Introduction
Twenty-two months after the September 11 attacks, Congress wrote a rule into law that still governs American flight instruction. Under Section 612 of the Vision 100 – Century of Aviation Reauthorization Act, an FAA-regulated flight school may not train a foreign student until the federal government has determined the student poses no threat to aviation or national security. The provision exists for a specific documented reason: the hijackers learned to fly at U.S. flight schools.
That framework was written around aircraft with pilots inside them. It has never been extended to unmanned aircraft.
Today a foreign national who wants to learn to fly a Cessna must be cleared by the Transportation Security Administration before the first lesson, and the school must document it. A foreign national who wants to learn to fly a drone can enroll in an American drone course, pay by card, and complete it without any federal agency being notified the enrollment occurred.
This is not a hypothesis about what might happen. It is a description of the current regulatory perimeter — and it sits alongside a second gap, in how drones owned or registered abroad enter U.S. airspace. Nexfinity News reviewed the governing statute, TSA’s 2024 final rule, FAA aeronautical information publications, 14 CFR Part 48 and current FAA registration data to map both.
The article that follows also states the strongest case against reading too much into the comparison. Both belong in the record.
This piece follows our earlier reporting on drone warfare as an asymmetric equalizer and our investigation into how Flock Safety built America’s largest covert surveillance network.
Background: What Congress Built After 9/11
The program began in 2004 as the Alien Flight Student Program. TSA established screening requirements for foreign nationals seeking flight training and required flight training providers to designate security awareness staff. In 2022 it was renamed the Flight Training Security Program. TSA finalized the long-standing interim rule in May 2024.
The obligations it places on covered providers are substantive. Flight training providers must notify TSA of all training events for candidates and must validate that a candidate holds a current Determination of Eligibility before providing training. All covered providers must also designate a Security Coordinator, provide security awareness training to their employees, and maintain records demonstrating compliance.
The program’s scope is defined by certificate and rating. Per AOPA’s guide to the rule, it applies to flight training toward an initial pilot certificate — recreational, sport or private — as well as instrument ratings, multiengine ratings, type ratings, and recurrent training for type ratings, delivered by FAA-certificated flight training providers, including individual flight instructors and Part 142 training centers.
The remote pilot certificate does not appear on that list.
The Gap: Nobody Certificates a Drone School
Manned aviation has FAA-certificated pilot schools under Part 141 and training centers under Part 142. There is no equivalent category for drone instruction.
Part 107 requires no documented pre-test training of any kind. An applicant may sit the knowledge exam having studied nothing but the FAA’s free Remote Pilot study guide. The commercial schools that grew up around the exam — online ground schools charging roughly $249 to $299 for lifetime course access — are ordinary businesses. Where they carry credentials at all, those come from private bodies: one leading provider advertises accreditation from the International Accreditors for Continuing Education and Training, a continuing-education accreditor, not an aviation regulator.
Because these schools are not FAA-certificated flight training providers, and because the remote pilot certificate is not a covered certificate, the Flight Training Security Program does not reach them. No Determination of Eligibility. No TSA notification of training events. No Security Coordinator requirement. No compliance recordkeeping.
Vetting exists — but it comes last. The FAA’s Aeronautical Information Manual states that all applicants, regardless of nationality, must pass a TSA Security Threat Assessment before the agency will issue a temporary or permanent remote pilot certificate. TSA conducts this under its Airmen Certificate Vetting Program, which was expanded to cover remote pilots when Part 107 took effect.
That check runs after the coursework, after the exam, and only for people who choose to pursue certification. Identity verification in the sequence happens at the roughly 800 FAA-approved knowledge testing centers, where a government-issued photo ID is required and a foreign passport is acceptable. Nothing in the chain records who studied — only who tested and applied.
And recreational flying bypasses the chain entirely. A foreign national must pass TRUST, The Recreational UAS Safety Test, to fly recreationally in the United States. The FAA states plainly that there are no minimum age or other eligibility requirements to take TRUST. It is free, online, taken once, and produces no central registry of who passed.
