# Legal, Economic and Cyber Security Framework Considerations for Drone Usage
## 6 Discussions
### Existing Vulnerabilities
This is closely related to the approach mentioned recently by studies performed by the European Union in relation to the product liability EU directive [28]. Currently, this mentions certain technical specifications that must comply with specific industry standardsand, if such standards do not exist, with state of the art in the field. This approach is not in line with technical changes that occur throughout the lifetime of the drone. Even if the software is considered state of the art when it is created, aside from inherent vulnerabilities in the software, changing technology and threat actor methods and techniques can generate new vulnerabilities to previously secure software. For this reason, continuous monitoring and analysis of the drone vulnerabilities is essential. This reflects that an exemption provided by the liability for defective products directive may be applicable (including that under Article 7(b) of the liability for defective products EU directive). Excessive liability rules without prevention and maintenance mechanisms in place may lead to withdrawal from the market of versions that are found to have critical vulnerabilities, which can lead to loss of profit either for the buyer or for the producers. This would distort the drone market and, thus, preventive steps and close monitoring of cyber-risks can prevent this from occurring [29]. The choice of jurisdiction is also essential for this use case. It depends on the specifics and the national legislation where the damage is caused. This also entails, in certain cases, cross-border liability under the 1952 Rome Convention. In addition, generally, irrespective of the location in which the drones are produced, placing a drone on the EU market makes it subject to the requirements (including health and safety) under EU law. Further, the liability rules become applicable as well. Nevertheless, we are not analyzing this angle in this paper. Training for flying in case of malfunctioning or cyber-attack can be also a preventive measure to be implemented, together with insurance held by users of the drones (similar to the automotive sector). Currently, there is an obligation under European law to hold insurance for drones weighing more than 20 kg, with certain EU member states opting for additional situations in which insurance should be held. These two measures add to the trust level in the drone usage for commercial purposes, and their costs should also be integrated in the cost-benefit analysis upon implementation. The view of the respondents is similar for the vulnerabilities existing in the drone software. Overall, 44% of respondents mentioned the drone producer as being responsible for any consequences of exploited vulnerabilities, whereas 28% of respondents view the entity that audited the drone as being responsible, validating H7. This is correlated with the preventive measure ranked primarily by the respondents as being useful in this case, followed by periodical auditing and including a cyber-security solution in the drone to detect and prevent cyber-attacks. H2 is invalidated for the vulnerability part, as the failsafe prevention measure is not the highest rated option. As expected, the software producer is considered mainly responsible by the respondents, with the entity that audited the drone being considered accountable as well. Thus, additional clarification in this respect may also be taken by the legislator. Such clarification has a beneficial effect on drone usage, as clarity in terms of liability brings trust into the ecosystem. As it was identified in the questionnaire, the respondents consider the most important point in time to address vulnerabilities as being the entrance into the market. Nevertheless, continuous monitoring of vulnerabilities is of highest concern to the respondents. This is closely tied to the liability for vulnerabilities, as it brings into play the stakeholders from the ecosystem that can bridge the cybersecurity gap by identifying and addressing vulnerabilities.