# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 6 Discussions
### Existing Vulnerabilities  
One use case relates to the software within the drone to contain vulnerabilities that can be exploited by attackers. Annex IX of Regulation (EU) 2018/1139 [23] on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency includes a general requirement for the mitigation of risks pertaining to privacy and security, including privacy by design and security by design. Nevertheless, such requirements are rather general and do not address the need for a continuous monitoring of the threat landscape, similar to those in Regulation (EU) 2019/945 [24]. This existing legislation refers to obligations pertaining to the producer of the drone and the entity performing marketing for the drone. Such obligations also include, in article 77 (h) of Regulation (EU) 2018/1139, an obligation for the dissemination of any vulnerabilities or security issues. This can be better reflected in the legislation specific for drones with specific processes for direct communication to users (not just public communications) and can involve a specific authority (such as EASA-European Union Aviation Safety Agency) for setting up the process efficiently. There are discussions on the applicability of other specific legislation on machinery and radio equipment to drones [25; 26]. However, the machinery directive contains only general health and safety requirements and liability, with a general reference to using a risk-based approach (including faulty hardware and software) and requirement for the emergency stopping of the drone in the case of cyber-attacks. Currently, a revision proposal from the EU is awaited in order to address new technologies. In this case, under existing civil tort law, the liability can be considered to pertain to the drone hardware or software producer if a direct liaison can be made between a specific vulnerability and the cyber-attack, provided the user properly handled the drone throughout its life. The liaison and the latter condition on proper usage is difficult to prove in practice. There are situations in which disclaimers can be made by the producer from the outset, such as a period of usability without maintenance of the drone, a lack of liability in cases where the drone is connected to personal devices of the user used also for other activities, etc. This type of liability is a fault-based liability specific for civil law, with common law jurisdictions having a slightly different perspective, but having as its starting point the same principle. The tort liability is generally difficult to establish in cases where there is inactivity of an entity (e.g., the producer of a drone), especially if there are no specific legal obligations for such entity with respect to the respective inactivity [27]. This can be the case for many instances in which vulnerabilities appear in time due to evolution in technology or improper development of drones even when current best practices have been implemented. In such cases, as there is no specific legal requirement for identifying and fixing the vulnerability in a timely manner, tort liability may not be applicable to many situations. Details regarding the proposed recommendations in terms of timing and response are included in Section 5.2. Furthermore, in terms of the burden of proof, under civil law, this belongs to the injured party. In this respect, by having clear strict liability for certain aspects, the burden of proof shifts to the other responsible entities. Nevertheless, strict liability may inhibit the progress and testing of drones. Furthermore, it may limit the entrance into the market of new players. Thus, having preventive steps in place may aid in this respect. This entails adding more clarity to the legal requirements mentioned above about privacy and security technical functionalities in order to include a risk assessment process and a continuous monitoring of risks and communication between stakeholders.