Hydroelectric Security: Why Dams Need Better Monitoring
In 2013, someone got into the control system of a small dam in Rye Brook, New York. Over three weeks, from late August to mid-September, they pulled up data on water levels, temperature and the status of the sluice gate. According to the U.S. Department of Justice, the access would normally have let them operate that gate remotely. It didn't, only because the gate had been manually disconnected for maintenance. Remediation still cost more than $30,000.
That's a small dam and a lucky break. It's also a useful reminder of what hydroelectric security is up against. A dam isn't a single building with a front door. It's a wall, a reservoir, a spillway, a powerhouse, a switchyard, miles of boundary and a control system, often in a remote place. This article explains why these assets are hard to protect, what the oversight picture really looks like, and how autonomous patrols can add physical coverage alongside what operators already do.
Why Hydroelectric Security Is Harder Than It Looks
On paper, a dam is critical infrastructure. On the ground, much of the site behaves like open land.
The footprint is huge. A project can include a dam crest, intake structures, penstocks, a powerhouse, a switchyard, access roads, parking areas and long reservoir shorelines. Fences rarely enclose all of it.
The location is remote. Many sites sit in canyons or rural areas with limited cell service, thin staffing and a long drive for responders.
The assets are varied. An intake gate, a transformer yard and a visitor overlook each have a different risk and a different audience.
The public is often nearby. Recreation areas, boat launches, trails and roads can run close to the works. Most visitors are harmless. Telling the difference takes attention.
The stakes are not just financial. The Congressional Research Service notes that damage or destruction of a dam by a malicious attack could disrupt water resource services, threaten public health and the environment, or cause catastrophic flooding.
Are Dams Really the Least Monitored? What the Numbers Show
We should be careful here. "Least monitored" is a strong claim, and nobody has measured every kind of infrastructure against every other. What the record does show is a real set of gaps.
A lot of dams. The National Inventory of Dams lists more than 92,000 dams. Nearly 17,000 are classified as high-hazard potential, meaning failure could cost lives, according to ASCE.
Mostly not federal. The CRS reports that federal agencies own only about 3% of the dams in the inventory. Most are owned by private entities, other governments and public utilities.
Oversight is split. States regulate roughly 69% of inventory dams. FERC licenses and oversees hydropower dams. CyberScoop reported that roughly 2,500 dams fall under FERC authority, out of 91,827 total.
Oversight capacity has been thin. In April 2024, CyberScoop reported that FERC had only four employees focused on hydroelectric dam cybersecurity oversight, and that most dams under its authority hadn't had a cybersecurity audit. Sen. Ron Wyden said at the time that there were "no minimum standards, no audits of a majority of dams and bad cybersecurity."
Limited state staffing. ASCE says one state dam safety official may be responsible for around 190 dams on average.
Aging assets. The average dam in the inventory is about 65 years old, and the nation's dams earned a D+ on ASCE's 2025 infrastructure report card.
Those figures describe oversight and condition. They don't prove a specific attack is coming. They do explain why operators can't assume someone else is watching.
Things are moving. FERC runs a Security Program for Hydropower Projects with physical security checklists, annual compliance certifications and inspections. In April 2026, FERC staff released a draft revision to its cybersecurity guidance, with comments due in May. The guidance remains non-regulatory, but it can shape how licensees are inspected.
The Physical Threats at a Hydroelectric Site
Cyber risk gets a lot of attention, and rightly so. This article is about the physical side, which is where patrols help. Common concerns include:
Trespass. People entering fenced or restricted areas, such as the powerhouse, switchyard, intake structures or crest.
Vandalism and theft. Metal, tools, vehicles and equipment in remote yards and buildings.
Interference with equipment. Tampering with gates, panels, fencing or other infrastructure.
Unauthorized drones. Flights over restricted works, which can be a nuisance or something worse.
Insider and contractor access. Legitimate credentials used at the wrong time or place.
Gaps in the boundary. Washouts, fallen trees, cut fence or open gates, especially after storms.
