Swift Cybersecurity
Blog

When the Threat Comes From Above: Capturing Drone Remote ID and Bluetooth Beacon Data to Build a Law Enforcement Case

Drone harassment cases — ex-partners hovering aircraft over a property, landlords surveilling tenants, stalkers tracking movement from the air — have become one of the fastest-growing categories of investigation requests we receive. Unlike most forms of surveillance harassment, drone operators leave a technically capturable trail while the aircraft is in the air. Our cybersecurity professionals deploy on scene alongside a licensed private investigator to capture that data in real time and turn it into an evidence package law enforcement can act on.

Drone harassment is not a fringe concern. We have seen it in divorce and custody cases, in landlord-tenant disputes, in stalking situations involving ex-partners, and in cases where business competitors attempt to photograph proprietary facilities or monitor employee activity. In every case, the drone operator relies on the assumption that their aircraft is anonymous — a small object in the sky with no identifying information visible from the ground. That assumption has been legally incorrect since September 2023, when the FAA's Remote ID rule took effect. And it is technically incorrect in ways most operators never anticipate.

What Remote ID Is — and Why It Changes Everything

The FAA's Remote ID rule requires all drones weighing more than 250 grams — virtually every commercially available model including the full DJI consumer and prosumer lineup — to continuously broadcast identifying information while in flight. This broadcast functions like a digital license plate transmitted over radio: the drone emits its serial number or session ID, its current GPS location, altitude, speed, and direction, the GPS coordinates of the operator's takeoff location, and a timestamp. These signals are not encrypted and are not private. They are intentionally designed to be receivable by anyone within radio range using standard consumer hardware. The FAA built the Remote ID system precisely so that law enforcement, safety officials, and members of the public could identify and locate drones operating in their airspace.

Remote ID broadcasts are transmitted on two radio frequencies: Bluetooth Low Energy (BLE) and WiFi 802.11 beacon frames. Both protocols are standard consumer wireless technologies, and both can be received with widely available off-the-shelf equipment. Our cybersecurity team uses calibrated field hardware to passively receive and log these broadcasts without any interaction with the drone or its operator.

How Our Team Works On Scene With the Licensed PI

When a client reports suspected drone surveillance, our response is a coordinated two-track deployment. The licensed private investigator on scene handles the visual investigation: documenting the drone's presence through timestamped video and photography, recording observable flight behavior, noting the direction and duration of approaches toward the subject, and managing the chain of custody for visual evidence. Simultaneously, our cybersecurity professionals operate the technical capture equipment — passive BLE and WiFi receivers that log the drone's Remote ID broadcast data in real time as the aircraft is in flight.

The technical capture produces a timestamped log of every broadcast received during the observation period: the drone's ID, its reported GPS coordinates, altitude, speed, direction, and the operator's reported takeoff location coordinates. Where the broadcast contains a hardware serial number rather than a session-linked identifier, that serial number is cross-referenced against the FAA UAS registration database to retrieve the registered owner's name and address. FAA drone registration — required for any drone over 250 grams — is tied directly to the registrant's personal information, which becomes part of the evidence package.

Bluetooth Beacon Proximity: Measuring How Close the Drone Got

The Bluetooth Low Energy broadcast used for Remote ID provides a capability beyond simple identification: proximity measurement. Every BLE signal carries an RSSI value — Received Signal Strength Indicator — which correlates with the physical distance between the transmitter and receiver. In open-air conditions, stronger RSSI readings indicate closer proximity; weaker readings indicate greater distance. By logging RSSI values at regular intervals throughout the observation period and correlating them with the timestamp and GPS data in the Remote ID broadcast itself, our team can generate a documented record of how closely the drone approached the subject over time.

This proximity data is significant for law enforcement purposes. Many stalking and harassment statutes require evidence that the subject was placed in reasonable fear, and evidence of repeated close-proximity approaches — documented not just by visual observation but by calibrated signal data — substantially strengthens that showing. The RSSI time series data, combined with the operator's reported location coordinates transmitted by the drone, also allows our team to document whether the operator was stationary or in motion during the surveillance — relevant when an operator claims the proximity was incidental or accidental.

What the Evidence Package Looks Like

Everything captured in a drone harassment investigation is compiled into a structured package formatted for law enforcement submission. The package includes the complete Remote ID broadcast log with timestamps, GPS coordinates, and RSSI readings for each observation interval; the licensed PI's timestamped visual documentation and written field report; FAA registration cross-reference results where a serialized ID was captured; a methodology summary documenting the equipment used, capture conditions, and chain of custody procedures; and a plain-language findings narrative that presents the technical data in a form that does not require specialized knowledge to evaluate.

Drone harassment can constitute criminal stalking, criminal harassment, or invasion of privacy under state law depending on the jurisdiction and the facts of the case. Federal law applies in cases involving commercial operations, airspace violations, or flights over protected facilities. Cases involving an identifiable operator and documented repeated proximity approaches are exactly the fact patterns that prosecutors and civil attorneys find actionable. Our evidence packages have been submitted to local law enforcement, prosecutors, and family court judges in support of criminal complaints, protective order applications, and civil harassment restraining orders. If the drone operator's identity remains unknown even after Remote ID cross-referencing — for example, if the operator registered under a different name or the drone is broadcasting a session ID without a traceable serial — our skip tracing team can extend the investigation using additional OSINT and field techniques.

Engaging Our Team Before the Next Flight

The critical limitation of this investigative approach is that Remote ID data only exists while the drone is airborne. There is no after-the-fact retrieval of broadcast data that was not captured at the time of the flight. If you are experiencing what you believe is drone surveillance, document every occurrence as precisely as possible — date, time, approximate direction of approach, duration — and contact our team immediately. The sooner we are engaged, the sooner we can have technical capture equipment staged and ready for the next incident.

This situation often intersects with other forms of technology-assisted harassment — particularly in cases involving post-separation coercive control, where a former partner uses multiple technological vectors simultaneously. Our team coordinates across investigation types to build a single comprehensive evidence record that addresses the full scope of the harassment pattern, not just the aerial component.

Learn about Cyber Protection Start Your Case

Ready to Take Action?

Connect with a verified, licensed investigator for your case — today.

Swift matches you with a credentialed PI or cyber investigator in your state. Confidential intake, fast response, professional results.