# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 5 Results
### User Modified or Created Software  
Once the drones have been placed on the market, users start to wish to customize them either themselves or by using third party software. This can bring certain risks if proper governance is not created for this modification. The questionnaire addressed the liability aspects in order to see how the role of other stakeholders than the drone users are viewed by respondents, followed by addressing preventive measures for cyber risks in this use case. The following question addressed this topic: \"Who is liable in case the drone software was modified by the user and this modification generated the damages or drone crash or possibility of hacker to take over the drone? (Multiple choice question)\". The response options can be seen in the legend of the figure below. As we can see in Figure 6, respondents mostly consider the user as liable for modifying the drone software followed by in-flight incidents or hacker attacks. In this regard, the competent authorities should provide some appropriate sanctions. Additionally, in order to avoid this kind of situation, it would be necessary to specify a warning notification in the operating instructions of the device. Thus, the main perception of the respondents (60%) is that other entities (rather than the drone user) are liable for the software changes made to the drone. This outlines the view that preventive measures are essential and that these have to be integrated in a conjunct effort between drone software producers and authorities. This invalidates H4, which stated that drone users are liable for drone software changes. The majority of respondents (60%) consider the software producer liable for not having in place a mechanism to handle such situations, and only 40% considered the drone user to be liable. This demonstrates that specific mechanisms should be in place in order to prevent that drone users can make any changes to the drone software. The exact ranking of the preventive measures is outlined in the responses to Question 6 below. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Response/Scale** & **1** & **2** & **3** & **4** & **5** & **Average Score** \\ \hline The drone should not fly without the latest updates installed (either automatically or manually) & 20 & 14 & 35 & 34 & 141 & 4.07 \\ \hline The drone should automatically install the updates when it is on the ground within the timeline provided by the drone software producer & 13 & 14 & 33 & 36 & 148 & 4.20 \\ \hline The drone should fly irrespective if the new updates are installed or not & 131 & 37 & 22 & 24 & 30 & 2.12 \\ \hline The drone software producer should highlight to the user the criticality of the update and the user should decide when to install it & 34 & 22 & 42 & 41 & 105 & 3.66 \\ \hline \hline \end{tabular} Source: Author’s processing.  
\end{table} 
Table 3: Preventive measures for proper install of updates. The following question addressed this topic \"Which of the following are useful preventive measures to prevent damage/hacker attacks in cases of drone software being modified by the user? (1 to 5 scale, 1 representing total disagreement and 5 total agreement). Answer options: Any change to the drone software should be approved by the drone software producer, A certification mechanism should be in place to perform a cyber security review of any change in the drone software, Users should not be able to change the drone software.\"  
In the case of this question, as can be seen from Table 4 below, the proportions are very close for two of the three answer options. Firstly, respondents believe that a certification mechanism should be implemented to review any changes to drone software in terms of information security. Immediately following this, at 0.01 difference from the average score, was the proposal that any modification of the drone software must be approved by the manufacturer. As a conclusion to this question, we can summarize that the software manufacturer is the only one who can assume such duties.