Electronic warfare against drones is usually discussed in terms of jamming: disrupting navigation, breaking the control link or interfering with the video feed. But the communications link itself can also reveal useful information.

That applies just as much to custom-built and open-source systems as it does to commercial drones.

Many UAVs use open-source flight-control software such as PX4 or ArduPilot, often communicating with ground stations and companion computers using MAVLink. MAVLink is designed to be lightweight and efficient, but confidentiality is not built into the protocol by default.

PX4's own security documentation states that MAVLink messages are unauthenticated and unencrypted by default. Its MAVLink 2 signing capability can authenticate messages and prevent unauthorised commands, but does not encrypt the contents. PX4 therefore recommends securing the underlying communications link separately where confidentiality is required.

ArduPilot documents a similar limitation. MAVLink 2 signing can verify commands, but telemetry downlink data is unaffected and the signing mechanism does not encrypt the transmitted information.

This distinction matters because a custom drone can use an entirely open-source technology stack and still transmit useful telemetry in the clear if the radio link has not been secured separately.

Depending on the configuration, telemetry can include position, altitude, speed, heading, system state and other navigation information. That information is necessary for normal operation, but if an unauthorised receiver can obtain it, the datalink becomes an additional source of information about the aircraft.

This is not simply a theoretical concern. A 2024 study examining a real UAV using MAVLink and ArduPilot identified multiple protocol and implementation vulnerabilities, including weaknesses associated with spoofing, message forgery and denial-of-service attacks. Other recent research has focused specifically on adding authenticated encryption to MAVLink because the standard protocol does not provide message confidentiality by itself.

The important point is that using open-source software does not make a datalink inherently insecure, nor does using a proprietary system make it inherently secure. Security depends on how the complete communications architecture has been implemented.

That includes the flight controller, telemetry protocol, radio modem, ground station, companion computer and any additional network links between them.

DJI's DroneID system provides one well-documented example of what can happen when operationally useful information is exposed over radio. Researchers demonstrated that DroneID broadcasts could be decoded to recover both aircraft and operator location. But the broader lesson is not about DJI. It is that information transmitted by an aircraft can become useful to anyone capable of receiving and interpreting it.

Encryption also does not make a transmitter invisible. Even where the telemetry itself is protected, a radio transmission can still potentially be detected and analysed. The content of a transmission and the existence of the transmission are separate problems.

For developers working with open-source drone systems, this makes the datalink a systems-engineering issue rather than simply a radio choice. It is necessary to understand what data is being transmitted, which parts are encrypted or authenticated, what security is provided by the underlying radio, and what information remains observable from the transmission itself.

The practical lesson from current drone operations is therefore fairly simple: the flight controller may be open source, the airframe may be custom built and the radio may be commercially available, but the complete communications chain still needs to be treated as part of the aircraft's security model.

A drone can have a reliable control link and still expose useful information through that link. Encryption, authentication and emissions management address different parts of that problem, and they should not be treated as interchangeable.