Daily Surveillance Briefing, August 4, 2026: Drones Watch Backyards

Drone First Responder programs are spreading faster than the rules meant to govern them. In New York, a bill aimed at AI crawlers could give publishers a path to unmask anonymous researchers.

State of Surveillance Editorial Team

Today in Surveillance:

  • Drone First Responder programs are scaling rapidly. EFF says more than 1,000 U.S. public-safety agencies had received FAA waivers by February 2026. The drones can send live video from 911 calls and capture views of backyards, roofs, and through windows [1].
  • New York's stealth-crawler bill is on Governor Kathy Hochul's desk. S9934A would require crawlers visiting covered news sources to identify themselves and their purposes. EFF and 18 civil-society groups say the bill could expose journalists, security researchers, and privacy tools [3][4].

More Than 1,000 Agencies Can Send Drones to 911 Calls

The biggest story today is not a new camera. It is the speed at which police departments are getting permission to fly cameras beyond an officer's line of sight. Drone First Responder, or DFR, programs send a small drone toward a 911 call while officers are still on the way. A dispatcher receives live video before the ground unit arrives. The pitch is faster information. The privacy cost is an aerial sensor pointed at homes before anyone has decided that a search is justified.

In a July analysis, the Electronic Frontier Foundation said more than 1,000 public-safety agencies had received FAA waivers for DFR programs by February 2026. The FAA had granted 976 DFR waivers from the first program in 2018 through April 2025. After the agency streamlined its process in April 2025, it issued more waivers between April 2025 and February 2026 than in the previous seven years combined [1]. The full Drone First Responder Programs Now Hit 1,000 Agencies lays out how a regulatory change turned a slow-moving experiment into a national pipeline.

That pipeline matters because DFR is not just a faster patrol car. The FAA's Beyond Visual Line of Sight approval lets a pilot operate from a desk rather than stand beside the aircraft. EFF describes programs using launchpads around cities, with AI helping launch and navigate drones while one operator handles multiple devices [1]. The system changes the default response to a call: the first arrival can be a persistent, high-definition view from above.

What can that view include? EFF says DFR drones can capture footage from “backyards, roofs, through windows,” including places a casual patrol officer could not see. A subject can be watched for minutes without realizing that a drone is overhead [1]. The ACLU says more than 1,400 U.S. police departments use drones of some kind and warns that DFR programs are spreading with little oversight or accountability [2]. Those figures describe different things. EFF's count concerns agencies with FAA waivers for DFR programs. The ACLU count covers police departments using drones generally. Neither is a count of people under surveillance, which is exactly why the numbers should not be casually combined.

The back end makes the camera more consequential. EFF says Flock Safety has turned drones into “flying ALPRs,” allowing aerial footage to feed a license-plate-reader network. Axon says its DFR platform is one of its fastest-growing sectors [1]. A drone launched for a low-risk call can therefore become part of a broader identification system, not a single-use response. EFF cites deployments in Chula Vista tied to unhoused people, mental-health concerns, and loud music. A camera that arrives for a minor call still sees the properties and people along its route [1].

There are safeguards, but they are uneven. California's AB 481 requires advance notice before a department acquires covered equipment, a use policy before procurement, and annual updates on how it is used. EFF also points to city portals that publish flight paths and reasons in real time [1]. Those requirements do not automatically follow from an FAA waiver. The immediate question for any community is simple: what launches the drone, what does it record, where does the footage go, and who can search it later?

New York Bill Could Turn Anonymous Crawling Into an Identity Problem

The day's second story moves from the sky to the open web. EFF joined 18 civil-society organizations in asking Governor Hochul to veto New York's S9934A, the Stealth Crawler Prohibition Act. The bill has passed both chambers and is now awaiting the governor's decision [3][4]. It is framed as a response to aggressive AI scraping. EFF says its mechanism reaches much further: it puts anonymous automated access itself in the crosshairs.

The bill defines a crawler broadly. The definition covers software that retrieves, scans, indexes, scrapes, or otherwise accesses a website, including a bot, user agent, AI agent, or equivalent tool [4]. A covered news source must perform a journalism-like public-information function, publish or update at least monthly, maintain an error-correction process, and have at least 1,000 monthly active viewers, listeners, users, or subscribers in New York [4].

