The FBI has seized more than 600 drones flying in restricted airspace around World Cup venues since the tournament opened June 11, with confiscations in all 11 US host cities and the total doubling in under two weeks. Miami leads at 99, Atlanta and Dallas follow, and two weeks of matches remain before the final. This is the largest domestic counter-drone operation ever run, and the numbers from the outside perspective look like a solid success story. They are, but only for half of the c-UAS problem.
The architecture running this tournament did not exist two years ago. The FY26 NDAA extended counter-UAS authority to trained state and local law enforcement for the first time, and roughly 60 state and local officers now run electronic drone mitigation at World Cup sites alongside the federal teams. The mitigation those officers run is jamming and link takeover, which rides the same assumption as the detection: the drone has a signal to find. FEMA put $625 million against World Cup security. The FAA stood up its DETER initiative to accelerate enforcement and walled off every stadium with a three-nautical-mile restriction to 3,000 feet on match days. The legal authority, the money, and the interagency machinery that people in this field spent years asking for are now operating at scale, and grading how they perform matters more than the fact they exist at all.
Kansas City's joint operation has detected 19 drones in restricted airspace since June 11 and turned those detections into 18 law enforcement contacts with operators, 14 seizures, and 5 federal citations. A contact rate like that only happens when the drones are broadcasting and the pilots are standing nearby, since an RF-silent aircraft or a distant operator leaves the detection with nobody to approach. In Dallas, the FBI detected a DJI Mini over the stadium during a match and a task force officer reached the pilot within seconds.
Every one of the 600 seizures ran through that sequence: a drone announcing itself in the radio spectrum, an operator who could be located, and in most cases a citation or a confiscated aircraft. This is compliance enforcement against the careless and clueless population, the tourists, content chasers, and hobbyists who never checked a NOTAM, and against that population it works better than anything fielded before it. However, a deliberate attacker is a different problem, and the 600 number doesn't accurately reflect the prospective danger here.
The population that plans around detection already exists, and it is not hypothetical or foreign. A DHS-funded study documented 221 weaponized drone attacks by Mexican cartels between 2021 and 2025, with CJNG experimenting with fiber-optic control specifically to defeat jamming. NORTHCOM's commander testified that roughly 1,000 drones cross the southern border every month for smuggling and reconnaissance, and in February the FAA closed the airspace around El Paso International for hours over cartel drone incursions. None of those flights produce a seizure statistic, because nobody contacts those operators.
The technology at the far end of that population keeps moving. A drone on a fiber-optic spool emits nothing. A drone navigating on its own optics with the strike logic onboard emits nothing. A drone flying pre-programmed waypoints with the radio off emits nothing until it arrives. A detection architecture built around finding the signal and walking up to the pilot sees none of it. The 600 drone pilots that flunked the World Cup's airspace test will likely respond to a knock on the door from the FBI. The drone pilots running a thousand border sorties a month plan on never getting one.
For FIFA World Cup, the coverage windows run the same direction. Match-day restrictions protect each stadium for roughly a six-hour window around kickoff, while the threat surface extends to fan festivals under separate smaller restrictions, team hotels, training camps, and transit hubs. Mexican forces already brought down an unregistered drone at South Korea's training camp before a match. Of 104 matches, one, the July 19 final, carries the national special security event designation that brings Secret Service-led hardened perimeters and continuous counter-drone coverage. Every other match runs on the detect-and-contact model, which means the densest protective architecture this country fields will cover one venue for one day out of a forty-day tournament.
The layers that would handle a deliberate attacker remain largely untested in this environment: radar and optical detection against a non-emitting airframe in urban clutter, discrimination between a drone and everything else moving over a city, and any kinetic engagement above a crowd, where the debris from a successful intercept becomes its own casualty event. Moscow demonstrated that last problem across its own neighborhoods in June, when intercept wreckage from a mass drone raid hit a mall, houses, and a car. The legal authority to engage over American crowds has expanded faster than the doctrine for doing it, and there is still no proportionality standard, no engagement rules for fires over 70,000 people, and no answer for who is accountable when a lawful intercept goes wrong. In reality, the World Cup will probably close without any of that being tested, but the software and hardware are rapidly progressing to the point where the next World Cup will be tested.
In the US, we have built the first floor of c-UAS defense and it works: detection of emitting drones at scale, legal authority pushed to the local level, operator identification fast enough to matter, and interagency coordination across eleven cities at once. None of it existed two years ago, and the people who built it earned the results they are getting.
A deliberate adversary starts where these numbers end. A drone on a fiber spool gives the RF sensors nothing. A drone flying its own optics with the strike decision onboard gives them nothing, and Russia began fielding that configuration on its cheapest mass-produced airframe in Ukraine this month, with the same autonomy showing up on both sides of the front and moving toward anyone with the money to buy it. The 600 drone seizures prove the system works against pilots who announce themselves. Nothing about the next attacker says they will.