In simple terms: the government vets the people who want a commercial certificate, at the end of the process. It does not know who is being trained, and it does not vet anyone flying for fun.
Foreign Registration: Rules That Exist but Are Self-Attested
Aircraft registration is where citizenship actually bites, and the rules are more restrictive than most operators realize.
Under 14 CFR Part 48, a small unmanned aircraft may be registered only if it is not already registered under the laws of a foreign country and is owned by a U.S. citizen, by a foreign national lawfully admitted for permanent residence, or by a corporation organized and doing business under U.S. law with the aircraft based and primarily used in the United States. The FAA states that for foreign operators, the certificate it issues functions as a recognition of ownership rather than a certificate of U.S. aircraft registration. Registration terminates automatically if the holder loses U.S. citizenship, or if a resident alien loses that status without becoming a citizen.
Drones weighing 55 pounds or more fall outside Part 48 entirely and must be registered under Part 47 with an N-number.
For aircraft already registered abroad, a separate track applies:
· A Notice of Identification must be filed with the FAA through FAADroneZone before operating a foreign-registered, Remote ID-equipped drone in U.S. airspace. The FAA issues a CID in return, which must be present at the control station and producible on request by the FAA or law enforcement. The requirement covers both recreational and Part 107 flight.
· The drone or its broadcast module must appear on an FAA-accepted Declaration of Compliance. A foreign-registered aircraft without Remote ID may be flown only inside an FAA-Recognized Identification Area.
· Commercial operation of a foreign civil aircraft additionally requires economic authority from the Department of Transportation under Part 375 — a foreign aircraft permit that should be applied for at least 15 days ahead and can take roughly 30 days to issue.
The certificate itself carries no nationality restriction. Part 107 does not require U.S. citizenship, and the FAA notes the United States currently has no bilateral agreements permitting issuance of a U.S. remote pilot certificate on the basis of a foreign one — so every foreign applicant enters through the same domestic exam and vetting sequence.
The accurate criticism here is not that the rules are absent. It is that they are self-attested and unaudited. Registration is a $5 online form. The NOI is a self-submitted filing. Nothing in the system independently verifies the assertions made in either.
One figure from the FAA’s own survey work deserves scrutiny. Among foreign Part 107 registrants, 41.0 percent reported conducting zero flights in 2025, against 8.0 percent of domestic Part 107 operators, according to the FAA Aerospace Forecast FY2026–2046. The FAA presents this as a behavioral difference among registrants. It also describes a population that completed U.S. registration and certification and did not fly.
Where the Comparison Breaks Down
Three objections deserve a direct answer, because they are the ones a regulator would raise.
Training was the bottleneck in 2001. It is not the bottleneck now. The hijackers required months of instruction to fly a wide-body airliner. A consumer drone requires none — it flies out of the box. Part 107 coursework teaches airspace classification, weather, sectional charts and regulations, not stick-and-rudder skill. Gating enrollment would not remove a capability, because the capability does not come from the school. This is the single strongest argument that the analogy does not transfer, and it is largely correct.
The population that enrolls is the compliant population. People who pay for ground school and sit a proctored exam are seeking to operate legally. They are also the one group the system already screens, through the TSA Security Threat Assessment. The operators driving the incident data — cartel crews at the border, contraband deliveries into prisons, unidentified operators near airports — are not enrolling in $299 courses.
“Unregulated” overstates it. Drone registration, Remote ID, the NOI regime and Part 375 all exist and are reasonably detailed. The defensible characterization is unaudited, not absent.
What survives all three objections is narrower but still real: the United States maintains a security-vetting regime for aviation training whose scope was fixed in 2003, and the fastest-growing category of civil aircraft sits outside it. Whether that scope should change is a policy judgment. That it has not been revisited is a matter of record.
Policy Explanation: What the Rest of the Rules Require
Three regimes are commonly collapsed into the phrase “drone license.” Only one involves a background check.
