Counter-Drone Paperwork for Local Police Goes to OMB: 14 Forms, 1,850 Agencies, a Dec. 4 Deadline

Fourteen forms. That is what stands between a sheriff’s office or a state prison system and the counter-drone authority Congress handed it last December. The FBI asked on November 4 for a standard three-year approval of those forms from the Office of Management and Budget, and the last window to comment on them closes December 4 [1].

The paperwork behind the authority

The SAFER SKIES Act, Title LXXXVI of the defense authorization law signed December 18, 2025, lets state, local, tribal and territorial police and corrections agencies detect, track and, if trained, take down drones that pose a credible threat [3]. The statute shields them from the federal wiretap, pen register, computer fraud and aircraft piracy laws that kept local agencies out of this work. It also overrides “the laws of any particular State, local, Tribal, or territorial jurisdiction,” but only “after completing the training” the statute describes [4].

The Justice Department and Homeland Security wrote the conditions into an interim final rule, effective July 1, 2026, at 6 CFR and 28 CFR part 124 [3]. The forms are how an agency proves it meets those conditions. OMB approved them on an emergency basis, and that approval expires November 30, 2026 [1]. The Justice Department notes that a collection under review gets month-to-month extensions while OMB works [1], so the forms should not go dark on December 1.

The list runs C-UAS-ATT through C-UAS-TTE: policy attestation, operations plans, advance notification, mutual aid, post-operation reports, extended retention notices, a semiannual summary and more [1]. The FBI expects 1,850 agencies to file: about 1,500 at the detection tier and 350 at the mitigation tier [2]. Its November estimate is 28,689 hours a year across roughly 26,205 filings, up from 25,314 hours and 24,355 filings in the September draft [1, 2].

What the forms ask of a department

Start with the two tiers, because they set the workload.

Detection and Warning Certification is an online course with an assessment, issued automatically on completion [3]. Mitigation Certification, which covers jamming, taking control of or destroying a drone, is a two-week residential course at the FBI’s National Counter-UAS Training Center at Redstone Arsenal, Alabama [5]. As of July 1, the center had trained 61 officers from 46 agencies [5]. The training is free to the officer. Travel and backfill for two weeks are not, and the Congressional Research Service flagged that cost as a possible barrier [5].

Not every sensor triggers the rule. Cameras, acoustic sensors and FCC-authorized radar intercept no communications, so the rule says the training requirement does not attach to them [3]. Equipment that reads a drone’s control link does.

Each agency adopts its own implementation policy, has counsel review it and attests through the portal; nobody in Washington pre-approves it [3]. The rule chose self-certification with audit and suspension power because, in the departments’ words, pre-approving thousands of policies “would create a Federal bottleneck” [3]. Every operation needs a C-UAS Operations Plan signed by the agency’s approving official. Prisons and critical infrastructure sites can hold a standing plan for up to 365 days [5]. Activating a mitigation system means notifying the FAA within five minutes, and a takedown or confiscation must be reported within 48 hours [5].

The estimates have moved. The July rule priced a mitigation operations plan at about 3 hours [3]. The September notice put it at about 1 hour, even though the forms collect more data, because the revised versions replace free text with structured choices and carry data over from the advance notification [2]. Initial policy adoption and attestation is now estimated at about 5 hours [1].

The July rule’s own total was far higher: a central estimate of about 72,000 hours a year, built on 150 mitigation-tier agencies each running 15 operations a year [3]. The notices assume more mitigation agencies and fewer total hours [1, 2]. Neither document explains the gap. Budget offices planning staff time should know the range exists.

One more operational fact sits in the November notice. The forms now move through an “offline, emailed workflow.” A secure web portal is expected in the second or third quarter of fiscal 2027 [1].

One comment, several changes

The September notice drew a single public comment, from an independent researcher [1]. It questioned the cost burden, the basis for the recordkeeping estimates and how retained records are treated. The FBI made, or committed to, changes agencies will see [1]:

• a one-time form training line in the burden table
• recordkeeping estimates split by tier, with the mitigation-tier figure raised
• a State-law citation field on the Extended Retention Notification
• published data schemas for each form
• a one-step “no-activity” semiannual summary for detection-tier agencies

That last one matters to the small department that certifies, buys a detector and has a quiet six months. Its semiannual filing becomes one step.

The retention notice connects to the privacy rules. Drone control communications may be kept no more than 180 days unless an exception applies, such as an open investigation, and an agency keeping them longer must tell the FBI within 30 days [3]. Agencies running standing detection for more than 30 days must review the scope of interception at least quarterly [3]. The rule also bars using the authority “solely to seize, monitor, deter, interfere with, or disrupt individuals exercising rights protected by the First Amendment” [3].

Corrections chiefs, troopers and a law professor

The record on this authority predates the Act. At a Senate Judiciary hearing on May 20, 2025, Ricky Dixon, Florida’s corrections secretary and president of the American Correctional Association, said drones deliver fentanyl, weapons and phones into prisons, and that each incursion forces a lockdown. He asked for “a comprehensive, scalable, and well regulated legal framework” with funding, training and oversight [6]. Sgt. Robert Dooley of the Florida Highway Patrol asked for “limited, controlled UAS authority by vetted and trained public safety entities under Federal oversight” [6].

Laura Donohue of Georgetown Law testified about the federal authority as it stood then. “What Congress passes cannot be a blank check,” she said, arguing that the statute raised First, Fourth, Fifth and Tenth Amendment concerns and operated like a general warrant [6]. She proposed a probable cause warrant to target specific drones, with exigency and border exceptions, substantive First Amendment protections, and state control over drones below 400 feet [6].

The final law took a different route. It added training, certification, an authorized-equipment list and the privacy terms the rule now spells out, but no warrant requirement [3, 4]. The rule also points to a June 12, 2026 charging memo from Acting Attorney General Blanche that shielded some local detection work from federal wiretap charges ahead of the World Cup. The memo did nothing about state law; only certification under the Act does [3].

What I’m watching

December 4. The OMB comment window closes [1]. Agencies that have already filed under the emailed workflow know better than anyone whether 45 minutes per post-operation report holds up [2]. This is the place to say so.

The final rule. The interim rule’s comment period closed September 4 [3]. The departments asked whether certifications should expire after a period such as 36 or 48 months [3]. No final rule has a date yet. The authority itself ends December 31, 2031 [4].