Congress gave the Department of Defense money and homework. The FY2025 NDAA (P.L. 118-159) is not a cure-all. It is an operational push and a legal stopgap that recognizes drones are an everyday threat to installations. Commanders and base security staffs need to translate congressional directives into hardened routines, not papers.

What changed, concretely

1) Money for defeat. Congress increased procurement and RDT&E authorizations for counter-UAS programs, including significant additions for the Army’s Low, Slow, Small Integrated Defeat System (LIDS) and other interceptor efforts. That buys more kinetic and non-kinetic options, but does not replace the need for sensor density and training. (See P.L. 118-159 and CRS summaries.)

2) A requirement for a plan to field more kinetic effectors. The law directs the Army to produce and brief Congress on a plan to procure and field additional kinetic effectors for LIDS. That is a top-down nudge to move from pilots and pockets of coverage to greater scale and commonality across installations. (See Section 113, P.L. 118-159.)

3) A counter-UAS threat library and information sharing. The Joint Counter-Small UAS Office must establish and maintain a threat library that catalogs incursions, threat profiles, and candidate defeat measures to be shared across services, combatant commands, federal partners, and industry. This is designed to reduce redundancy, accelerate lessons learned, and speed procurement decisions. (See Section 353, P.L. 118-159.)

4) Strategy, doctrine, and exercise requirements. The NDAA directs the Department to issue updated memoranda and guidance on authorities to counter UAS, publish installation-level standard operating procedures, and run large-scale exercises to test responses to UAS incursions and swarms. That pushes the department to normalize C-UAS into routine base defense and training cycles.

5) Legal and operational limits remain. Title 10, Section 130i authorizes DoD to take action to mitigate UAS threats at specified “covered” facilities in the United States, but it requires close coordination with the Department of Transportation and the FAA when actions could affect aviation safety or airspace. It also includes sunsets and reporting obligations that constrain open-ended domestic kinetic response. In short, authorities are there but constrained by safety, interagency coordination, and oversight requirements. (See 10 U.S.C. 130i.)

Why this matters for bases

Drones have turned from nuisance to credible asymmetric vector. They can surveil, deliver explosives, or act as complex sensor networks that enable larger attacks. The NDAA moves funding and direction toward layered defenses, doctrinal clarity, and information fusion. That is progress, but the worst gap is not hardware. It is the intersection of policy, training, and integration.

Common failure modes

  • Patchwork coverage. Bases often have pockets of C-UAS capability without full perimeter detection or engagement coverage. Buying more interceptors without more sensors and resilient command and control simply shifts the gap.

  • Interagency friction. FAA safety concerns and local airspace users slow or constrain active defeat options. Legal coordination requirements are necessary, but they translate into time and bureaucratic friction when a fast decision is needed.

  • Data isolation. Without a common threat library and streamlined sharing, lessons from an incursion at one installation do not reach other commands or industry partners fast enough to prevent repeat failures.

  • Training shortfalls. New systems without realistic doctrine, training lanes, and large-scale exercises produce capability that exists on paper but not in the field.

Operational priorities commanders must treat as urgent

1) Sensor-first posture. Invest in layered detection: acoustics, RF, radar optimized for small UAS, and visual/EO verification. More interceptors without reliable detection equals expensive dead weight.

2) Standard operating procedures that work. Use the NDAA deadlines as triggers, not endpoints. Base commanders must craft simple, playable SOPs that define detection-to-decision timelines, delegated authorities for escalation, and safety checks with airspace managers.

3) Exercise the whole chain. Run multi-hour, multi-domain drills that include base defenders, air traffic managers, local law enforcement, and the JCO threat library feed. Validate that command and control, rules of engagement, and evidence collection work under stress.

4) Prioritize low-cost, scalable defeats. Not all threats require missiles or high-power microwaves. Geofencing enforcement, rapid netting and capture tools, autonomous interceptors designed for FPV and swarm profiles, and hard-wired RF-spectrum monitoring produce high value for limited budgets.

5) Fix the legal handoffs. Work with the DoD, DOT, FAA, and federal partners to pre-authorize playbooks for common, high-confidence intrusion profiles. Where safety requires coordination, build rapid notification channels and pre-cleared mitigation packages.

6) Operationalize the threat library. The JCO library should be treated as a living API into fielding decisions. Feed it validated incident packages, sensor signatures, and defeat outcomes. Industry and combatant commands must have prioritized access for rapid weaponization of lessons learned.

Risk tradeoffs to manage

  • Jamming and electromagnetic defeat measures can create collateral effects on aviation and comms. Prioritize selective, reversible options and robust testing on ranges before fielding in operational airspace.

  • Kinetic interceptors are expensive per engagement. They make sense against high-value threats and during sustained campaigns, not for noisy, low-cost harassment drones unless they are part of an asymmetric swarm campaign.

  • Privacy and oversight. Title 10 guidance requires Fourth Amendment- consistent handling of intercepted communications. Preserve chain-of-custody and minimize retention unless legally required.

Bottom line and recommendations

The FY2025 NDAA closed some gaps: funding, an operational push for more interceptors, a requirement to systematize knowledge, and deadlines for guidance and exercises. That is necessary, but not sufficient. Commanders must turn congressional direction into hardened routines. Focus on sensor density, clear SOPs with the FAA, realistic training, and a bias toward scalable, low-cost defeat options for the most common threats. Simultaneously, DoD and Congress should prioritize legislative fixes that remove pointless friction while preserving aviation safety and civil liberties.

If bases treat the NDAA as a checklist instead of a program of force posture change, drone threats will continue to exploit seams. Treat the new authorities and funding as the start of an industrial effort to turn installations into layered, redundant, and practiced defensive systems, not as a one-time hardware purchase.