The United States is rapidly expanding the use of unmanned systems across the air, land, maritime, and undersea domains. Whether remotely operated, semi-autonomous, or fully autonomous, these platforms increasingly carry something potentially more valuable than the vehicle itself: data. Military operations are undergoing one of their most significant transformations in decades. Unmanned systems are proliferating across every operational domain. Artificial intelligence is moving computing and decision-making closer to the tactical edge. Sensors are generating unprecedented amounts of information. And military planners increasingly envision contested environments populated by thousands of unmanned aircraft, ground vehicles, surface vessels, and undersea systems. The Department of Homeland Security (DHS) faces a similar evolution. Unmanned platforms increasingly support border security, maritime surveillance, infrastructure protection, disaster response, law enforcement, and other missions. These systems are commonly described collectively as UxVs, an umbrella term encompassing unmanned or uncrewed vehicles across domains. Some are highly autonomous and AI-enabled. Others are remotely piloted. Some follow predetermined routes. Others require continuous human control. From a data-security perspective, however, their level of autonomy is not the defining issue. The critical question is what information the system carries, and what happens to that information if the platform doesn’t return.
UxVs operate in environments where physical loss is an expected part of operations. They crash. They malfunction. They are shot down. They become disabled. Communications links fail. Ships and undersea vehicles can be recovered. Ground systems can be abandoned or captured. Some future concepts explicitly depend upon large numbers of relatively inexpensive platforms whose loss is considered operationally acceptable. But accepting the loss of a vehicle should not mean accepting the loss of its information. Consider the range of unmanned systems operating across national-security missions: Air Force: remotely piloted aircraft such as the MQ-9, collaborative combat aircraft, reconnaissance UAS, and smaller tactical drones. Army: small UAS, unmanned ground vehicles, robotic reconnaissance platforms, autonomous logistics systems, and counter-mine platforms. Navy: unmanned surface and undersea vessels performing ISR, mine warfare, ocean surveillance, communications, and other missions. Marine Corps: expeditionary UAS, unmanned logistics platforms, reconnaissance systems, and maritime platforms supporting distributed operations. Space Force: ground and edge systems supporting distributed space-domain awareness, communications, and related mission operations. Coast Guard and DHS: unmanned aircraft and maritime systems supporting border surveillance, maritime domain awareness, port security, search and rescue, law enforcement, and critical-infrastructure missions. These systems vary enormously in size, cost, sophistication, and autonomy. They share one important characteristic: They can store information locally. And if the system can be recovered, that information may be recoverable too.
The obvious answer might be sensor imagery or video. The real answer can be much broader. Depending on its mission and architecture, a UxV could contain: imagery, video, radar, sonar, or other sensor data; mission plans and target information; coordinates and navigation routes; waypoints and geospatial databases; flight, driving, or sailing histories; communications configurations; network addresses and architecture information; electronic warfare parameters; threat libraries; intelligence databases; cryptographic material or credentials; maintenance and diagnostic information; system logs; mission software and firmware; proprietary algorithms; and AI models and associated mission data. Even information that appears mundane in isolation can become valuable when analyzed by a sophisticated intelligence organization. A navigation history can reveal operating locations. System logs can expose capabilities and limitations. Communications configurations can help map tactical networks. Maintenance information can identify vulnerabilities. Mission software can reveal how a platform behaves. An adversary doesn’t necessarily need to recover a document stamped CLASSIFIED to obtain valuable intelligence. The system itself can tell a story about how the United States operates, communicates, senses, targets, and fights.
Artificial intelligence significantly increases this risk because AI-enabled platforms can store particularly valuable intellectual property and operational information. A captured system might contain trained models supporting autonomous navigation, computer vision, sensor fusion, target recognition, electronic warfare, or threat avoidance. Those models can represent years of research, enormous investment, and accumulated operational knowledge. Recovering them could potentially help an adversary understand how a system makes decisions, develop countermeasures, identify weaknesses, replicate capabilities, or accelerate its own development. But it would be a mistake to conclude that only autonomous or AI-enabled systems require strong data protection. A remotely piloted UAS can contain sensitive mission information. A preprogrammed unmanned undersea vehicle can contain valuable sonar and navigation data. A remotely controlled ground robot can retain imagery, maps, network information, and mission histories. A comparatively inexpensive tactical drone can reveal unit locations, routes, imagery, communications information, and operational patterns. Autonomy increases the potential value of the data. Physical vulnerability creates the underlying risk. If a platform stores sensitive information and can potentially fall into unauthorized hands, its data at rest needs protection.
Traditional cybersecurity frequently focuses on keeping attackers out of a system through networks. Firewalls, endpoint detection, network monitoring, access controls, and data-loss-prevention technologies are all important. But imagine an adversary physically recovers a UxV. They now possess the computer. They may be able to remove its storage, disassemble the platform, connect components to specialized forensic equipment, analyze firmware and hardware interfaces, or spend weeks examining the system in a laboratory. A nation-state adversary may have teams of engineers, intelligence analysts, cryptographers, reverse engineers, and hardware specialists available for the effort. The cybersecurity problem has fundamentally changed. The question is no longer: “Can the adversary remotely penetrate the network?” It becomes: “With the entire device sitting on their laboratory bench, can they recover what’s stored inside it?” That is a data-at-rest problem.
