Hostile UAS operations: aviation resilience and liability

The development of unmanned aircraft systems (“UAS”), commonly known as drones, continues to create significant opportunities for the aviation and aerospace sectors. Unfortunately, not all of these are positive. In recent weeks, a series of incidents involving hostile UAS activity in Germany and Lithuania has highlighted the increasingly complex legal and operational risks posed by UAS around European airports and airspace. These risks raise important questions not only about aviation security but also the potential for public and private law liability regimes to apply in parallel to hostile UAS operations.

Recent incidents demonstrate an evolving threat

In August 2026, a drone carrying an explosive device that failed to detonate was discovered within the secured cargo area of Leipzig/Halle Airport, one of Europe's busiest cargo hubs. Investigators reportedly suspected that a second drone struck a cargo plane in the vicinity, while a third drone was found near the airport around ten days later. Germany’s Federal Prosecutor subsequently opened an investigation, and the Interior Minister reportedly described the incident as part of a “well-established pattern of Russian hybrid operations in Europe”.

Just over a month later, NATO fighter aircraft reportedly intercepted and destroyed a suspected Russian drone that had entered Lithuanian airspace. It appears that this drone also carried an explosive device that did not detonate.

These incidents also need to be viewed in the context of earlier security concerns at Leipzig/Halle Airport. In 2024, an incendiary device concealed within a parcel ignited at the airport's DHL logistics hub shortly before it was due to be transported by air. The incident formed part of a wider investigation into suspected sabotage operations targeting logistics and transport infrastructure in Europe. Against that backdrop, the use of drones carrying explosive devices may be viewed as part of a broader trend towards increasingly sophisticated attempts to target aviation and logistics infrastructure.

Fortunately, none of these incidents resulted in major damage or loss of life. However, the Leipzig incident reportedly involved a drone carrying an explosive device striking a cargo aircraft without detonating. Taken together, these events illustrate the increasing sophistication, range and potential destructive capability of hostile UAS activity and raise important questions about how the aviation sector would respond if a future incident caused substantial physical damage or operational disruption.

Who bears the loss? Civil liability considerations

A successful hostile UAS attack could have consequences extending far beyond the immediate security incident.

In the cargo sector, a successful attack by a hostile UAS operator could theoretically lead to the destruction of or damage to valuable cargo, as well as major disruption to flight schedules as a result of runway and airspace closures. That, in turn, could lead to very serious financial losses. In such a scenario, responsibility for those losses is likely to depend on a complex web of contractual arrangements, applicable domestic law, insurance provisions and, in the case of international air cargo, the Montreal Convention 1999. 

The potential exposure is not limited to aviation assets. Hostile UAS activity may also cause damage to people or property on the ground. In the UK, such incidents could engage the strict liability regime under section 76 of the Civil Aviation Act 1982, as well as potential claims in negligence, nuisance or other causes of action. The consequences of a major drone incident may therefore extend well beyond airports, airlines and cargo operators.

The recent incidents therefore demonstrate that drone-related risk is no longer simply an airspace-management issue. The rapid growth of drone technology creates not only regulatory and security challenges, but also potentially significant operational resilience, civil liability and insurance considerations for the aviation sector.

Where a hostile UAS operation is linked to a State actor or terrorist organisation, complex questions may also arise regarding insurance recovery and the application of war-risk or terrorism exclusions.

Accordingly, airports, airlines and cargo operators should consider whether their contractual and risk-management frameworks adequately address deliberate drone incursions. In particular, they may wish to review:

• contractual allocation of responsibility for security failures and operational disruption;
• notification and cooperation obligations under relevant insurance policies;
• contingency planning for runway closures, flight disruption and cargo delays;
• evidence preservation following an incident, particularly where subsequent civil claims may arise; and
• the adequacy of existing drone detection and counter-UAS capabilities.

Could a State be responsible?

The recent incidents appear to form part of a broader pattern of activity against a backdrop of heightened geopolitical tensions. As well as raising questions about civil liability for any damage caused, they also raise questions about the international responsibility of any State ultimately found to be behind the operation.

If the drones are ultimately attributable to a foreign State, their unauthorised entry into another State’s airspace may amount to an infringement of sovereignty, recognised in Article 1 of the Chicago Convention. If, as part of an incursion, any UAS is used as a weapon against a civil aircraft in flight, this could also engage Article 3 bis. 

The Chicago Convention does not itself establish a compensation regime for private parties affected by such incidents. Article 84 does, however, permit contracting States to submit disputes to the ICAO Council for determination, and findings of responsibility by the Council may form part of a broader process through which questions of reparation between States are addressed, as demonstrated by the Council’s May 2025 determination that Russia was responsible for the downing of Flight MH17.

The UK regulatory position

The UK already has a well-developed legal and regulatory framework governing drones. Under the Air Navigation Order 2016 and the UK’s retained drone regulatory framework, drone operations must not endanger aircraft or persons, and operators are subject to registration and competency requirements overseen by the Civil Aviation Authority.

More significantly, airports benefit from Flight Restriction Zones (“FRZs”), making it a criminal offence to fly drones without permission within designated areas around protected aerodromes. Following the widespread disruption caused by drone sightings at London Gatwick Airport in 2018, the UK expanded FRZs and invested in enhanced counter-drone capabilities.

Depending on the circumstances, hostile drone activity may also engage offences under the Aviation Security Act 1982, terrorism legislation, the Air Navigation Order, and the Criminal Damage Act 1971.

However, the incidents reported in Germany and Lithuania illustrate that legal prohibitions alone cannot eliminate the threat posed by increasingly sophisticated drone technology, particularly where malicious or State-sponsored actors are involved. As drone capabilities continue to develop, regulators and industry participants will face challenges that traditional aviation security measures were not designed to address.

What next?

The incidents at Leipzig and in Lithuanian airspace demonstrate that hostile UAS activity is becoming a mainstream aviation risk rather than a niche security concern. They also sit against a backdrop of increasing UK and European focus on the resilience of critical transport infrastructure and the need for operators to anticipate emerging security threats.

As drone technology becomes more capable, accessible and difficult to detect, hostile UAS activity is emerging not only as a security threat but also as a significant operational resilience risk. Airports, airlines and cargo operators should consider whether their security arrangements, resilience planning, insurance programmes, emergency-response procedures and contractual arrangements are capable of responding to a major drone incident and supporting a rapid recovery from any resulting disruption.

If you would like any further information or advice on drone regulation, aviation resilience, liability issues or aviation security risks, please contact Chloe Challinor, Patrick Bettle and William Bainbridge in Burges Salmon’s aviation team.