Wire

Pentagon drone plans would have to go public

The Defense Department would need to post the unclassified report online within 30 days, while keeping a classified annex separate. The same language also calls for yearly updates and tougher cybersecurity design rules if the system moves ahead.

In Washington, a Pentagon drone blueprint would have to be written for two audiences at once: the public and the classified channels that handle sensitive detail. The amendment would require the Defense Department’s unmanned-systems command-and-control report, the software, communications protocols, data standards and hardware that let operators task, direct and monitor drone systems, to be submitted in unclassified form, though it could carry a classified annex.

The unclassified portions would have to be posted on the department’s public website within 30 days. That means the basic shape of the plan would not sit only inside government files; it would be visible to people trying to understand how the Pentagon wants future drone networks to work.

A five-year paper trail

The report would not be a one-and-done filing. For five years after the final report, the Secretary of Defense would have to fold an annual update into the budget justification materials sent to Congress.

Those updates would have to cover what the department did in response to the recommendations, changes in allied or partner-country command-and-control practices, new technologies or cybersecurity threats, and any pilots, exercises or acquisitions launched from the report.

Built to be patched

The amendment also reaches into design. Any framework recommended in the report, and any system developed or bought from it, would have to use modular open systems architecture, a setup that lets software and hardware pieces be updated, replaced or patched without redesigning the whole machine.

It would also require supply-chain risk management, current National Institute of Standards and Technology cybersecurity guidance, a documented vulnerability-disclosure process and red-team testing every two years after fielding. The point is to make the system easier to fix as threats change, not just harder to break on day one.

Back to wire