# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 5 Results
### Existing Vulnerabilities  
Vulnerabilities can be identified from the outset of software creation or can appear throughout the lifetime of the software, either for the source code created by the drone producer or by a third party in the supply chain. Even if legislation is not clear on the liability for vulnerabilities and obligation for establishing security measures, given this timeline, there are certain stakeholders that can practically be involved in the prevention of vulnerability exploitation and the fixing of vulnerabilities. The questionnaire addressed this topic in two questions: the first concerning the liability angle and the second the preventive security angle. The following question addressed this topic \"Who is liable in case the drone software contained vulnerabilities from the outset and these permitted a hacker to control the drone and generate damages? (Multiple choice question)\". The answer options for this question can be found in the legend of the figure below. As expected, the answers in Figure 4 show that, if there were certain manufacturing problems, the software producers would be responsible for the caused inconvenience. It is interesting to see that the drone distributer/seller is also considered to have a role in this respect. This is especially useful in cases where the drone is produced in another country than it is sold. This clarifies the issues around the applicability of different legislation and different legal requirements around the world. Furthermore, 17% of respondents consider that security should be the responsibility of a dedicated security solution, which does not necessarily belong to the drone producer. This view is reflected in the ranking of the preventive measures detailed below. H7 is validated, as the majority of respondents view the drone software producer as liable for the vulnerabilities in the drone software, with 44% of the responses. However, it is worth noting that 45% of the respondents view as liable two stakeholders that are involved in the auditing/verification of the drone software, respectively--17% consider the cyber security solution installed on the drone as liable and 28% consider the auditor/tester of the drone cyber security as liable. This suggests that the respondents view the cyber security checkpoints as liable for not properly identifying such vulnerabilities in a similar percentage as the drone software producer. In addition, the following question addressing this topic was \"Which of the following are useful preventive measures in case of software vulnerabilities included from the outset  
Figure 4: Liability in case of outset vulnerabilities. Source: Author’s processing. in the drone software? (1 to 5 scale, 1 representing total disagreement and 5 total agreement). Answer options: Cyber security auditing before the drone is placed on the market, Periodic cyber security auditing to be performed by the user in order to be allowed to fly the drone, Failsafe mechanisms in case the drone is taken over by hackers in order to safely land the drone and alert the user, Cyber security software to be included in the drone to prevent intrusions and respond to them\". If there are vulnerabilities in the drone software, the largest part of the respondents consider that the best preventive measure is for the information security software to be included from the factory onwards in the drone. Thus, it can act quickly and respond to existing reported problems (Table 2). The respondents consider the entrance into the market as the first point for vulnerability management. Furthermore, even higher in ranking is the need for a dedicated cyber security software to be installed on the drone in order to prevent attacks and to be able to respond to them. This is seen as more useful than periodic auditing of the drone, where real-time responses in case of vulnerabilities are essential. H2 was invalidated for the preventive measures on vulnerabilities.