Ukraine's Audacious Drone Attack: Some Thoughts

Ukraine took out a bunch of Russian nuclear-capable strategic bomber aircraft last weekend, and they did it with small, cheap drones. As well as with over a year of intricate and incredibly stealthy planning, which is, if you ask me, the really important part.

Keeping in mind that information on this attack is still coming out, here's my thoughts on Ukraine's June 1st attack.

This is really a story about strategic and tactical brilliance, not about drones. Your key takeaway from Ukraine's audacious June 1st attack shouldn't be “wow, small drones make it so easy to score huge hits."

It should be “wow, Ukrainians are insanely good at covertly planning and executing extraordinarily difficult missions of which drones are one part."

Absolutely nothing about this mission was easy or low-effort.

This attack took 18 months of immaculate strategic planning, incredible operational security, and highly disciplined patience. Doing something like this is vastly more difficult than "going out and buying a bunch of drones and a truck."

This attack is a perfect example of a key reality, which applies to both military operations and to the civilian world: splashy new uses for modern technology get splashy headlines, and those surface-level accounts of such use cases give the average person a very simplified and inaccurate idea of how capable new technologies are on their own. The truth is that attacks like this pretty much never happen without a bunch of not-particularly photogenic and utterly crucial logistical planning and strategy.

Another way to say this is “the cult of the operator would, in a just and rational world, be replaced by the cult of the logistics guy”

Ukraine's June 1st drone attack does not mean we're going to see an inevitable surge of terrorist attacks using similar tactics. I said it once, and I'll say it again: the patient, strategically brilliant planning that was required for Ukraine to pull this attack off is not something your average idiot terrorist or lone wolf kook is going to be able to at all easily replicate, much less outside of a war zone where it’s way harder to get explosives.

While I'm sure various bad actors absolutely are going to be looking at this attack with great interest, I don't think there's anything here that really represents a game-changer for any organization or individual who lacks the resources, expertise, or patience of the Ukrainian state.

And while this Ukraine attack demonstrates many interesting things, it does not, in my opinion, demonstrate a radical lowering of the bar of competency required to pull off a massive, coordinated, clandestine attack using small explosives-laden drones.

Yes, we should be worried about sophisticated and highly-organized nation-state level adversaries pulling an attack like this off at some point in the future, but personally, I'm not going to be losing a ton of sleep over adversaries below that level being able to do the same thing.

I'll put it this way: it's really interesting that we still haven't seen a major terrorist attack using small drones outside of the context of hot wars or serious civil conflict. I'm not totally sure why this is the case, and I'd certainly never claim that it'll never happen. I assume it will eventually. We should be working hard to anticipate that it will, and technologically hardening ourselves against such an attack.

But the fact that we're in the middle of 2025, almost 15 years into the modern consumer drone technological revolution, and we still haven't seen anyone successfully execute a major terrorist attack using small drones?

I think that's an indicator that doing terrorist attacks with drones outside of active conflict settings still just isn't that desirable or easy to pull off, for whatever reason. And I think we should be paying close attention to those reasons, and adjusting how we think about threats from small drones accordingly.

While I suspect there are a bunch of interlocking reasons why we still haven't seen terror attacks outside of active conflict with small drones, here's one big one: it's really hard to get light-weight explosives that can be carried on a drone outside of active war zones in most countries.

We should work to keep it that way.

And here's another big reason, at least if you're in the US: why bother with drones to commit a terror attack, which requires technical expertise and exposes you to risk of being caught (as we do have remote ID and other counter-drone systems, imperfect as they can be), when you could just use a gun?

Ukraine's June 1st drone attack does not represent a sudden and unexpected technological leap forward. All the drone and communications technology Ukraine used here has been around for a while, although they of course used it very ingeniously.

Consider this: Ardupilot, the open-source flight planning software that Ukraine appears to have used to control the drones remotely (likely via a cellular data link), was first introduced way back in 2009. I remember using ArduPilot Mission Planner way back in 2013, when I was tinkering with DIY drone projects with Stanford's drone club.

Here's an excellent Bluesky thread from John Wiseman that goes into more detail on what Ardupilot is, how it works, and how Ukraine exploited ArduPilot Mission Planner in this attack.

