On the evening of November 16, 2023, a hobbyist launched a drone near M&T Bank Stadium as the Baltimore Ravens hosted the Cincinnati Bengals on Amazon Prime Video's Thursday Night Football. The aircraft entered stadium airspace. Referees halted play twice in the fourth quarter. Maryland Stadium Authority and state police eventually located the pilot; he was, the Authority later confirmed, "unaware of the restrictions and did not have a [temporary flight restriction] waiver to operate the drone in stadium airspace during the game."

This was not a sophisticated adversary — an uninformed hobbyist. And yet, under the legal framework that existed at the time, the Maryland State Police watching that aircraft penetrate restricted airspace were legally prohibited from doing anything about it.

What the FAA's Stadium TFR Actually Covers

FAA regulations governing stadium airspace are unambiguous. Under FDC NOTAM 4/3621, drone operations are prohibited within 3 nautical miles and up to 3,000 feet above ground level of any venue with seating capacity of 30,000 or more during covered events, beginning one hour before the scheduled start and running one hour after conclusion. Covered sports include NFL regular-season and postseason games, MLB games, NCAA Division I football, and NASCAR Cup Series races.

The penalties carry real weight. Civil fines can reach $75,000. Criminal exposure runs to $100,000 and up to one year in prison. The FAA can also confiscate the aircraft.

Marquee events expand the envelope further. Super Bowl LIX in New Orleans operated under a 10-nautical-mile inner TFR and a 30-nautical-mile outer ring closed entirely on game day, with altitude restrictions reaching 18,000 feet from 4:30 to 10:30 p.m. CST. For FIFA World Cup 2026, the FAA established TFRs not only over 11 stadium sites across host cities but also fan-fest locations, team hotels, and base camps — a layered aerial exclusion zone that tracks the tournament's entire operational footprint rather than just its venues.

The rules have been on the books for years. The problem has never been the rules.

A Legal Authority Gap Seven Years in the Making

Before December 2025, counter-UAS authority at public venues was cleanly divided along federal and non-federal lines. Federal law enforcement — FBI, DHS components — could detect, track, and actively mitigate unauthorized drones. State and local police could detect and report. Jamming, signal-hijacking, net-capture, kinetic intercept — all required special federal authorization that local officers did not possess.

The consequences scaled with the threat. Unauthorized drone incidents at NFL games climbed from 67 in the 2018 season to 2,845 in the 2023 season, a roughly 4,145 percent increase. The FBI and DHS cannot maintain mitigation-ready teams at 32 stadiums across the country on any given Sunday; the geography alone makes that structurally impossible.

Congress had been aware of the gap since at least 2018. The DEFENSE Act, introduced February 20, 2025, by Senators Tom Cotton and Jacky Rosen, would authorize DHS and DOJ to extend temporary counter-UAS authority — detection, tracking, control, seizure, or destruction of aircraft — to trained state and local officers over active stadium TFRs. The legislation drew public backing from the NFL, MLB, NCAA, and NASCAR. NFL Security Chief Cathy Lanier put the stakes plainly: "As the threat of illicit drone use continues to rise, it is critical that our partners in local law enforcement have the tools and resources they need to keep fans safe."

The Safer Skies Act, signed in December 2025, finally moved the line — beginning the formal expansion of counter-UAS authority to state and local law enforcement and closing what had become a seven-year structural gap. But a major international event was already in the final stretch of planning when the ink dried.

Deputization, $500 Million, and 78 Matches

For FIFA World Cup 2026 — 78 matches, 11 host cities, with stadiums and fan zones and team hotels all under active TFRs — federal planners fell back on an existing legal mechanism rather than wait for permanent statutes to fully clear. The DOJ-FBI Joint Terrorism Task Force framework allows the FBI to deputize state, local, tribal, and territorial law enforcement as temporary federal officers for specific counter-UAS missions at defined events.

"In effect, they become deputized, they become federal agents for this limited purpose," said Norm Coleman, representing World Cup host cities. Coleman was blunt about the legislative math: "I'm not waiting for Congress to do anything at this point in time." White House Task Force coordinator Andrew Giuliani acknowledged officials were "obviously hopeful that we can get legislation over the finish line" but did not want to "base a World Cup plan of safety and security solely on hope."

Deputization carries a hard prerequisite: officers must complete certification at the FBI's National Counter-UAS Training Center in Huntsville, Alabama — established in 2025 — before being authorized to deploy detection or mitigation technologies under the grant programs. FEMA awarded $250 million to the 11 host states and Washington, D.C. in December 2025, with a comparable second tranche expected in fiscal year 2027, for a total cited pool of $500 million.

The hardware fielded at World Cup venues spans current commercial practice. A DHS contract awarded in February 2026 brought Fortem's AI-powered DroneHunter — an autonomous net-firing interceptor — into venue coverage. Ondas/Sentrycs cyber-over-RF signal-takeover technology was deployed at more than half of the 11 locations. Boston Dynamics Spot robotic dogs, without facial recognition capability, were assigned to the International Broadcast Center in Dallas and the NY-NJ Stadium for perimeter security. FBI fielded its own counter-UAS protection teams at select venues for layered coverage.

"The biggest concern I have is, honestly, with drone defense. It is one of the areas that we are struggling with every single day," Mullin said, adding that officials were "not totally caught up." — DHS Secretary Markwayne Mullin

Mullin's assessment was grounded in recent data. At the Formula 1 Miami Grand Prix in May 2026, 8 unauthorized drones entered restricted airspace. At the Masters in Augusta that April, 12 did — both incidents occurring weeks before the World Cup kicked off. Compounding the enforcement picture: a national database for cross-referencing drone detections across venues does not exist, meaning an aircraft appearing at multiple events cannot be systematically flagged as a pattern.

Why It Matters

The World Cup is the largest counter-UAS test the United States has attempted at a civilian mass event. It is also, by design, provisional. Deputization is a legal mechanism calibrated for a specific context, not a durable framework. Permanent statutory authority — the kind that covers 32 NFL stadiums every autumn Sunday — still depends on legislation that has not fully arrived.

Two major events follow. The 2028 Summer Olympics in Los Angeles and America 250 anniversary events have been explicitly cited by planners and analysts as the next benchmarks requiring sustained counter-UAS infrastructure, not another ad hoc patch. What the World Cup builds — and more critically, what it exposes — becomes the operational template for those. The Huntsville certification pipeline is real but finite and cannot scale to the broader law enforcement workforce on a compressed timeline. And the absence of a national drone-detection data-sharing framework, cross-venue and cross-agency, remains an acknowledged gap that no current program fully addresses.

Detection at large venues is increasingly standard. The harder problem — who has the legal authority to act on that detection, with what tools, and under whose chain of command — is still being assembled, event by event.

Sources