Manufacturing. There is no federal manufacturing license for small unmanned aircraft. A company can design and build drones in the United States without applying to the FAA for permission to be a manufacturer. Under Part 89, producers of standard Remote ID drones and broadcast modules must file a Declaration of Compliance attesting the product meets Remote ID performance requirements under an FAA-accepted means of compliance. Manufacturers pursuing design or production approval under Part 21 demonstrate compliance through that process instead. Kit sellers must file a Declaration of Compliance; a person assembling that kit for personal use does not. Separately, the onboard radio requires FCC equipment authorization, and any design qualifying as a defense article falls under export-control licensing.
Operating. The Part 107 remote pilot certificate is required for flight conducted for business purposes or compensation. Applicants must be at least 16, read and understand English, pass a 60-question knowledge exam at 70 percent or better, and complete recurrent training every 24 months.
Registering. Drones at or above 250 grams must be registered through FAADroneZone at $5 for three years, self-service and self-attested.
Purchasing. No federal law requires a background check, waiting period, licensed dealer or transfer record to buy a drone. Federal obligations attach after purchase — registration, Remote ID, a 400-foot ceiling, visual line of sight, airspace restrictions — and each depends on the buyer choosing to comply.
Examples: The Fleet and the Incident Record
The FAA’s public dashboard lists 837,513 registered drones and 481,760 certificated remote pilots. Drones under 250 grams flown recreationally need no registration at all; the FAA estimated roughly 310,000 such micro units were imported in 2024 alone, and outside researchers place the true total U.S. fleet at approximately 5 to 6 million units. The FAA’s Aerospace Forecast counted 493,396 remote pilot certifications issued through December 2025 and projects 628,600 certified remote pilots by 2030.
The incident data has moved sharply in 2026.
· Airports. The FAA reported 601 drone sightings near U.S. airports from April through June 2026, up from 320 in the prior quarter, and says it now receives more than 100 reports a month. On June 29, 2026, the crew of a JetBlue A321 approaching JFK reported striking a suspected drone at roughly 3,000 feet. The aircraft landed safely with no damage found.
· Prisons. The Federal Bureau of Prisons recorded 23 drone sightings in 2018 and 479 in 2024, involving deliveries of drugs, weapons and cell phones.
· Mass events. DHS and the FBI recorded more than 600 drone incursions into restricted airspace across U.S. World Cup host-city venues as of June 20, 2026, with more than 300 drones seized.
· The border. A DHS counter-drone official told lawmakers cartels use drones nearly daily to move narcotics and surveil Border Patrol, with more than 27,000 drones detected. On Feb. 10, 2026, the FAA abruptly closed airspace around El Paso International Airport, halting 43 scheduled departures and disrupting travel for roughly 5,900 passengers. The order was rescinded in under eight hours. Officials initially attributed it to a cartel drone incursion; subsequent reporting indicated the closure stemmed from a dispute over a Pentagon laser test.
Impact: Enforcement Capacity Is Early
Congress addressed part of the response gap in the SAFER SKIES Act, enacted in the FY2026 National Defense Authorization Act and signed Dec. 18, 2025. Until then, authority to disable a drone in flight belonged to a small number of federal agencies; local police who wanted counter-drone capability had to be deputized as federal task force officers.
DOJ and DHS issued a joint interim final rule effective July 1, 2026, creating an independent certification pathway for state, local, tribal and territorial law enforcement and correctional agencies. Participating agencies must adopt an implementation policy, designate an approving official, and follow data retention and dissemination limits. The comment period closes Sept. 4, 2026.
Uptake is early. Roughly 46 agencies and 61 individually certified officers had completed mitigation training as of the rule’s publication. The departments project about 1,500 agencies at the detection tier and 150 at the mitigation tier within two years — against a national total of roughly 18,000 law enforcement agencies. The Congressional Research Service has flagged the certification pace as an open question for Congress.
Conclusion
The strongest version of this story is not a prediction. It is a precedent.
Congress has already decided that aviation training is a security chokepoint worth regulating, and built an apparatus to police it — eligibility determinations, security coordinators, event notifications, recordkeeping. That apparatus was scoped in 2003 to the aircraft that existed then. Unmanned aircraft, now numbering in the millions and generating more than a hundred airport sightings a month, fall entirely outside it.
