# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 6 Discussions
### Proper Patching of Software  
Furthermore, related to the first use case, if the vulnerability is identified by the producer and the producer publishes a patch, there are various steps that can be taken and, depending on the actions taken by each stakeholder and the legal obligations, the liability can shift between the various stakeholders involved [30].  
Currently, legislation is not specific on handling vulnerabilities identified after the drone has been placed on the market. Aside from the specific drone legislation, general security requirements under Article 32 of the GDPR may be applicable if the drone holds personal data. If drones are used for critical infrastructures or NIS Directive operations, additional requirements become applicable. Introducing a clear process for vulnerability handling is essential to ensure trust on the drone market, to handle data swiftly and efficiently and to handle security measures properly throughout the lifecycle of the drone. EU Directive 2019/771 on the sale of goods includes a general obligation in Article 7 in terms of updates (including security updates), but without details on its implementations, as analyzed in the questionnaire question mentioned below.  
There are two main requirements for this aspect. The first is that of the timing for creating patches. Timing is essential and should be as soon as practically possible. The second concerns the deployment of patches. For this case, an impact assessment is to be performed on the most efficient technical solution, depending on the type of patch. One option that can ensure the limitation of risks is that of not allowing the flight of drones without implementation of the most recent patches. Of course, the obligations on the producer side can be correlated with training on the side of the user, as part of the training and certification.  
Furthermore, the angles concerning liability mentioned in Section 5.1 are applicable for patching as well. This is relevant especially if there is no express legal requirement to analyze identified vulnerabilities and patch them. Furthermore, if no timeframe for patch creation and patch dispatch is provided under the law, liability may be difficult to establish.  
Similar to the measures under Section 5.1, the measures in this section have an impact in terms of costs on the producer side. The security advantages have to be taken into consideration along with the benefits they bring in a cost-benefit analysis of the level of security measures to be implemented [31].  
Furthermore, they can have an impact on usability, as the maturity of users concerning cybersecurity measures is relevant in order to understand the need for patching and the manner in which this is performed. Of course, it can be extended to the notification of any identified vulnerabilities. This can be achieved through training and including cyber security components in the certification process. This maturity level increases users' acceptance of drones for day-to-day commercial activities and any increase in costs due to security prevention measures.  
Similarly, for updates on drone software, 55% of respondents consider the producer liable in the case of the lack of proper updating of drone software, with H6 being validated. Furthermore, their view is that the drone producer should implement technical measures to make the updating mandatory before flight or to indicate the criticality of updates in order to alert and inform the user properly. H5 is invalidated, as the respondents do not view lack of flying without all updates as a necessary preventive measure.