Who may bring down a drone, and how much time do they have?

Contents

1. Poland, through the guards it already had
2. The Czech Republic, through a new zone
3. Latvia, through the guard’s judgement
4. The number missing from the law
5. Where the minutes go
6. Moving decisions out of the incident
7. The horizon

On 21 July 2026 the Czech interior and transport ministries circulated a bill letting critical infrastructure operators bring down drones using their own employees. The explanatory memorandum attributes the limits of police response to the drone’s speed, police travel time and the need to locate the pilot. The memorandum adds that the decision on how to react usually has to be taken within minutes. Poland got there earlier by a different route, and Latvia went further still. All three give, or propose to give, this power to people outside the police and armed forces, but none of these texts counts the minutes.

Poland, through the guards it already had

For kinetic action Poland created no separate regime for critical infrastructure and relied on the general provisions of its aviation law. Since 2016 the Aviation Law has listed who may destroy a drone, immobilise it or take control of its flight. The list sat in Article 126a and moved in February 2025 to Article 156ze. It includes the police, the Border Guard, the intelligence services and the armed forces. It also includes the staff of specialised armed security formations, the armed guards whom operators employ or contract to protect their sites. All of them may act when a drone threatens life or health, protected facilities or air traffic, or could be used in a terrorist attack. Since 2025 they may also act when a drone enters a geographical zone closed to drones over a site important for state security. Action based solely on a breach of the flight ban in zones over military facilities is reserved for soldiers and the Military Gendarmerie.

The amendment to the crisis management act, in force since 4 July 2026, added a radio layer to that protection. Under the new Article 6zj of the act, a critical infrastructure operator first declares its jamming equipment, with frequencies, power and antenna positions. The declaration goes to the interior ministry, the telecoms regulator and the defence ministry’s frequency management unit. In cases listed in the Aviation Law and two other acts, the operator may decide to allow jamming for as long as the guards need it. The effects of any loss of telecommunications services have to be kept to a minimum, and each use must be reported without delay. The interior or the defence minister may order the operator to stop using the equipment or to change how it is used. At a Polish critical site the kinetic option rests on the guard’s own powers and the radio option on the operator’s decision.

The Czech Republic, through a new zone

Today in the Czech Republic only the state holds an explicit power to bring down a drone. The police, the armed forces and, since July 2025, the Military Police hold it, and the Prison Service holds a narrower one. The police may act when a drone poses an immediate threat to life, health, property of considerable value or public order. Operators have no explicit power. They can only fall back on self-defence, necessity and self-help, and the memorandum attributes their passivity to the resulting legal uncertainty.

The bill amends the civil aviation act and the police act. Inside an existing permanent no-drone zone, it introduces a special area over a critical site (prostor s rozšířenou možností zamezení letu). The Czech Civil Aviation Authority would designate it on the operator’s initiative, in agreement with the defence and interior ministries. Within it the operator may stop a flight, including by damaging or destroying the drone, when two conditions are both met. The drone must be flying without authorisation inside that area. It must also be over the area in which the operator applies physical security measures under the critical infrastructure act.

The power is exercised only by the operator’s own employees, trained and holding a valid remote-pilot competency certificate for subcategories A1/A3 and A2. The operator must warn the pilot where circumstances allow, avoid any manifestly disproportionate response and keep the risk to third parties to a minimum. Its procedures and risk analysis are filed on the critical infrastructure portal. Every use is reported to the police, and any breach of the no-drone zone to the Civil Aviation Authority.

Jamming remains excluded, because the ban in the electronic communications act is left in place. The memorandum argues that improper use of jamming equipment can paralyse mobile networks, emergency service systems and systems that rely on satellite navigation, such as toll gates. It also calls the required notification of the telecoms regulator and air traffic control unworkable given the number of operators. Poland built its radio layer on a declaration of that kind. For the police, the bill drops the word “immediately” from the threshold and adds critical infrastructure to the protected interests. Officers also gain a power to stop drones reasonably suspected of breaking the rules of a no-drone or restricted zone. The bill is intended to take effect on 1 July 2027.

