On the last day of the 2026 World Cup, NORAD F-16s fired flares over northern New Jersey to warn off civilian pilots who had flown into restricted airspace. During the tournament, federal agencies seized more than 700 drones across 11 host cities. The counter-drone effort worked.
That’s what worries me.
In less than two years, Los Angeles will open the 2028 Olympic Games, a National Special Security Event spread across dozens of venues followed weeks later by the Paralympics. The threat there won’t be the one we just beat, and this summer’s solutions won’t be the ones we need.
I’ve seen this before. From 2010 to 2013 I ran the Army’s Rapid Equipping Force in the middle of the counter-IED fight. Congress authorized roughly $21 billion for JIEDDO, and we spent nearly $50 billion more on MRAPs. We still lost the adaptation race. The enemy learned and changed faster than our institutions could. Drones have the same traits that made IEDs so hard to beat: cheap dual-use parts, know-how that spreads through informal networks, and changes that cost the adversary almost nothing. Drones are IEDs that fly.
The next drone won’t have a radio link
We don’t lack counter-drone technology. But every answer we field starts a clock; someone is already building the counter. In Ukraine and the Gulf, autonomous navigation that doesn’t need GPS is maturing quickly. One operator can run a swarm, and AI handles terminal guidance. Most counter-drone systems fielded today detect the radio link between drone and operator, and jam it. The drones that matter in 2028 may not have one.
When the sensor at the venue can’t hear the drone, the warning has to come from before launch. Left of launch is intelligence.
Weak signals become capabilities before we see them
The drone threat rarely announces itself. During the battle for Mosul in 2016 and 2017, ISIS dropped small munitions from commercial quadcopters. In 2024, fiber-optic drones appeared in Ukraine as a workaround to jamming and quickly became widespread. In June 2025, Ukraine smuggled more than 100 small drones into Russia hidden in trucks, flew them over commercial mobile networks with open-source autopilot software, and struck strategic bomber bases as far away as Siberia. It was built from commercial parts and networks. The capability was the combination.
The same thing is happening here, in plain sight. A small startup has built software that keeps data moving when networks fail, uses AI agents to fuse that data and recommend actions, and ships new features every week. It’s built for logistics. Pair it with an off-the-shelf mesh radio sold for drones; vendors say some can cover thousands of square miles from altitude. In a matter of months, a small team could field a jam-resistant, AI-assisted network of drones and sensors that no requirement anticipated and no threat library lists.
Nothing about either piece is a threat. That’s the problem. We catalog platforms; the threat emerges in the combinations. And the expertise to put them together is for hire. This month, a Ukrainian air defense officer offered me his team’s combat experience on LinkedIn.
Intelligence is more than threat warning
Our intelligence enterprise tends to treat counter-drone support as a threat function: who is flying, what they intend, what is coming. That job matters, but it’s one of three.
The second job is awareness. Near a stadium or a base, most drones are flown by hobbyists, photographers, delivery services or people who never checked the rules. The hard problem is finding the one that matters in a crowded sky. That takes a picture of normal: Remote ID, FAA authorizations, event credentials, known commercial traffic. Most of that data sits outside intelligence channels, with the FAA, commercial operators, and state and local agencies that gained their own counter-drone authority on July 1 under the SAFER SKIES Act. The fusion model has to be built with these partners, not around them.
The third job is adaptation. Every drone we recover tells us how the adversary is changing: firmware, components, frequencies, supply chains. That knowledge has to reach the people building countermeasures and the units that will face the same drone next week. When Gen. Stanley McChrystal’s task force in Iraq tied intelligence to operations, it went from about 18 raids a month in 2004 to about 300 a month by 2006. Not with better equipment, but because every completed cycle made the next one faster.
One threat, one learning loop
It’s tempting to treat Los Angeles as a homeland security problem and the Gulf as a warfighting problem. The drone doesn’t care. The same parts, tactics and know-how reach forward bases, stateside installations and crowded stadiums at the same time. Northern Command couldn’t determine who flew several drones over a strategic U.S. installation after the Iran campaign began this year.
That cuts both ways. What we exploit from a drone downed overseas is the earliest warning Los Angeles will get. What we test at stadiums at home, in real conditions, strengthens the force overseas. JIATF 401 convenes DHS, the FBI, the FAA and dozens of other federal organizations; its director, Brig. Gen. Matt Ross, puts it plainly: “Nobody can solve this problem alone.” Intelligence has to be the engine that makes that connection worth having.
Two clocks, one collision point
Our planning runs on a deliberate, gated clock: fund, test, buy, then freeze the configuration so people can train on it. The adversary’s clock has no freeze date. State actors are patient: they watch our events, probe our installations and study our playbook. Extremists and lone actors copy what works overseas, hide among careless flyers and can change tactics up to the day they act. Whatever becomes cheap and proven overseas in early 2028 will be available to them in July 2028.
The collision point is our freeze date. Whatever they adopt after it, we meet unrehearsed.
The answer: test continuously through 2027 at real events, buy fast in early 2028, and never fully freeze. Keep money, authority and software update paths open so something can still change in the final 90 days.
Intelligence has to unfreeze the plan
Only intelligence can create the pressure to reopen a plan that has been funded, tested and trained on. Program managers have every incentive not to, and operators rarely get the chance. The intelligence community should schedule those assessments now, tied to the plan’s decision points:
- a threat baseline today
- a reassessment after every 2027 test and every real incident
- a formal assessment before we buy
- a final one inside the last 90 days
Each should answer one question: what has changed that should change the plan?
Sometimes the answer will be “nothing.” The system has to be ready for the times it’s “a lot.” That means flexible funding that portfolio managers can move as the threat moves, and a Congress willing to let them.
In Afghanistan, when the enemy adapted faster than we did, soldiers and allies paid for the delay. We know the date of the next test. Build for the threat we’ll face in 2028, not the one we just beat.
Pete Newell is the CEO of BMNT and a former director of the Army’s Rapid Equipping Force.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
Discussion about this post