Francesco Demarcus : 17 October 2025 11:16
Jubilee 2025 in Rome presents a challenge not only for managing millions of pilgrims and tourists, but also for protecting urban airspace. Drones, increasingly widespread and accessible, bring with them significant vulnerabilities and risks. Despite the implementation of advanced monitoring and control systems, critical issues remain related to non-compliant or home-built drones, which can evade identification and tracking systems.
Between radar evasion, autonomous swarms, encrypted communications and the threat of cyber-drones, a new technological scenario is emerging for the Capital
In preparation for the event, Rome installed two antennas along the Vatican-Aurelia axis to monitor drone traffic. The system allows authorized drones to be monitored in real time and transmits data to the relevant authorities, with the aim of ensuring the safety of the city’s airspace. However, despite technological advances, several vulnerabilities still exist that could compromise its effectiveness.
Tracking system features
The system is designed to collect DRI signals, aggregate telemetry and send alerts to the relevant authorities in case of anomalies
Operating limits in urban environments
Tall buildings, RF multipath, and electromagnetic noise reduce identification capabilities; low RCS or RF-silent drones may remain undetected.
This article analyzes the main evasion techniques: from low-altitude flights to the use of stealth materials, encrypted communications, and autonomous navigation systems based on SLAM (Simultaneous Localization and Mapping) and Deep Reinforcement Learning (DRL). It also discusses the impact of the use of secure communications (AES, FHSS, VPN), which, while improving protection for legitimate operators, hinders law enforcement efforts. Hence the need for regulatory updates, more advanced technological tools, and an integrated approach to airspace defense.
As the climax of Jubilee 2025 approaches, Rome is preparing to manage increasingly crowded and complex events. In this context, one of the greatest risks to the safety of urban airspace concerns drones that do not comply with European regulations on remote electronic identification (DRI). Some home-built or modified models may not transmit mandatory identification signals, evading installed monitoring systems.
This phenomenon represents a real threat: an “invisible” drone can fly over sensitive areas, transporting and releasing unauthorized objects (be they spy equipment, contraband, or dangerous materials) without the authorities having time to intervene promptly.
A homemade drone is a UAV assembled manually from standard or homemade components. They can range from simple quadcopters to hexacopters or octocopters.
Modularity and the use of open-source firmware facilitate the removal of the DRI module and the replacement of communication channels with LTE/5G or proprietary protocols.
Major components include:
This modular structure, combined with the widespread availability of open-source firmware, makes it very easy to customize drones, remove or deactivate the DRI module, and replace standard communication channels with alternative connections, such as LTE/5G modems.
Attackers can rely on tried-and-tested strategies to bypass detection systems. Common techniques include:
In recent years, research has produced highly advanced autonomous flight systems capable of operating in complex urban environments lacking GPS signals. These technologies can make drones particularly difficult to detect or neutralize, even in the presence of advanced surveillance systems such as those implemented for the Jubilee.
Low-altitude flights minimize exposure time compared to long-range sensors but increase the risk of collision; they are effective against systems designed for higher-altitude targets.
The use of RAM and optimized geometry reduces radar reflection; in small UAVs the RCS can drop below thresholds that make detection with X/S radar difficult.
The SLAM (Simultaneous Localization and Mapping) system allows drones to build three-dimensional maps of the environment and locate themselves within them, using only vision sensors and IMUs, without the need for GPS. This is particularly useful in complex urban areas like Rome’s historic center, where satellite reception can be obstructed by buildings and structures. Recent surveys show significant progress in managing dynamic environments and weak textures. The integration of deep learning and V-SLAM improves reliability and real-time performance on drone hardware.
Operational Focus: A malicious drone equipped with SLAM could fly in “radio-silent” mode through alleys, basilicas and crowded squares, automatically avoiding obstacles and making itself invisible to tracking systems based on RF or GPS signals.
DRL and trajectory learning
Deep Reinforcement Learning (DRL) has revolutionized autonomous drone navigation, enabling the training of intelligent agents that learn safe trajectories in unfamiliar environments. Algorithms such as PPO (Proximal Policy Optimization), DDPG, and TD3 have been used to develop adaptive flight strategies capable of avoiding obstacles, tracking targets, and responding in real time to new threats. End-to-end algorithms (e.g., SAC) support BVLOS navigation in highly dynamic scenarios. Modular frameworks such as “VizNav” use TD3 and PER for efficient and responsive 3D flight. Hybrid models that leverage visual and LiDAR inputs allow for contextual input injections for improved perception. DRL models do not follow fixed rules: by learning from the environment, they generate responses that complicate predetermined countermeasures.
