Why did Amazon leave the Commercial Drone Alliance?

Answer: Amazon left the Commercial Drone Alliance because the Alliance is pushing a broadcast-only safety model that removes the requirement for drones to independently detect and avoid obstacles.

Context and principles: The FAA is writing the rules for BVLOS (Beyond Visual Line of Sight) drone operations. This is when a drone flies autonomously, out of the operator's sight, making its own navigation decisions. Two approaches are competing for how to conduct these flights safely.

The Commercial Drone Alliance wants all aircraft below 500 feet to broadcast their position, speed, and heading using ADS-B or similar protocols. Their logic is simple: if everyone announces where they are, everyone can avoid each other. They argue that onboard detect-and-avoid sensors (radar, cameras, LIDAR) are too heavy, too expensive, and impractical for small delivery drones.

Amazon's position is different. Amazon says drones need onboard detect-and-avoid. Cameras, radar, and sensors on the drone itself that can independently see obstacles, regardless of what other aircraft are broadcasting. Amazon left the Alliance because they believe the broadcast-only approach is not safe enough. And they have data to back it up.

Over 70,000 flights, Amazon's Prime Air detect-and-avoid system performed successful collision avoidance on two potential mid-air collisions with other aircraft. One of those was a helicopter. That helicopter was legally required to broadcast its position over ADS-B. It wasn't broadcasting. Under a broadcast-only safety model, the drone would have had no idea the helicopter was there. The onboard sensors caught what the broadcast system missed.

That is the difference between a system that depends on everyone else following the rules and a system that can independently verify what is actually in front of it.

Key takeaway: A broadcast-only safety model fails when a single aircraft does not comply. Independent detect-and-avoid does not have that dependency.

How does broadcast-only navigation create a GPS spoofing attack surface?

Answer: Requiring drones to continuously broadcast precise position, speed, and heading on unencrypted channels hands an attacker the data they need to covertly hijack the drone's GPS.

The hardest part of GPS spoofing is not generating a fake signal. The hard part is making the fake signal match what the drone's navigation system already expects, so the drone doesn't notice the switch. To do that covertly, the attacker needs real-time position and velocity data.

Research from the UT Austin Radionavigation Lab showed that covert GPS capture requires precise knowledge of the target's position and velocity, and that the spoofer could obtain this data by intercepting ADS-B messages. Both ADS-B and Remote ID transmit on unencrypted, unauthenticated channels. No encryption, no authentication, no integrity verification. And this situation is not likely to change soon.

Without that broadcast data, a spoofing attempt is noisy. The drone's Extended Kalman Filter detects the mismatch and triggers a failsafe. With the broadcast data, the attacker generates a signal that matches within the required tolerances (80 nanoseconds of time offset and 500 meters of location offset), and the drone doesn't flag an anomaly.

Attack sequence:

1. Attacker passively collects broadcast position, speed, and heading using a cheap SDR receiver or smartphone app. No active scanning required.

2. Attacker configures a GPS spoofer to generate counterfeit signals precisely aligned with what the drone's receiver expects

3. Attacker gradually overpowers the legitimate GPS signal while maintaining alignment. The navigation system never flags the switch.

4. Attacker slowly introduces positional offsets, steering the drone off course

5. Without onboard detect-and-avoid, no independent sensor exists to cross-check the GPS data

Context: GPS signals travel over 12,000 miles from satellites in orbit. By the time they reach the drone, they are extremely weak. A low-power SDR transmitting from the ground at close range can overpower them with very little effort.

Without broadcast data, this attack is hard. The attacker has to independently figure out where the drone is and how fast it is moving. And if you get it wrong, the drone's navigation system detects the mismatch and triggers a failsafe. The attack is noisy and easy to catch.

With mandatory broadcast, the attack becomes much easier. The attacker sits back, passively collects the drone's telemetry, aligns the spoofed signal to match expected values, and takes control without triggering any alert. The drone flies wherever the attacker wants.

This is not theoretical. The UT Austin team demonstrated successful GPS capture of UAVs using broadcast telemetry data. The CDA's proposal would mandate the broadcast of this data by regulation.

Key takeaway: The CDA is proposing a system that mandates the broadcast of the telemetry data an attacker needs to hijack a drone, while opposing the primary defense that would catch the attack and prevent collisions.

What can AI Agentic App Builders Learn From This?

Ask one question in every design review: does this control still work without a human in the loop?

In traditional aviation, pilots also broadcast their position over ADS-B. But GPS spoofing does not cause a human pilot to fly into a school. The pilot can cross-check instruments, look out the window, or radio air traffic control. The pilot is the final detect-and-avoid system.

When you remove the pilot and go autonomous, every control that silently depended on human judgment becomes a single point of failure. The broadcast system was one layer in a stack that included a trained human with eyes, instruments, and judgment. It was never designed to be the only safety layer.

And broadcast compliance is not guaranteed. In January 2025, a U.S. Army Black Hawk helicopter collided with an American Airlines regional jet over the Potomac River. The helicopter was not broadcasting ADS-B. Sixty-seven people died. Congress introduced the ROTOR Act to mandate ADS-B on military aircraft. The House rejected it in February 2026. Military helicopters still fly without broadcasting their position. The CDA's broadcast-only model depends on universal compliance in a world where we have fatal proof that compliance is not universal, and where Congress has declined to fix it.

This is the same pattern repeating in AI agent and autonomous system design. Teams take controls that worked under human supervision, such as output review, access controls, or monitoring dashboards, and deploy them in systems where no human is watching in real time. The threat model changed the moment the human was removed.

When I first joined Prime Air, the engineering team shared an analogy. You can drive a car into a wall. The car does exactly what you tell it. But a horse will stop. A horse has its own sense of self-preservation. It sees the wall and refuses. The vision was to build a horse, not a car. A system that is independently safe.