The Czech model ties the power to the operator’s payroll, confines it to a defined portion of airspace and keeps jamming off limits.

Latvia, through the guard’s judgement

Since 20 January 2026 the Latvian Security Guard Activities Law has let guards at critical sites stop remote-controlled devices. The power covers the site, its protection zone and the airspace above them. A guard may capture the device, force it down, damage or destroy it, without warning, whenever it threatens the site. The text covers sites of categories A, B and C, and the Cabinet of Ministers determines which means guards may use and how. Guards must do everything possible to limit harm to the site and to keep other people safe. Every use must be reported at once to the police, the site’s security officer and the guard’s superior. What triggers action is the guard’s own assessment of the threat.

The number missing from the law

The Confederation of Industry of the Czech Republic repeated the memorandum’s sentence about minutes almost word for word in its consultation response. Its full statement assumes drones flying at between 15 and 20 metres per second and counts the time from detection to the perimeter in seconds. Martin Saska, a robotics researcher at the Czech Technical University, told Czech Television that a drone must be eliminated within about a minute. Smaller drones, he added, may be detected only a few hundred metres out, in which case the response has to be immediate. In Poland the figure in circulation is 90 seconds for a target detected at 2 kilometres. It comes from an analysis by Grzegorz Matyasik of the Eastern Flank Institute.

The Polish acts, the Latvian law and the published Czech bill state no detection range, no target speed and no decision time. A statute need not name a speed or a range. An explanatory memorandum is where a feasibility estimate would normally sit, and the Czech one offers minutes and nothing finer. None of these documents sets out a time budget for the whole procedure.

Where the minutes go

The Polish 90 seconds for 2 kilometres corresponds to a speed of 22.22 metres per second, or exactly 80 kilometres per hour. At 2 kilometres a slow drone at 36 kilometres per hour leaves the defence about 200 seconds. A medium one at about 76 kilometres per hour leaves about 95, and a fast one at about 160 kilometres per hour about 45. The defender buys the range, and the attacker chooses the speed.

scroll sideways →

Table 1. The last column uses the example distance of 300 metres between the fence and the critical plant, discussed below.

A human-in-the-loop procedure is a chain. Someone sees the track, someone checks whether the flight is authorised, someone decides, and someone with the power and the means acts. Each link has a median and a spread. When the medians fit the time available, the spread alone determines which procedures fail, because the drone does not wait for the slow cases. The model behind the figures below has eight such links. The 45-second median for the decision to engage comes from measured times that police dispatchers take to assign a call its priority. Prioritising a call and deciding to engage are both quick judgements on incomplete information, but applying that value here remains an assumption.

Take a medium-speed drone detected at 2 kilometres, with the decision median at 45 seconds. In the model, a procedure with a human in the loop finishes before impact in 68 per cent of cases when verification is instant. When verifying whether the flight is authorised takes a median of 90 seconds, it finishes in 1.2 per cent of cases. Even instant verification leaves one case in three unfinished.

Figure 1. Medium-speed target detected at 2 km. Share of procedures finished before impact by verification median, with a 45 s decision median, illustrative model.

How far out must a drone be detected for such a procedure to finish in time nine times out of ten? For a given target, that depends mainly on two human steps, verification and the decision to act. Against a medium-speed target the required range lies between 2.7 kilometres with instant verification and 5.7 kilometres with a 90-second verification median. Against a fast target it lies between 5.7 and 12 kilometres.

Figure 2. Detection range a human-in-the-loop procedure needs. Range at which nine procedures in ten finish before impact, for three target speeds and a 45 s decision median, illustrative model.

These values come from an illustrative model rather than from measurement. The model treats the steps as consecutive and draws their durations independently. If the decision median changes as well, what matters is mainly the sum of the verification and decision medians. When that sum stays below roughly 25 seconds, over 93 per cent of procedures against a medium-speed drone detected at 2 kilometres finish before impact. At a sum of 30 seconds the share is between 88 and 92 per cent, depending on how the two steps split the time.