A hostile swarm can fragment the mission and redistribute tasks, ensuring persistence of the operational effect even in the event of interception of single nodes
Operational focus: A drone equipped with DRL could automatically recognize air police surveillance patterns and alter its route to evade them, exploiting blind spots or less-monitored routes. This behavior, not pre-programmed but learned, makes it extremely difficult to predict its moves.
Detect and Avoid (DAA) systems integrate radar sensors, cameras, and computer vision algorithms to prevent collisions and identify obstacles in flight, even in densely populated environments. These systems enable autonomous operations in controlled airspace, increasing flight safety in urban or critical environments. Commercial drones licensed for logistics or surveillance could leverage DAA to navigate congested environments. However, even a rogue drone with DAA capabilities can “read” and bypass legal air traffic flows, blending in and making it difficult to identify.
Sources: Bresson, G., et al. (2017). IEEE Transactions on Intelligent Vehicles. – Tzoumas, V., et al. (2021). IEEE Robotics and Automation Letters. – Hwangbo, J., et al. (2017). IEEE Robotics and Automation Letters. – Yan, J., et al. (2022). Sensors, 22(8). Babbar, R., & Duggal, R. (2020). Journal of Aerospace Information Systems. – FlytBase. (2023). DAA Technology for BVLOS Drone Operations.
Drone swarms are based on algorithms inspired by nature, allowing multiple aircraft to operate in a coordinated yet decentralized manner. Each drone communicates with its neighbors to make collective decisions, without the need for central control. Models based on Particle Swarm Optimization (PSO) enable the tracking of hidden targets, even under cover, accelerating complex mapping. The use of multi-agent evolutionary algorithms ensures efficient patrols even in unfamiliar environments, while swarm intelligence principles promote robustness, scalability, and resilience without centralized control. Signals are transmitted between the drone and operator via radio protocols. To prevent interception or jamming (communications disruption), drones can employ advanced encryption techniques.
Mesh communications and jamming resilience
P2P mesh networks increase resilience: the loss of a node doesn’t compromise the mission. An effective countermeasure: network-level behavioral analysis
Stealth technology in drones is based on two fundamental principles: the use of radar-absorbing materials (RAM) and the design of geometries with low radar cross-section (RCS). The radar cross-section of an object represents the amount of energy reflected back to the radar illuminating it. In drones, especially small ones, the use of sloped surfaces, composite materials, and absorbent coatings significantly reduces radar visibility. Tests conducted on carbon fiber UAV models have shown average RCS values of less than –17 dBsm, in a frequency range of 3–16 GHz, making them difficult to detect with conventional X- or S-band radars. Furthermore, some commercial models use conductive plastics treated to deflect or absorb incoming microwaves.
In an urban context like that of Rome during Jubilee 2025, a stealth drone could fly over sensitive areas while maintaining an electromagnetic profile indistinguishable from background noise, evading detection antennas and passive radars.
Sources: Mikhailov, M., et al. (2022). Characterization of RCS of Composite UAVs. MDPI Drones, 7(1), 39. https://www.mdpi.com/2504-446X/7/1/39 – Ali, Z. (2022). Effect of RCS variation on drone detectability. LinkedIn Engineering Notes. https://www.linkedin.com/pulse/effect-radar-cross-section-rcs-variation-z2sqc
Dark drones are designed to avoid detection through radio signals. Unlike traditional drones, which transmit real-time data on known frequencies (e.g., 2.4 GHz or 5.8 GHz), these devices fly in RF-silent mode, completely eliminating communications during flight. They often operate via pre-programmed waypoints, loaded into the air traffic controller’s memory, or use computer vision to navigate their surroundings. This lack of emissions makes them invisible to many anti-drone systems that rely on RF interception.
A “dark” drone can also deactivate the remote identification system (DRI), required by European regulations, making it legally invisible. Furthermore, the use of open-source flight controllers (e.g., Pixhawk, ArduPilot) allows the installation of modified firmware to mask the device’s electromagnetic behavior. In areas such as the Vatican or Trastevere, these drones can fly through the city center undetected by currently active systems.
Dark drones operate by following pre-programmed routes via locally loaded waypoints, without the need for a constant internet connection. Mission planning occurs offline, avoiding any detectable data transmission. Thanks to optical sensors and SLAM (Simultaneous Localization and Mapping) algorithms, they can navigate complex environments without GPS. The absence of RF signals makes them virtually invisible to radar and tracking systems. This flight mode makes them ideal for clandestine or unauthorized operations.
