White Paper

WHITE PAPER Protecting Drones In the Event of Compromise or Capture mrcy.com 2 mrcy.com 2 Unmanned and autonomous vehicles, commonly called drones, have become integral to modern military operations. Offering unprecedented reconnaissance, surveillance, and operational capabilities across land, air, and sea, these vehicles face a unique security challenge: they are expendable assets with a high risk of battlefield loss. When captured and reverse engineered, these systems can provide adversaries with valuable intelligence, potentially compromising operational security and technological advantages. Histor y has demonstrated the reality of this threat. In 2011, Iranian forces captured a U.S. militar y-operated RQ-170 Sentinel UAV, reportedly through electronic warfare techniques 1 . This incident let Iran reverse engineer the advanced stealth drone, potentially gaining insights into U.S. sur veillance capabilities and stealth technology. Similarly, in 2016, China seized a U.S. Navy under water drone in the South China Sea 2 , raising concerns about the potential compromise of sensitive oceanographic data and under water drone technology. Recent events such as the war in Ukraine, where reports indicate that approximately 300,000 Russian drones have been shot down 3 , also highlight how the growing use of drones in conflict significantly increases the risk of capture or wreckage recover y in the future. These high-profile cases underscore the critical need in unmanned or autonomous vehicles for robust security measures that are specifically designed to mitigate the risks associated with battlefield loss. SECURITY APPROACHES FOR UNMANNED VEHICLES Robust data protection is central: mission data, sensor readings and operational parameters must be strongly encrypted at rest, with storage that can rapidly erase or render data unreadable the moment capture appears imminent. Anti-tamper protections should combine physical barriers against unauthorized access to internal components with software-based defenses against reverse engineering, backed by secure boot and run-time integrity checks that stop unauthorized or modified code from running. Minimizing the attack surface — disabling unnecessary services and ports, applying strict access controls — reduces the number of ways in, and a resilient architecture assumes some components will be compromised, using isolation and compartmentalization to contain the damage. Remote disabling can help when connectivity allows it, but a captured or downed vehicle often can't be reached in time. The more important design question is what the system does on its own, the moment it loses contact or detects tampering, with no operator and no network in the loop. MERCURY'S SECURITY SOLUTIONS To address these security challenges, Mercury Systems offers a comprehensive security solution specifically designed for embedded systems such as those found in unmanned and autonomous vehicles: RelianceOne. Most security architectures are built around preventing capture. RelianceOne starts from a different assumption: for an expendable, forward-deployed asset, capture isn't a risk to guard against — it 's an eventuality to design for. That changes the engineering problem. Rather than depending on an operator-triggered kill switch or a network link that may not exist once a vehicle is down, RelianceOne's tamper-response acts autonomously and immediately, the instant physical intrusion or loss of expected state is detected, with no human and no comms link required. And because the design assumes an adversary will eventually gain full physical possession and unlimited time with the hardware, RelianceOne is built on a threat model that assumes the attacker will obtain root (admin) access — protecting data and IP through mandatory access controls and hardware-rooted isolation rather than privilege boundaries a physically present attacker can eventually work around.

• Cover