Before accessing such a source, a crawler would have to disclose a valid and accurate user-agent string naming its software, version, and company. It would also have to disclose all uses and purposes for the content [4]. The Attorney General could seek civil penalties of up to $15,000 per day for each violation. The bill also allows a journalism provider to seek a pre-action subpoena from a service provider to identify an alleged violator [4].

That subpoena power is where the privacy fight starts. EFF says the news source would not first have to show misconduct or actual injury before seeking to unmask automated traffic [3]. A law intended to make AI companies identify themselves could instead create a path for a publisher to seek the identity behind a research tool, a security investigation, or a privacy extension.

EFF's examples are not theoretical. The Markup used anonymous crawlers identifying as Firefox to investigate Amazon's treatment of its own brands. ProPublica used an automated tool that simulated an ordinary customer to investigate Amazon steering shoppers toward more expensive products. Cybersecurity professionals use anonymous scraping to monitor threats, and EFF says Privacy Badger crawls sites anonymously to detect trackers [3][5]. The protection these projects need is the ability to observe a service as an ordinary visitor. If the observer must announce every identity and future purpose first, the test is no longer ordinary.

There is a real problem on the other side. Publishers pay for bandwidth and server infrastructure, and aggressive crawlers can burden a site. EFF's Tori Noble argues that technical defenses, including rate limits, robots.txt, and blocking abusive traffic, address that problem more directly than a law aimed at anonymity [5]. The distinction matters. A server can reject harmful traffic without learning the name of every researcher who visits it.

The EFF + 18 Groups Urge Hochul to Veto NY's Stealth Crawler Bill follows the statute's definitions and the coalition's objection. For readers, the practical stake is not whether AI companies should be allowed to scrape everything. It is whether protecting publishers requires building a deanonymization route that can be used against people doing public-interest work.

What to Watch

DFR oversight. Ask whether a city has a public use policy before it accepts a DFR program, whether launches are limited to defined emergencies, and whether live feeds are kept out of wider ALPR or analytics systems. California's AB 481 process offers a transparency baseline, but the FAA waiver itself does not answer those local questions [1].

Hochul's decision. S9934A's effective date is 90 days after it becomes law. The next development is whether the governor signs, vetoes, or allows the bill to lapse without action [3][4]. Watch for whether any final version narrows the definition of crawler or the subpoena route.

The line between access and identity. Both stories turn a normal activity into an identity system. A drone sent to a call can identify homes and vehicles that were not the reason for the dispatch. A crawler visiting a public page can be required to identify the person or organization behind it. The question in both cases is the same: what information must be collected before anyone has shown that the person did anything wrong?

Sources

  1. Electronic Frontier Foundation, Beryl Lipton - “Hundreds of Drone First Responder Programs Could Soon Be Launched Across the Country” (July 23, 2026). https://www.eff.org/deeplinks/2026/07/hundreds-drone-first-responder-programs-could-soon-be-launched-across-country
  2. American Civil Liberties Union, Jay Stanley - “Eye-in-the-Sky Policing Needs Strict Limits” (July 26, 2023). https://www.aclu.org/documents/eye-in-the-sky-policing-needs-strict-limits
  3. Electronic Frontier Foundation, Rindala Alajaji and Tori Noble - “EFF Joins 18 Civil Rights Organizations Calling on Governor Hochul to Reject the Stealth Crawler Prohibition Act” (August 3, 2026). https://www.eff.org/deeplinks/2026/08/eff-joins-18-civil-rights-organizations-calling-governor-hochul-reject-stealth
  4. New York State Senate - S9934A, Stealth Crawler Prohibition Act (2025-2026 session). https://www.nysenate.gov/legislation/bills/2025/S9934/amendment/A
  5. Electronic Frontier Foundation, Tori Noble - “‘Stealth Crawlers’ Are Not a Threat to the Open Web. Bills Targeting Them Would Be.” (July 20, 2026). https://www.eff.org/deeplinks/2026/07/stealth-crawlers-are-not-threat-open-web-bills-targeting-them-would-be