For decades, military survivability has understandably concentrated on protecting platforms and their ability to accomplish the mission. Stealth. Armor. Mobility. Countermeasures. Redundancy. Electronic protection. UxVs require another dimension of survivability: information survivability. Future systems should increasingly be designed around an uncomfortable but realistic assumption: This platform may eventually be captured. The security architecture should then ask what happens next. Can an adversary read the mission data? Can storage be removed and analyzed independently? Can credentials or cryptographic material be recovered? Can software, firmware, or AI models be extracted? Can operational histories be reconstructed? Can information recovered from one lost platform help compromise other platforms, missions, or networks? A vehicle can be lost without becoming an intelligence windfall. But that outcome has to be engineered into the system.
Protecting the UxV itself is only part of the challenge. Every unmanned system operates within a larger ecosystem. That can include: mission-planning workstations, ground control stations, ruggedized laptops, tactical servers, removable storage, portable SSDs, maintenance computers, data-transfer devices, launch-and-recovery equipment, and edge-computing systems. These supporting systems may contain even more information than the vehicle. A UxV may carry information about one mission. A mission-planning workstation might contain information about dozens. A maintenance system might reveal configurations across an entire fleet. A ground control station may contain network, communications, mission, and operational information spanning multiple platforms. For DoW, defense-industry, and DHS organizations, the appropriate security boundary therefore isn’t simply the unmanned vehicle. It’s the entire UxV data ecosystem.
The good news is that losing a platform does not have to mean losing its data. Data-at-rest protection is a mature security discipline built around encryption, authentication, cryptographic key protection, and related technologies intended to keep stored information inaccessible when equipment is lost, stolen, or captured. This is particularly important at the tactical edge. A captured UxV may have no network connection. A remote security service may be unreachable. An administrator may have no ability to issue a wipe command. Protection therefore needs to travel with the data. Strong encryption can make information stored on a captured device unusable without appropriate authorization. But for classified information, simply having encryption isn’t enough. The implementation matters. The keys matter. Authentication matters. And the architecture matters.
For National Security Systems handling classified information, the National Security Agency’s Commercial Solutions for Classified (CSfC) program provides an important framework. NSA’s Data-at-Rest (DAR) Capability Package provides architectures for protecting classified information using appropriately evaluated commercial technologies and layered security. Rather than depending upon a single encryption product, CSfC DAR applies defense-in-depth principles involving independent layers of protection, evaluated components, approved cryptography, authentication and authorization, key protection, and defined configurations. The principle is particularly relevant to UxVs: Physical possession of the platform should not equal possession of the classified data. An adversary that recovers a platform should face cryptographic barriers designed to keep the information inaccessible even though the hardware itself is now under the adversary’s control. For classified UxVs and their supporting NSS infrastructure, DAR therefore shouldn’t be viewed as simply another cybersecurity feature. It is part of platform survivability.
The United States is investing heavily in unmanned systems, autonomy, artificial intelligence, resilient communications, and distributed operations. Security doctrine and system requirements need to evolve alongside them. Programs routinely establish requirements for what a UxV must do during its mission. How far must it travel? How long must it operate? What payload must it carry? What threats must it survive? How autonomous must it be? What communications must it support? There is another requirement that deserves similar attention: What must happen to its data when the platform is lost? That question should be considered during system architecture and acquisition, not after deployment. Data-at-rest protection should extend across the platform and its supporting ecosystem and should be appropriate to the sensitivity and classification of the information being stored. For classified NSS environments, applicable NSA-approved DAR architectures should be incorporated into that discussion from the beginning.
As UxVs proliferate across military and homeland-security missions, it’s easy to focus on the physical systems: aircraft, vehicles, vessels, sensors, payloads, processors, and communications. But every one of those platforms increasingly has a second asset onboard: what it knows. That information can reveal where the platform has been, what it has observed, how it communicates, what threats it recognizes, how it makes decisions, and potentially how the larger force operates. AI makes some of that information even more valuable. But AI isn’t a prerequisite for the risk. Any UxV carrying sensitive information can become an intelligence source when it falls into adversary hands. The United States has already accepted an operational reality in which some unmanned platforms will be lost. That doesn’t mean their data must be lost with them. The next generation of UxVs should therefore be designed around two forms of survivability: Protect the platform so it can complete the mission. Protect the data so that, if the platform doesn’t come home, the mission doesn’t come home with the adversary.
Brett Hansen, Cigent CEO, has 30 years of IT experience. Prior to joining Cigent, he held leadership positions with companies providing SaaS data solutions. He was also an executive at Dell for over a decade overseeing Client Software organization including developing and leading Dell Data Security business that provided integrated hardware and software security solutions. Brett started his career with IBM holding leadership positions with various software organizations focusing on IT management, development, and security.