Sources: Echodyne (2023). What is a dark drone and how to ID one . https://www.echodyne.com/resources/news-events/what-is-a-dark-drone-and-how-to-id-one –
Dedrone (2023). Counter-UAS: Beyond RF Detection . https://www.dedrone.com/white-papers/counter-uas
Photonic radars, which for those born in the 1970s may well recall a Japanese #shōnenmecha-style depiction of the future, represent a new generation of detection devices based on optical technologies, capable of overcoming the limitations of conventional radar. Using laser pulses and optically generated millimeter waves, these radars ensure high spatial resolution, low interference, and sensitivity to very small targets, such as stealthy micro-UAVs.
In South Korea, photonic radar has been successfully tested to detect small drones beyond 3 km, even in adverse weather conditions such as fog or rain. The systems combine imaging capabilities and artificial intelligence to classify targets based on Doppler signatures or electromagnetic profiles.
Installations on rooftops or observation towers can provide complementary coverage to radar and RF sensors, especially in environments with many reflective surfaces. The operational challenges of this new technology remain, for now, cost, integration in populated cities, and managing false positives.
Sources: Han, K. et al. (2023). Photonic radar performance in adverse environments. PLOS One, 18(12):e0322693. https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0322693
Aerospace Testing Int. (2023). South Korea tests photonic radar for drone detection. https://www.aerospacetestinginternational.com/news/south-korea-tests-photonic-radar-for-drone-detection.html
Securing communications between drones and the control station is essential for ensuring operational safety, especially in high-density urban environments such as those envisioned during Jubilee 2025. Vulnerable radio channels can expose drones to interception, spoofing, man-in-the-middle attacks, and intentional jamming. To mitigate these risks, the industry employs a range of cryptographic technologies and secure transmission protocols.
AES-256 is the most widely used symmetric encryption standard for securing drone-operator communications. This system uses 256-bit keys to encrypt data, making it virtually unbreakable without the correct key. It is used for both real-time transmission of telemetry and control data and for FPV (first-person view) video streams. However, its effectiveness depends on secure key management and the robustness of the entire application protocol.
Some advanced countermeasures that could be implemented, such as the mandatory adoption of AES standards in all civilian drones with rolling-code key systems and two-factor authentication between drone and base station
Frequency Hopping Spread Spectrum is a technique that involves transmitting data across a wide spectrum of frequencies, hopping from one channel to another in a pseudo-random sequence known only to the drone and its controller. This makes it extremely difficult for an attacker to jam the communication, as they would have to simultaneously jam on all frequencies or know the hopping pattern.
To counter hostile drones employing FHSS, spread-spectrum RF detection systems are needed, capable of tracking rapid frequency changes and correlating suspicious activity with flight behavior.
Source: NIST FIPS 197 – Advanced Encryption Standard (AES). – Sklar, B. (2001). Digital Communications: Fundamentals and Applications .
Some drones employ custom communication protocols, with public/private key cryptography (RSA, ECC) to authenticate the origin of the command and encrypt packets. These systems increase security over standard protocols, but pose new detection challenges, as transmissions do not follow patterns known to counter-drone systems. The lack of standardization hinders interception and decryption by law enforcement, making it urgent to develop European legislation defining minimum standards for cryptographic interoperability in civilian drones.
The use of RSA, ECC, and proprietary protocols increases security but reduces interoperability and the ability to legitimately intercept.
Drones controlled via cellular networks (LTE/5G) can use VPNs (Virtual Private Networks) and cryptographic tunnels (e.g., IPsec, WireGuard) to hide the pilot’s location, protect data, and avoid hijacking attempts. The encrypted connection prevents the transmission of GPS coordinates, except through encrypted content. However, this system is not free from legal and privacy implications; using a VPN obscures the origin and identity of the operator, making it difficult to associate a flight with a registered user, creating a series of issues regarding traceability and the enforcement of EU regulations.
Drone swarms can communicate via P2P mesh networks, where each node acts as a relay for the others. This eliminates the need for a central control point, making it more difficult to disable the entire network with a single attack. Furthermore, distributed algorithms (e.g., gossip protocol) ensure intrinsic resilience to interference. The only way to effectively counter these networks is through advanced behavioral analysis and artificial intelligence that identifies anomalous patterns of cooperation between UAVs, even in the absence of central emissions.
Source : Diffie, W., & Hellman, M. (1976). New Directions in Cryptography . IEEE Transactions on Information Theory. – RFC 4301 – Security Architecture for the Internet Protocol. – Brambilla, M., et al. (2013). Swarm robotics: a review . Swarm Intelligence , 7(1).