Figure 3. Sensitivity to the decision median, medium-speed target at 2 km. Share of procedures finished before impact for verification medians of 0, 45 and 90 s, dashed line at 90 per cent, illustrative model.

Moving decisions out of the incident

All three countries move part of the decision from the incident itself into the preparation phase. The Czech bill fixes the airspace in advance, and Latvia ties the power to the category of the site. The Polish law has the equipment declared and the zones set before any drone arrives. Settling a step beforehand is the right approach, because it costs no time when the drone is inbound.

Both conditions of the Czech bill must hold at once, so the operator’s power arises only when the drone is already over the secured area. The memorandum says as much, and so does the Confederation of Industry in its response. Detection and tracking may start far earlier, but action under the new power may not. Take a site whose critical plant lies 300 metres inside the fence. A fast drone covers that distance in about 7 seconds, a medium one in about 14. Everything except the shot has to be finished before the drone crosses the fence. The Czech energy association writes that a drone should ideally be hit before it reaches the perimeter. The Latvian text extends further out, to the protection zone around the site. The Polish one ties the power mainly to the threat, with the zone breach as one trigger among several.

Figure 4. Window inside the perimeter, illustrative. Time to fly the 300 m from the fence to the critical plant at three target speeds.

Under the Czech bill the operator must first establish that the flight is unauthorised. Its documentation has to say how it learns from the zone manager of authorised flights. The Polish Air Navigation Services Agency (PANSA) offers a partial answer, a system meant to report in real time whether a drone operation is authorised. The Czech bill also obliges the operator to warn the pilot where circumstances allow. Latvia requires no warning at all. The Polish act moves the declaration of the equipment ahead of the incident but says nothing about when the operator decides to allow jamming. If that decision waits for the incident, someone with the authority has to be reachable at all hours. Matyasik makes the same point and recommends a duty officer with prior written authority, backed by a framework decision in the site’s protection plan.

The energy association called the duty to warn the pilot unworkable in most cases. Neither detection nor Remote ID, it noted, gives a way to contact a particular person. It also asked that elimination be allowed outside the secured area when an explosive atmosphere rules out firing over the site. The Confederation of Industry called a kinetic shot over an industrial site extremely dangerous and electronic takeover far safer, yet out of the operators’ reach. The Czech telecoms regulator pointed out that jamming may not work against fibre-optic, autonomous and inertially navigating drones. The Czech defence ministry asked for the bill to cover means still under development, including radio takeover, and to require a risk analysis in built-up areas.

The horizon

The Czech interministerial consultation closed on 18 August, and the comments must be addressed before the bill can go to the government. The defence ministry and the Security Information Service wanted the bill extended to the Military Police and intelligence officers too. The energy sector proposed allowing contracted guards to act and dropping the pilot certificate requirement for staff who only detect. The Polish and Czech rules for operators build on national laws implementing the EU directive on the resilience of critical entities. Poland transposed it in the same amendment that added Article 6zj, the Czech Republic in its 2025 act on critical infrastructure resilience. Fibre-optic and autonomous drones erode the radio options and shift the weight to hard-kill means, which need the target within range, and early enough.

The Czech bill and the Polish act already have a place for a time budget. The Czech operator would have to file a risk analysis of detection and engagement, and the Polish one prepares documentation with procedures for a threat. Neither has to say how long its procedure takes.

The region is settling who may act. How long they have is still a number none of these texts states.

Declaration of interest. Silesian Advanced Systems, the team the author founded, is developing an autonomous counter-drone system and has not yet been incorporated. Through that work the author has a direct commercial stake in the issue. Should measured verification and decision times prove much shorter than those used here, the case for automated systems like his would weaken. The time-budget model and its inputs are published at silesianadvanced.systems/analyses/time-budget/ so that the arithmetic can be checked independently.

