Ten years after Congress ordered it, the Federal Aviation Administration has finally proposed a rule governing who can ground drones over America's power plants, refineries, prisons, and rail yards. The catch: as written, the restrictions it authorizes never have to end, and nobody outside the facility has to be told they exist.
On May 6, 2026, the FAA published its Notice of Proposed Rulemaking implementing Section 2209 of the FAA Extension, Safety, and Security Act of 2016 (Public Law 114-190), which gave the agency 180 days to build a petition process for fixed-site facilities seeking drone restrictions. The FAA missed that deadline by roughly nine years. The proposed rule, docketed as FAA-2026-4558 (RIN 2120-AL33), would create a new 14 CFR Part 74 establishing "Unmanned Aircraft Flight Restrictions," or UAFRs — a two-tier system covering an estimated 125,000 candidate sites across the 16 critical-infrastructure sectors named in National Security Memorandum 22, with the FAA projecting more than 9,000 facilities will actually apply over five years, at an estimated annualized cost of $21–31 million.
What the Rule Actually Does
A Standard UAFR restricts drone flight within a facility's property lines up to a default 400 feet AGL, requires baseline security measures like restricted access and Remote ID receivers, and permits commercial, public-safety, and delivery operators to transit through if they broadcast Remote ID and notify the facility in advance. A Special UAFR — reserved for facilities with a documented credible threat or sponsored by a federal security agency — is modeled on the existing Special Security Instructions process under 14 CFR 99.7, carries five-year terms, and can be designated as national defense airspace, meaning unauthorized incursions become a criminal matter rather than a civil one.
The FAA gave the public 60 days to comment, then extended the window from July 6 to August 5, 2026 after pushback from industry and civil-liberties groups. The National Press Photographers Association filed its comments on July 20, and its objection isn't to the rule's existence — it's to what the rule leaves out.
Steelmanning the FAA's Approach
The case for giving critical-infrastructure operators a fast, low-friction path to restrict drone overflight is genuinely strong. Power substations, chemical plants, and prisons are exactly the kind of targets where a single successful drone incursion — whether from a hobbyist, a criminal casing a site, or a hostile actor testing defenses — can cause outsized harm, and the current patchwork of ad hoc Temporary Flight Restrictions has left operators without a durable tool. A standardized, FAA-run application process with defined safety criteria is a real improvement over the status quo, and the Standard UAFR's built-in carve-outs for Part 91/107/108/135/137 operators who broadcast Remote ID and give advance notice show the agency wasn't trying to seal off the sky entirely. A decade of statutory delay is also its own argument for finally getting something on the books rather than continuing to wait for a perfect version.
But a rule can get the safety balance right and still get the accountability structure wrong, and that's the NPPA's actual complaint. As the organization put it in its filing, a UAFR "has no expiration date and no review clock in the current draft." Once a facility wins a Standard UAFR, it can remain in effect indefinitely, with no periodic FAA review, no sunset provision, and — critically — no public registry that tells a journalist, researcher, or ordinary pilot which of the 125,000 eligible sites actually has one, what its boundaries are, or when it might lapse. NPPA General Counsel Mickey Osterreicher has warned that restrictions "adopted in the name of security can gradually expand beyond" their original scope. NPPA President Alex Garcia's framing is the right one: "security and transparency are not opposing goals."
The Missing Newsgathering Carve-Out
The more specific gap is that the proposed rule exempts public-safety drones and delivery operators by name but never once uses the words "journalist," "reporter," or "newsgathering" — not in the regulatory text, not in the preamble. Drones have become standard equipment for covering wildfires, floods, industrial accidents, and protests near exactly the kind of infrastructure this rule covers, and a permanent, undisclosed UAFR effectively removes that vantage point with no First Amendment-specific consideration built into the application process at all.
That is a fixable defect, not a reason to scrap the rule. The FAA doesn't need to weaken the safety case for restricting drones near a chemical plant to add three things the NPPA specifically asked for: a public, searchable registry of active UAFRs and their boundaries; a fixed expiration date with mandatory periodic re-justification, mirroring the five-year clock already built into Special UAFRs; and a narrow, Remote-ID-gated exemption path for credentialed newsgathering comparable to what public-safety operators already get. None of those changes touch the underlying security rationale — they just make sure a tool built to protect a power plant doesn't quietly become a permanent, invisible blackout zone with no one accountable for deciding it should stay that way.