In the increasingly complex and sensitive context of the use of civilian drones in urban environments, the issue of legal regulation and operational management takes on absolute centrality.
In the increasingly complex and sensitive context of the use of civilian drones in urban environments, the issue of legal regulation and operational management takes on a paramount importance. The Italian regulatory approach is based on a European framework outlined in EU Regulations 2019/947 and 2019/945, which establish the general conditions for the use of unmanned aerial systems. These regulations, implemented in Italy by the Italian Civil Aviation Authority (ENAC), define operational categories, technical requirements, and electronic identification obligations, particularly through the Direct Remote Identification (DRI) system.
Effective January 1, 2024, DRI became mandatory for all UAS operations in a specific category, including flights under Italian standard scenarios. Class C1–C6 drones must be equipped with a module that transmits essential information in real time, such as the operator code, the drone’s position, altitude, and, where available, the pilot’s position. This transmission must be publicly accessible via platforms such as D-Flight, while only authorities can access the operator’s full identity. However, the current regulatory architecture does not impose minimum encryption standards for communications nor does it explicitly prohibit the use of VPNs, peer-to-peer networks, or proprietary transmission protocols. This has created a veritable regulatory “gray area,” within which a drone may formally appear compliant despite operating in a technically opaque manner that is difficult for authorities to trace.
The Italian UAS-IT regulation, updated by ENAC in 2021, also imposes additional requirements regarding mission recording, mandatory logbooks, and mandatory tracking via D-Flight. However, even in this case, there is a lack of active and systematic monitoring of installed firmware, the correct configuration of DRI modules, and the compliance of the cryptographic protocols used. In the absence of periodic technical audits, the risk of modified or bypassed firmware being used increases significantly, compromising the overall effectiveness of the regulatory system.
Operationally, the growing sophistication of malicious drones makes it increasingly urgent to strengthen law enforcement’s technological capabilities. The effectiveness of DRI systems alone is insufficient when techniques such as frequency hopping, end-to-end encryption, or the use of decentralized mesh architectures are used. Current radio frequency monitoring systems are often unable to identify non-standardized transmission patterns. Authorities should therefore equip themselves with advanced tools, such as wide-spectrum RF receivers, deep packet inspection technologies, and artificial intelligence algorithms capable of detecting anomalous behavior even in the absence of central signals. Added to this is the need to physically neutralize any threats, using interceptor drones or selective short-range jamming systems.
To complete this framework, it is recommended to establish a system of technical audits and preventive certification for every drone placed on the market. This system should include mandatory firmware validation, verification of DRI module compliance, and inclusion in a public register accessible to authorities. Additionally, it would be useful to introduce post-sale and in-use technical inspections, with specific penalties for non-compliant operators.
Finally, a shared operational protocol between ENAC, ENAV, local police, armed forces, civil defense, and prefectures is essential. Investment in specialized training is needed so that operational units can recognize suspicious signals, activate countermeasures, and coordinate complex interventions.
Technological evolution in the UAV sector shows no sign of slowing down. While today’s debate on urban security focuses on low-observability drones, encrypted communications, and coordinated swarms, the near future promises even more complex and difficult-to-manage scenarios. The horizon no longer consists solely of remotely piloted aircraft or small-scale autonomous systems, but extends to bio-hybrid, miniaturized, and neurologically controlled devices.
A recently published article by RedHotCyber documents advanced experiments in the creation of ” cyber-beetles ,” live insects fitted with microelectrodes and neural backpacks capable of controlling their movements via joysticks, without disrupting their vital functions. In essence, nature becomes a vehicle. These are not simple robots: these devices exploit the biological autonomy of the host organism, to which they are associated with a minimal electronic interface. The result is a vehicle capable of moving without radio emissions, virtually invisible to radar and electro-optical systems, with an overall weight of less than 5 grams and autonomy that does not depend on batteries or software.
From an operational standpoint, these cyber-insects pose a unique challenge for any surveillance infrastructure: no RF signature, no GPS signal to track, and an unprecedented infiltration capacity. Regulatoryly, they raise radical questions: there are currently no EASA or ENAC regulations that can classify or regulate the use of living beings enhanced by neural interfaces for civilian or military purposes. The distinction between drone, machine, and organism is becoming blurred, opening up ethical and strategic scenarios that authorities will urgently need to address.
Protecting urban airspace requires an integrated approach, effectively balancing privacy and security, regulation and technology, oversight and innovation. Jubilee 2025 represents a daunting challenge: Italy’s response must be commensurate, both legally and operationally.
Francesco Demarcus