# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 6 Discussions  
The respondents to the questionnaire generally consider the first steps in the drone lifecycle (such as production, operation systems, safety systems) to be the responsibility of the drone producer.  
The elements related to the use and maintenance of the device in their original form are generally considered the responsibility of the user or of cyber-security solutions installed on the drone.  
The drone, as a device, represents a benefit in every field of activity in which it intervenes. The use of drones in the economic field will definitely help the economy grow by making things go faster and easier. Being a part of the digitalization process, it also comes with a package of risks, but this situation provides specialists with reasons to keep on performing research in order to find solutions.  
The use cases considered in this section refer to flaws in the vulnerability management process. In terms of vulnerability identification, we analyzed the lack of identification in Section 5.1 (for general confidentiality or integrity vulnerabilities, reflecting H2 and H7) and Section 5.4 (for the availability vulnerabilities, reflecting H1 and H2) below. Furthermore, for the vulnerability identification and analyzed phase, for human error on the user/client side, Section 5.3 considers software changes or user-created software installed on the drone, reflecting H3 and H4. For the response phase, we analyzed the lack of proper addressing of vulnerabilities (either in lack of proper created patches, lack of timely patches or lack of proper patch applying to the drone software, in Section 5.2 and reflecting H5 and H6).  
There are various reasons for which an attack on a drone can be successful. This depends on various actions of the stakeholders involved in the drone ecosystem, from the producer of the hardware to the producer of the software and the user.  
According to [PERSON] et al., attacks on drones can target different security concepts [22], as follows: (a) privacy, which includes traffic analysis, interception, data capturing or location tracing; (b) integrity, where the most common types of attacks are substitution or alteration of the information, access control point modifications, man-in-the-middle and message forgery; (c) confidentiality, which can be compromised by identity spoofing, replay attacks or eavesdropping; (d) availability, which is prone to physical attacks, denial-of-service and distributed denial-of-service attacks, GPS spoofing or wi-fi jamming; and (e) trust, when the UAV components that rely on third party software or hardware are affected by malware infection, firmware replacement or other types of user's agreement violations. The motivation for the cyber-attack may differ (e.g., hacktivism, state cyber-attacks, commercial cyber-attacks on the drone producer or company using the drone). The purpose of this paper is to identify the civil liability angles and potential preventive steps that can be taken to minimize damages caused by cyber-attacks. This outcome is applicable irrespective of the motivation of the cyber-attack.  
Below, we outline the main use cases that can occur, with analysis of the liability that can be established under the current legal provisions and the proposal for clarification in terms of liability and in terms of obligation to ensure preventive measures against cyberattacks. The below are applicable also for the software within the drone, but also for the software on the user side handling the drone.