↑ Back to top

Sources

1. Česká republika. 2025a. Zákon č. 173/2025 Sb., kterým se mění zákon č. 300/2013 Sb., o Vojenské policii a o změně některých zákonů (zákon o Vojenské policii), ve znění pozdějších předpisů, a některé další zákony. 21 May.
2. Česká republika. 2025b. Zákon č. 266/2025 Sb., o odolnosti subjektů kritické infrastruktury a o změně souvisejících zákonů (zákon o kritické infrastruktuře). 3 July.
3. Česká televize. 2026. “Ničit drony by dle návrhu mohli i pracovníci kritické infrastruktury.” ČT24, 21 July. ↗
4. Český telekomunikační úřad, Bezpečnostní informační služba, Ministerstvo obrany. 2026. Připomínky k materiálu KORNDW7JRL1U. eKLEP, August. ↗
5. Ekonomický deník. 2026. “Zničit dron nad elektrárnou nebo letištěm? Výhrady mají zpravodajci i energetici.” 25 August. ↗
6. European Parliament and Council of the European Union. 2022. Directive (EU) 2022/2557 of 14 December 2022 on the resilience of critical entities. Official Journal of the European Union L 333, 27 December.
7. InfoSecurity24. 2026. “Ochrona infrastruktury krytycznej przed dronami. Co się zmieniło?” 28 July. ↗
8. Kasperek, Maciej M. 2026. “Where the Second Comes From.” Silesian Advanced Systems, 20 September. →
9. Matyasik, Grzegorz. 2026. “Czy obiekty infrastruktury krytycznej są chronione przed dronami?” Instytut Wschodniej Flanki, 27 July. ↗
10. Ministerstvo obrany ČR. 2025. “Q&A: novela zákona o Vojenské policii.” ↗
11. Ministerstvo vnitra ČR. 2026. Návrh zákona, kterým se mění některé zákony s cílem posílit odolnost subjektů kritické infrastruktury proti bezpilotním systémům, with explanatory memorandum. eKLEP KORNDW7JRL1U, 21 July. ↗
12. Rzeczpospolita Polska. 2016. Ustawa z dnia 10 czerwca 2016 r. o działaniach antyterrorystycznych. Dziennik Ustaw 2016, item 904.
13. Rzeczpospolita Polska. 2025a. Ustawa z dnia 24 stycznia 2025 r. o zmianie ustawy Prawo lotnicze oraz niektórych innych ustaw. Dziennik Ustaw 2025, item 179.
14. Rzeczpospolita Polska. 2025b. Ustawa z dnia 8 grudnia 2006 r. o Polskiej Agencji Żeglugi Powietrznej, consolidated text. Dziennik Ustaw 2025, item 1267, Article 3b.
15. Rzeczpospolita Polska. 2026. Ustawa z dnia 29 maja 2026 r. o zmianie ustawy o zarządzaniu kryzysowym oraz niektórych innych ustaw. Dziennik Ustaw 2026, item 815.
16. Saeima. 2025. Grozījumi Apsardzes darbības likumā. Latvijas Vēstnesis 2, 6 January 2026. ↗
17. Svaz energetiky ČR. 2026. Stanovisko SEČR k návrhu zákona na posílení odolnosti subjektů kritické infrastruktury proti bezpilotním systémům. 17 August. ↗
18. Svaz průmyslu a dopravy ČR. 2026. Připomínky k návrhu zákona o ochraně kritické infrastruktury před drony. 20 August. ↗
19. Warner, Dave, Shaun Messinger, Chris Knight, Greg Scott, Jeff Clawson, Isabel Gardett, Tracey Barron, et al. 2014. “Characterization of Call Prioritization Time in a Police Priority Dispatch System.” Annals of Emergency Dispatch & Response 2 (2): 17–23. ↗

Download PDF

More about the Sentry-N2 system: White papers

← All analyses

Print version, current online version: https://silesianadvanced.systems/analyses/who-may-act/