DHS ‘struggling’ with counter-drone measures leading up to World Cup

The Department of Homeland Security is feeling the effects of its historically long shutdown as it gears up to mitigate and manage an evolving threat landscape tied to the FIFA World Cup, which is set to kick off next week. 

While Secretary Markwayne Mullin told lawmakers Wednesday that the agency is in a “comfortable” position when it comes to preparation for the festivities overall, drones pose a challenge. 

“The biggest concern I have is, honestly, with drone defense,” Mullin said during a fiscal 2027 budget hearing. “It is one of the areas that we are struggling with every single day.” 

Drones have had a growing presence at large events. At the Formula 1 Miami Grand Prix in May, Mullin said there were eight drones that entered the space that shouldn’t have been there. At the April Masters Tournament in Augusta, Ga., there were 12 drones that breached the no-fly zone. 

The top DHS leader said all 11 World Cup stadiums currently have counter-drone equipment, but concerns remain. 

“We have spent a tremendous amount of ability and money to be able to be very offensive with drones, but on the counter-drone measures, everybody’s a little behind,” Mullin said. 

Part of the lag can be blamed on funding gaps. In December, the Federal Emergency Management Agency announced $250 million in funding for states hosting the events. The DHS unit was also in charge of a $625 million grant program meant to support FIFA security programs. Those funds weren’t sent to host cities during the DHS shutdown. 

Faced with potentially cancelling fan events and cutting corners elsewhere, host cities advocated for the release of the funding.

“After 76 days of being shut down… we had to start really focusing on FIFA because we were behind,” Mullin said. “We’re not totally caught up.”

Deputy Secretary Troy Edgar said DHS has released about $6 billion in FEMA funds since Mullin took over.  

Cross-agency collaboration

The Department of Transportation’s Federal Aviation Administration is also working to combat drone threats, along with the Department of Justice’s FBI. 

The FAA has established temporary flight restrictions around World Cup stadiums and venues. People who violate the restriction can be fined up to $100,000, spend up to a year in prison and have their drone seized. 

“There will be no grace period for violators,” Brett Skiles, special agent in charge at the FBI’s Miami field office, said during a press conference last week.

FBI co-Deputy Director Andrew Bailey, who was also at the event, said six officers from the Miami area and one from Tampa are now certified in counter-UAS operations after graduating from a program hosted by the recently established FBI National Counter Drone Training Program in Huntsville, Ala. 

“In coordination with the Federal Air Marshal Service, we will detect and neutralize all unauthorized drone activity that threatens the matches and the fan-fest events,” Bailey said. 

The devil in the cyber details

While drones are a major threat, cyber is also top of mind for agencies involved in the World Cup preparations. 

“When we look at the World Cup and the ecosystem around the event, that’s the convergence of your physical security and your cybersecurity,” Justin Miller, associate professor of practice of cyber studies at the University of Tulsa, told FedScoop. “If a ticketing system fails, transportation goes down or access controls break, you can quickly move from a cyber incident to crowd confusion and public safety concern.” 

Miller spent nearly 25 years as part of DHS’s Secret Service, retiring in 2024 as a senior special agent. During one event, he monitored the critical systems at a college in Arizona for a vice presidential visit. 

“I started asking, ‘what happens if the water system drops?’” Miller said, pointing to small details that can have outsized consequences. 

If the pressure dropped and a fire alarm went off during a vice president’s speech, that could lead to a chaotic crowd reaction. Or, if the water pressure dropped and there’s a fire in the facility, there might not be enough pressure to accurately spread the water throughout the system. A threat actor could take advantage of either situation. 

“There’s a critical system specialist tied to the World Cup, to the Olympics, that is discussing those exact things,” Miller said. 

A cyberattack doesn’t have to destroy entire systems to create disruptions, Miller added — it only has to create a gap in trust. The federal government, as well as local partners, are working together to build in redundancy and alternative plans. 

“In cyber, you’re going up against well-trained, well-funded and practiced individuals,” Miller said. “You’ve got to try to think creatively.”

The pressure on FBI, DHS and local partners is mounting as the games draw closer, placing an emphasis on removing “external” obstacles such as the funding lapses at DHS, according to Miller. 

“When we pay people their salary, I think they’re locked in, but when you start not paying them and creating external pressure, we start getting gaps in our operations,” Miller said. “It doesn’t matter how robust your computer system is, how strong it is, how great it is.”