# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
###### Abstract
Both types of legal requirements have as their goal the clarification of a stakeholder's role in the drone ecosystem and, thus, encouraging the safe usage of drones and, consequently, the increased wish of customers/companies to use drones in their day-to-day activities. A lack of clear legal provisions in terms of the prevention of cyber-attacks and liability for certain economic damages caused by a drone (e.g., caused by a cyber-attack) can impact the manner in which drone usability in various sectors of the economy is viewed by consumers and entities operating in those sectors [3]. The main issues refer to the lack of specific legislation and reliance on general tort law [4]. Tort law has in mind certain criteria for identifying the liable entity which may not reflect the specificity of the drone ecosystem [5]. In addition, the product liability legislation may be considered for certain aspects [6]. This article includes references to the pain points for the above in terms of legislative gaps and potential approaches that can be taken for such cases. This lack of legal requirements is also reflected in the literature, which addresses in a limited manner the aspects of liability and preventive measures in the case of drones. The relevant literature focuses more on the authorization part, on specific technical cyber-attack detection and on cyber-attack prevention. Furthermore, from an economical perspective, the relevant literature focuses more on the economic benefits of using drones and their functionality in various domains, rather than the cost-benefit analysis of having cyber-attack prevention mechanisms (organization or technical) in place. In order to develop our research paper, we analyzed the existing legislation and relevant literature based on the abovementioned three angles (legal, technical and economical). For the identified gaps, we proposed certain ways forward and validated these through a quantitative analysis (a questionnaire whereby we identified the view of the respondents based on the three main aspects: liability in case of cyber-attacks, choice of type of cyber-attack prevention mechanism and cost-benefit analysis of respondents for implementing such prevention mechanisms). The results of this questionnaire were analyzed from a quantitative perspective, while taking into account the various forms of cyber-attacks and prevention mechanisms, as detailed in the below sections. Three main conclusions are the result of our research, as detailed below. In terms of liability for cyber-attacks, we found that this is considered by respondents as being shared between stakeholders in the drone ecosystem, starting with the drone software producer, the distributor, the auditors/certification bodies and the drone user. This depends on the type of cyber-attack and on the role of the stakeholder. The questionnaire results identify particularities of liability for each type of cyber-attack analyzed. Prevention mechanisms also depend on the role of the stakeholder, especially for continuous monitoring and improvement of security posture. Respondents are of the view that the entire ecosystem related to drone production, distribution and usage is responsible for a part of the security measure design and implementation. Given the responses in terms of enhancing cyber-security technical and organizational measures, it can be concluded that respondents are willing to pay additional direct and indirect costs in order to benefit from more secure drones. The direct costs refer to various periodical maintenance or costs for security services/certifications. The indirect costs reflected in the price of the drone refer to steps taken by the stakeholders on the supply chain before the drone is used by the user.