Short Bursts:
COTS Drones are not COTS Drones: Avoiding a Dangerous Misconception in UAS Operational Employment

By Capt T.J. Curran

Over the past two years, military professionals have been inundated with news articles and commentary, about the proliferation of commercial-of-the-shelf (COTS) uncrewed aerial systems (UAS) being used as weapons in the war in Ukraine. NATO and nations all over observing the conflict have recognized the need to adapt to this new paradigm, and fast. However, this drive for rapid adoption has exposed major and potentially fatal vulnerabilities in the Force.

The British Army, since 2023, have opened the flood gates on COTS UAS adoption and adopted a policy with a relatively simple process for all army units, regardless of cap badge or specialty, to purchase and operate commercial UAS for training and experimentation purposes. Under this program, units may purchase whatever systems they like as long as they get them registered and classified with the Military Aviation Authority (MAA).^{Footnote 1}  This has led to rapid adoption in units such as 2nd Battalion, The Parachute Regiment, who now operate commercial UAS as a matter of course in all their sub-units.

However, this adoption of COTS UAS systems for military purposes, exposed the British Army to major operational security and force protection risks. The misconception is such: the use of the term “COTS”, in mainstream news and amateur defence reporting, is functionally a misnomer. In fact, the DJI Mavic or Parrot Anafi you may buy from your local RadioShack, is not the same drone you will encounter on the battlefields of Ukraine today. Equally often, the term COTS is mis-used to describe UAS systems developed from commercial components, but specifically designed for warfare, mitigating the vulnerabilities discussed below.

Unmodified COTS UAS are riddled with potentially lethal vulnerabilities and limitations to their military utility. For one, most contemporary COTS UAS transmit the location and ID of the RPAS and pilot, this is now legally required for COTS UAS in the U.S.^{Footnote 2}   UAS manufacturers may also restrict their platforms from flying in restricted areas defined by GPS coordinates, or in the absence of GPS signal. These features, which contribute to public safety domestically, are dangerous and limiting to UAS operators in a warzone. Anyone with a cheap commercial software defined radio receiver could exploit these vulnerabilities by manipulating GPS signals or intercepting the live location of the operator.

Ukrainian and Russian forces still buy thousands of UAS from commercial manufacturers^{Footnote 3}  (such as DJI and Parrot), but they no longer send them direct to the frontline, as they did at the outset of the conflict in 2022. Instead, UAS systems bought off-the-shelf are sent to workshops behind the frontline to be modified for military use by hacking the software and firmware of the drone and integrating components such as encrypted communication chips, fibre-optic cabling or hardened GPS receivers. These modifications limit the exploitable aspects of the UAS.

It is these modifications which make the “no longer off-the-shelf” UAS systems combat capable and dangerous today. Without them, COTS UAS are littered with vulnerabilities that will prevent successful UAS operations against even mildly prepared adversaries, and almost certainly get the operators killed by betraying their location. The progress of battlefield evolution is such, that the era of COTS drones was with us and gone in a matter of months.

Since early 2022, the effectiveness of the electronic warfare (EW) organisations on both sides virtually guarantees that un-hardened UAS will be exploited and defeated. In May 2023, the Royal United Services Institute, a prestigious defence and security think tank headquartered in the UK, reported that Ukraine was losing around 10,000 UAS per month. Russian EW systems, primarily focussed on the counter unmanned aerial systems (C-UAS) task, are as prolific as one system per 10km of frontage. Many manufacturers alongside their UAS products, offer a dedicated product specifically designed to defeat and exploit their own UAS systems. One such system is DJI’s AeroScope, which first hit the market in 2017. AeroScope was rapidly procured in large quantities by Russia in early 2022 as a response to Ukrainian use of unmodified DJI UAS early in the conflict.^{Footnote 4}   

Unfortunately, this major misconception about the nature of the systems currently operating in Ukraine is prolific. The vast majority of Parrot and other UAS procured by the British Army would be an absolute liability in actual combat with a near-peer or peer adversary. Evidently, even some of the most professional armies in the world have themselves fallen victim to this mistaken impression.

To their credit, the UK Cyber Force recognised the issue in April 2024, and issued a moratorium on the overseas use of these COTS UAS. However, the integration of COTS UAS, commercial electronics and other technologies is an inevitable evolution in modern warfare. Fortunately, Ukraine has already pioneered many of the necessary modifications necessary to make most COTS UAS operationally capable in a near-peer or peer threat environment. Instead of ceasing overseas activity, the UK Armed Forces could invest in modifying their COTS UAS fleets to mitigate the inherent vulnerabilities previously discussed. Many of these modifications, such as the CIA Jeep Doors hack, are available for free through open-source file sharing sites like GitHub.

The pace of innovation on the battlefield is astounding, Ukrainian senior officers estimate that a battlefield innovation such as a new, more resilient comms link, lasts about 3 months before the counter to this technology hits the battlefield.^{Footnote 5}  We in the Canadian Armed Forces must be mindful that our adoption of battlefield lessons is wholly informed and continuously reviewed. The CAF must embrace the innovations of COTS UAS to remain relevant as a fighting force. We must also ensure we have the underlying systems and understanding to adapt and innovate at the speed of relevance, rather than learning yesterday’s lesson tomorrow.

About the author

Taylor Curran is a Captain in the Royal Canadian Corps of Signals. A graduate of the Royal Military College (2019) with a bachelor’s in electrical engineering, he has specialised in Electromagnetic Warfare. He spent 3 years at 21 EW Regt in Kingston and deployed twice on Op REASSURANCE in EW roles. He is currently the Canadian Army Exchange Officer at the U.K.’s 14th Signal Regiment (EW) serving as the Regimental Training Officer.

This article first appeared online in the Short Bursts section of the Canadian Army Journal (August 2025).