Reasonable people can conclude that is the correct outcome — that drone training confers no capability worth gating, and that scarce vetting resources belong elsewhere. What is harder to defend is that the question appears never to have been formally asked. Nexfinity News found no public record of TSA or the FAA evaluating whether the Flight Training Security Program should extend to unmanned aircraft instruction.
Two enforcement models are in play, and both assume compliance. Supply-side controls — tariffs, the FCC Covered List — determine which companies may sell new aircraft here. Identity-side controls — Remote ID, registration, the NOI regime — assume the operator broadcasts and files. Neither reaches the fastest-growing category: counter-drone firm Dedrone found do-it-yourself and FPV builds accounted for 9.82 percent of drones detected worldwide in 2025, a 4.3-fold increase over 2024. A home-assembled FPV aircraft has no manufacturer, files no Declaration of Compliance, carries no Remote ID unless the builder installs one, and leaves no purchase record.
Nexfinity News has requested comment from TSA regarding whether the Flight Training Security Program has ever been assessed for extension to unmanned aircraft instruction, and from the FAA’s UAS Integration Office regarding auditing of self-attested registrations and Notices of Identification.
Key Takeaways
· The post-9/11 flight training rule does not cover drones. The Flight Training Security Program requires TSA clearance, provider notification and recordkeeping for foreign nationals seeking pilot certificates and ratings. Remote pilot certification and drone ground schools fall outside its scope.
· No agency certificates a drone school. There is no Part 141 or Part 142 equivalent, and Part 107 requires no documented pre-test training at all.
· Vetting comes last, not first. TSA runs a Security Threat Assessment on all Part 107 applicants regardless of nationality — after training and testing. TRUST, the recreational test, has no age or eligibility requirement.
· Foreign registration rules exist but are self-attested. Part 48 limits registration to U.S. citizens, permanent residents and qualifying U.S. corporations; foreign owners receive a recognition of ownership. Foreign-registered drones require a Notice of Identification and, for commercial work, a DOT Part 375 permit. Nothing independently verifies either filing.
· The counterargument is real. Drone training confers far less capability than manned flight training, and the people generating incident data are not enrolling in ground school.
· The FAA lists 481,760 certificated remote pilots and 837,513 registered drones, against a true fleet estimated at 5 to 6 million units.
Sources
1. Vision 100 – Century of Aviation Reauthorization Act (P.L. 108-176)
2. Federal Register — Flight Training Security Program final rule (May 1, 2024)
3. AOPA — TSA finalizes Flight Training Security Program
4. AOPA — Guide to TSA’s Flight Training Security Program Rule
5. DHS — DHS/TSA/PIA-011 Airmen Certificate Vetting Program
6. FAA Aeronautical Information Manual, Ch. 11 Sec. 5 — UAS Pilot Testing and Certification
7. FAA — Become a Certificated Remote Pilot
9. FAA — Remote Identification of Drones
10. FAA — Remote ID for Industry and Standards Bodies
11. FAA — How to Register Your Drone
12. FAA — Notice of Identification for Foreign-Registered Drones
13. FAA — Information for International UAS Operators in the United States
15. FAA Aerospace Forecast FY2026–2046, Emerging Aviation Entrants
16. Federal Register — Counter-UAS Authority for SLTT Law Enforcement (July 6, 2026)
17. Congressional Research Service — IF13279
18. HSToday — New Federal Counter-Drone Rule Gives Local Police Authority
19. DroneLife — FAA Data Shows Drone Sightings Near Airports Nearly Doubled
20. ASIS International — Drone Reports Near US Airports
21. KERA News / AP — Pentagon-FAA dispute over lasers led to El Paso airspace closure
22. Cronkite News — Mexican cartels embrace drones
23. Manufacturing Dive — Trump imposes 100% tariffs on some drones and components
24. sUAS News — How a Foreign Drone Manufacturer Can Sell Drones Into the United States