It appears that Ukraine piloted the drones with Ardupilot by taking advantage of Russian cellular data networks. This is a clever, if daring move, because it means that the drones won't be susceptible to usual anti-drone electronic warfare technologies (which are geared towards hunting drones that communicate with their operator via radio frequency links). And again, there's nothing new about this: cellular-data controlled drones have been around for a really long time.

There's also a downside to controlling drones with cellular data, which is why most drones on the market today, and most drones that you see in Ukraine, still rely on good old-fashioned radio frequency datalinks: that's because communicating with a drone via cellular data introduces latency into the connection, sometimes to a considerable extent. During many tactical operations with drones, the pilot needs to be able to react with lightning speed, which means that datalink latency is a real problem. It's unclear how the Ukrainians compensated for this.

I can speculate that in this case, the latency may not have been a huge deal, because the Ukrainians predicted - quite accurately - that the Russians largely wouldn't be able to intercept their drones until it was too late. And indeed, there are a few rumors spreading around on Telegram claiming that some of the Ukrainian drones were taken out by Russian locals with hunting rifles

As it's really hard to hit a very small drone with a hunting rifle under normal conditions, perhaps these gun-wielding locals were able to hit them partially due to latency issues (or because they were still being controlled by an automated ArduPilot mission, and not by a human able to take evasive maneuvers). But that's still just idle speculation on my part.

What about the drones themselves? A few Ukrainian sources are claiming that the drones used in the attack were "Osa" models produced by First Contact, a Ukrainian company that produces solidly-built, closed-frame drones intended for kamikaze/suicide operations - rugged enough to make it to their destination via covert means.

While I'll issue again the major caveat that information is still coming out about these attacks, the Osa does seem to resemble the black drones stacked in a truck that are visible in the image above, which I've seen circulating around on Telegram since Sunday.

First Contact's Osa drones are capable of carrying up to 3.3 kilograms of payload weight and with a 15 minute flight time at a maximum speed of 150 km/hour, which gives you a sense of the mission parameters that Ukraine had to work with here (and explains why the trucks did have to be relatively close to the airfield target). To return to my original point: these are pretty standard, normal specs for the kamikaze drones that both Ukraine and Russia have used extensively on the battlefield since early 2022.

Far as I can tell, Ukraine didn't roll out any totally new or previously unknown technology for this attack. Instead, they brilliantly took advantage of stuff that already exists, in a way that plays to their well-demonstrated organizational, technical, and intelligence-based strengths.

Ukraine's attack was not reliant upon cutting edge "AI." As I said above, it appears that Ukraine piloted their drones via Ardupilot and cellular data.

I've seen some speculation that the Ukrainians may have used Mission Planner to automate the first part of the flight - IE, out of the trucks and toward the airfield - and then, for the second part of the flight, switched control of each drone over to an individual human pilot who could more precisely steer them into their final targets. While I'm still unable to confirm if this is the case or not, it does seem like a very plausible approach to me.

The main point here is that this apparently was done using drone mission planning software -IE, that allows drones to follow pre-programmed waypoints - that was first released back in 2009, in conjunction with clever use of cellular data networks.

In other words, don't buy into the usual AI-related hype that unfortunately and inevitably crops up around any drone-related topic nowadays. The reality of what actually happened is plenty interesting enough.

On a related note, remember that story that was going around last week, originated by the Economist, about how Russia was supposedly piloting Shahed drones by means of AI and Telegram messages? Some Ukrainian technical specialists looked into this and concluded that this claim was pretty much entirely misconstrued bullshit.

Sadly, prestige journalism far too often prints misconstrued bullshit when it comes to small drones. But that's a screed for another time.

Drone attacks like this are vital tools for psychological warfare as much as for kinetic warfare, such as by means of "causing really annoying traffic jams as newly-paranoid Russians inspect every single truck on the road." I've written before about how drones capacity to freak people out is often just as effective as their actual kinetic and intelligence-carrying capabilities are. Ukraine's drone attack on Russia was embarrassing, destabilizing, and will also lead to a lot of extremely annoying, quotidian inconveniences in the form of snarled-up traffic for the Russian public. Russian authorities will be seeing Ukrainian drones behind every corner and out every window now.

This, too, is tactical brilliance.