Drone Security Risks at the FIFA World Cup
Georgia Tech experts explore the drone-related security risks facing FIFA World Cup venues, from cyber threats and surveillance to airspace violations.
The usage of drones, or uncrewed aerial vehicles, has become a widely discussed topic in the current news cycle. From influencer content capture, farming, delivery and logistics, to the bleeding edge of warfare technology, drones have become a central component in the modern technology landscape. The vast capabilities of even the most basic consumer drones have now added an additional series of challenges for security professionals at large-scale events like the FIFA World Cup.
Why Event Organizers Worry About Drones
At major public and private events, remote pilots and security professionals are finding difficulty balancing functionality and risk-management. The Federal Aviation Administration has attempted to curb the usage around densely populated events by codifying rules for remote pilots through regulations like CFR Part 107 and issuing temporary flight restrictions (TFRs).
While CFR Part 107 lays out clear guidelines for the employment of drones around crowds and large events, some remote pilots ignore these regulations for a multitude of reasons. As a result of these infractions, law enforcement is often forced to begin issuing fines and confiscating unauthorized drones.
But why should FIFA and the FAA be so concerned about drone usage around World Cup events? There are multiple reasons.
“A World Cup venue concentrates tens of thousands of people in a fixed, highly publicized location, which makes the airspace above it an attractive and hard-to-defend attack surface," says Saman Zonouz, Associate Professor and director of Online Master of Science in Cybersecurity (OMS Cybersecurity) Cyber-Physical Systems track, adding that there are three main lines of concern.
The first is safety, where even a malfunctioning or colliding drone over a packed stadium is dangerous. "Such a drone malfunction could be caused by conventional component failures (e.g., broken propeller or sensor), or because of cyber-attacks (e.g., infected firmware on the drone, GPS spoofing attacks, etc)," he explains.
The second concern is security, where a drone is a cheap, agile sensor for surveilling crowds, security postures, and VIP movements; the third, and worst case, is weaponization, similar to what was seen in earlier phases of the Russia-Ukraine war with weaponized recreational DJI drones.
The Weaponization of Uncrewed Aerial Vehicles
Jenna Jordan, Associate Chair and Associate Professor, Sam Nunn School of International Affairs and director of Georgia Tech’s Master of Science in International Security Online (MSISEC Online), shares Zonouz's concerns about the multiple safety issues drones can cause, especially during a global event.
“The World Cup this year poses a very large security challenge," she says. "You have 78 matches across 11 cities in the United States. Beyond that, there are fan festivals, public viewing areas, hotels, transfer hubs, and formal or informal gathering spaces. The concern is that drones can create multiple security risks such as intelligence collection and surveillance capabilities (photography and video recording), communications interference (jamming), and physical disruption of the event."
She also expressed her concerns about the potential of weaponization of drones.
"Security officials are concerned about drones collecting information on ingress and egress routes, emergency evacuation routes, security checkpoints, police security locations, and VIP movements," Jordan explains. "There are dignitaries attending these events, at hotels and lodging locations. The information and surveillance collection is a security concern from FIFA's perspective.
"All this footage can become very valuable when combined with other information," she adds. "It could reveal vulnerabilities and security plans. If there were an emergency or a security event, it could complicate response efforts.”
Drones, like any other system receiving telemetry, are susceptible to being hacked by threat actors. Remote pilots, unaware of this possibility, can introduce new threats into an environment simply by attempting to fly near an area with a TFR. The idea of a benign system being overtaken by a malicious actor is nothing new.
The fact that this has become a normalized activity solidifies the need to reduce the number of aircraft within a secure airspace.
"The FAA sometimes enforces temporary flight restrictions over stadiums precisely because, unlike a fence or a metal detector, you cannot simply wall off the sky," Zonouz says.
According to Zonouz, consumer and prosumer drones are easy targets for bad actors, as they were designed with affordability and ease of use as top priorities, not resilience against sophisticated adversaries. That means they rely on radio links, GPS, telemetry, and companion apps largely designed assuming a "benign environment."
While the risk exists, there are ongoing efforts by Zonouz and his team to help make the skies safer.
Combating Danger in the Skies
In his lab at Georgia Tech, researchers have reverse-engineered drone firmware, communication protocols, ground control stations, and controller software to better understand where vulnerabilities exist. Their analyses have uncovered weaknesses throughout the technology stack that could allow attackers to manipulate or disrupt a drone's operation.
"The realistic attacks span the whole stack," Zonouz describes. "Depending on the model, an attacker can seize flight control, force a landing or a fly-away, or pull the live footage straight off the air."
Zonouz and his lab also study risks embedded early in the technology lifecycle. Software and hardware supply chain compromises can introduce malicious code before a drone ever reaches its owner. These hidden backdoors may enable future remote access, while "logic bombs" can remain dormant until triggered by specific conditions, such as a drone reaching a particular location.
To better understand and defend against these threats, Zonouz's research group develops and demonstrates advanced malware designed to mimic real-world adversarial techniques in controlled environments.
While there may never be a single solution for managing drone activity around major international events like the FIFA World Cup, security experts emphasize that effective protection depends on a layered approach. That concept, often referred to as "defense in depth," combines technology, policy, monitoring, and responsible operation to reduce risk.
For drone operators, that responsibility begins with following Federal Aviation Administration (FAA) regulations and respecting temporary flight restrictions established around large public events. Choosing to keep drones grounded in restricted areas helps preserve a safe and secure airspace, allowing security professionals to focus on identifying and responding to genuine threats.
As Zonouz notes, protecting increasingly connected technologies is not solely the responsibility of cybersecurity researchers or law enforcement. It requires cooperation from manufacturers, policymakers, security professionals, and the public alike.
