A US Army soldier aims a handheld counter-drone device at a simulated aerial threat in Lithuania
U.S. Army Staff Sgt. Pierce Gallegos engages a simulated aerial threat with a counter-drone device during training at Pabradė Training Area, Lithuania, May 22, 2026. Photo: U.S. Army / Sgt. Max Elliott (public domain)

Information is a major instrument of statecraft. Social media is a major global influence. What sort of particular intelligence is required to support policy decisions in the areas of Unmanned Aerial Vehicle (UAV) policy and operations; Cyberwarfare and Cyber Influence Operations?

Situation

According to the Annual Threat Assessment report, “Disruptions to Europe’s critical infrastructure by state-affiliated actors have the potential to cause loss of life, harm U.S. and European commercial interests, and affect Ukrainian military supplies. For example, European countries are increasing spending on capabilities to detect, track, identify, and counter small UAVs and other threats.

According to the recent research article published by the Department of Homeland Security, “Drones are transforming industries nationwide, but they are also increasingly exploited by malicious actors. The new DHS Program Executive Office for Unmanned Aircraft Systems and Counter-Unmanned Aircraft Systems will oversee strategic investments in drone and counter-drone technologies that can outpace evolving threats and tactics.”

Complication

S&T Senior Advisor, the Hon. Daniel J. Tamburello, “Until recently, this high level of sophistication and elevated threat from s-UAS has been mostly limited to the realm of state actors. However, these drones are now within reach of transnational criminal organizations, terrorists, and even lone actors.”

Resolution

Cybersecurity and Infrastructure Security Agency, Protecting Against the Threat of Unmanned Aircraft Systems issued a guide. Specific risk protection activities against UAVs and UAVs threats are described in this report. Risk protection activities include:

  • Identify threats
  • Identify pre-incident indicators
  • Identify threat actors
  • Identify threat TTPs
  • Identify vulnerabilities
  • Threat information sharing
  • Integration of protection activities
  • Recommend countermeasures
  • Investigate crimes and terrorist acts, includes threat investigations
  • Threat detection

Effective statecraft requires precision intelligence. UAV operations, cyberwarfare, and cyber influence operations dictate specific collection priorities.

Intelligence for UAV Policy and Operations

UAV operations and decisions on threat prevention depend heavily on technical and geospatial data. An intelligence should be collected in several areas and based on objectives of tactical and strategical levels. Recently, several adversarial nation-states (China, Russia, Iran, North Korea) and Ukraine have invested a lot of efforts into development of UAVs for defense and attack purposes.

Thus, the intelligence collected for the analysis and processing include:

A collection of intelligence and statistical data on UAV systems, operators, production sites have to be collected and analyzed, for example, including, but not limited to: register of locally produced UAV systems, register of production sites and technical capacity, technical characteristics of UAVs, register of operators, register of local universities capable to train the software developers and UAV operators, register of training facilities for UAV operators, register of all companies involved in Export/Import operations of UAVs and spare parts, list of sanctioned operators and producers, export and import volumes of UAVs and spare parts, usage of supplementary technologies and substitute, usage of UAV software, register of local UAV software companies. The collection to be made in adversarial nation-states and selected countries which may develop a threat to the US security.

US policymakers require exact data on the adversaries’ capabilities of UAVs including operational ranges, payload capacities, and encryption standards. The technological advancement lead to the intelligence assessment and consequential policy response and decisions for GEOINT and SIGINT intelligence collection.

Satellite imagery provides target identification and real-time damage assessments.

Army missions require precise mapping. A real-time access to the data is much preferred for decision-making purposes.The tracing of dual-use component flows should be implement to monitor and control export/import flows and sanctions. In order to analyze production volumes and technical capabilities of UAVs. Analysts must analyze foreign electronic warfare capabilities and GPS jamming techniques in order to develop anti-jamming techniques and advance proprietary protection measures.

Intelligence for Anti-cyberwarfare

Cyberwarfare policy shifts focus toward network architecture and source attribution. Recently, several adversarial nation-states (China, Russia, Iran, North Korea) and Ukraine have invested a lot of efforts into development of cyberwarfare for defense and attack purposes.

Thus, the intelligence collected for the analysis and processing include:

A collection of intelligence and statistical data on operators of cyber-ware in chosen nation-states including, but not limited to: register of cyberwarfare operators and cyber-centers (state-owned and private), register of state-owned cyber operations sites, register of cyber-related software companies and hardware companies, register of incumbent operators, register of local universities able to train for the cyber defense and consequentially cyber-attack, register of local white and black hackers, register of hacking attacks locally and internationally, register of all companies involved in Export/Import operations related to cyber security, list of local sanctioned operators.

Forensic evaluation of attribution codes. The isolation of malicious code and command servers links digital attacks to specific state actors. Threat identification demands forensic evaluation.

Infrastructural risks and threats. The Intelligence Community should evaluate weaknesses within national power grids, financial networks, and military communications.

Monitoring activities: Deterrence strategy depends on weapon monitoring. Analysts track foreign zero-day exploit development and autonomous cyber mechanisms. This data will help to develop and decide on defensive and offensive options.

Intelligence for Anti-Cyber Influence Operations

Cyber influence operations exploit global digital communication networks. This theater requires open-source collection, pattern and behavioral analysis of nation-state adversaries and non-nation-state terrorist actors.

Recently, several adversarial nation-states (China, Russia, Iran, North Korea) and Ukraine have invested a lot of efforts into development of Influence and Narrative Operations for defense and attack purposes.

Thus, the intelligence collected for the analysis and processing include:

A collection of intelligence and statistical data on operators of influence operations in chosen nation-states including, but not limited to: register of influence actors (state-owned and private), register of state-owned influence operations sites and companies, register of financing sources for PsyOp and Influence operations (local oligarchs, media magnates, corrupt politicians, state-actors, state agencies, foreign financing sources), list of propaganda journalists, register of media-outlets, register of near-state contractors, register of PsyOp networks within the country.

Inauthentic Behavior: Adversarial campaigns utilize automated networks. Analysts detect foreign botnets and coordinated troll farms. These assets exploit domestic societal divisions.

Narrative Vectors: Disinformation campaigns follow predictable paths. Tracking mechanisms monitor the origin, speed, and target demographics of hostile data streams.

Target Vulnerability: Cognitive warfare affects public trust. Intelligence assesses population susceptibility to foreign manipulation. This analysis measures the degradation of institutional stability.

Conclusion

UAV operations, cyberwarfare, and cyber influence operations represent distinct areas of modern conflict. All three can be used for hybrid military operations and proxy wars. UAV policy requires precise physical and technical metrics. Cyberwarfare demands deep infrastructural and architectural visibility. Cyber influence operations require the psychological and algorithmic mapping of the global information space.

Bibliography