Drones are already a recognized concern at dams. The FAA and the Department of the Interior prohibit public drone flights within 1,000 feet of both sides of Folsom and Shasta dams and below 400 feet. Similar restrictions cover Hoover, Glen Canyon and Grand Coulee. Violators can face civil penalties and criminal charges.
What FERC Expects for Physical Security
FERC's program for licensed hydropower projects asks owners to document security with a physical security checklist, a security assessment and plans, plus an Annual Security Compliance Certification due December 31. Its guidance describes protective measures that address "foot, land, and water avenues of approach" to critical assets.
That language matters because it reflects the reality of a dam. Someone can approach on a road, along a shoreline, across a slope or over the water. A single gate camera doesn't see all of those. Operators have to think in terms of the whole property, and then show that they do.
Where Traditional Hydroelectric Security Falls Short
Most operators already have fencing, lighting, cameras, access control and a security or operations team. These are the right basics. But they strain at this scale.
Cameras cover points, not terrain. A camera on the powerhouse doesn't see a shoreline, a back road or a hillside above the switchyard.
Power and connectivity are hard in remote places. Adding fixed sensors across a large site is costly.
Guards are expensive and predictable. Around-the-clock staffing at a remote site is a heavy cost, and routines can be learned.
Alarms don't explain themselves. A fence alarm at 3 a.m. could be wildlife, weather or a person. Someone has to find out.
Conditions drift. Erosion, vegetation, storm damage and damaged barriers can appear between inspections.
Response takes time. Distance from town means more minutes before anyone can verify what's happening.
How Autonomous Patrols Support Hydroelectric Security
Autonomous patrols add mobile coverage across a large, varied site. In a fully managed program like ours, the drone launches, flies and lands on an automated route. AI-assisted detection flags people, vehicles and unusual activity, and trained pilots supervise. For a hydroelectric facility, that can mean:
Coverage of the whole property. Scheduled flights over the crest, spillway, powerhouse, switchyard, access roads and shoreline, including areas fixed cameras don't reach.
Alarm verification. When a sensor trips, a patrol can show what's there, so your team can decide whether to send someone, call law enforcement or stand down.
Remote-site awareness. Patrols can check places that are slow and costly to reach by road, like a far shoreline or a hillside above the transmission corridor.
Boundary and condition checks. Aerial passes can reveal open gates, damaged fence, fallen trees and washouts, especially after storms.
Low-light awareness. Thermal and low-light cameras can help detect people and vehicles at night, depending on the platform we match to your site.
Records. Time-stamped patrol records support incident reports, FERC security documentation, insurance and conversations with law enforcement.
BVLOS (beyond visual line of sight) authorization is what lets a small operations team supervise patrols across large, remote sites. LandSkyAI holds BVLOS authorizations in the United States and has completed more than 100,000 drone patrols. Because many dams sit under restricted airspace, we plan flights with the operator and the relevant authorities rather than around them.
Building a Layered Hydroelectric Security Plan
Patrols work best as one layer. A practical plan looks like this:
Start with your FERC security assessment. Know which assets are critical and what the approaches to them are.
Define and harden the perimeter. Fencing, gates, barriers and signs at the points that matter most, plus clear zones for public access.
Control credentials. Badges, keys and logs for staff, contractors and visitors, with regular reviews.
Add cameras and sensors where they work. Cover powerhouse, switchyard, intake and entry points.
Add aerial patrols and verification. Cover the full property, including the places fixed devices don't reach.
Plan for drones. Know your airspace status, have a reporting process and decide who talks to law enforcement and the FAA.
Write a response plan. Decide who is called, in what order, and what staff should and shouldn't do.
Review after every event and every season. Storms, construction and staffing changes alter the picture.
How Hydroelectric Security Patrols Connect to What You Already Have
You've already invested in a security program. Autonomous patrols are designed to plug into it, not replace it.
Your FERC security program. Patrol records can sit alongside your physical security checklist, assessments and inspections as an added source of documentation.
Fencing and gates. Patrols check their condition across the whole boundary, between your own walk-throughs.
Cameras and sensors. Fixed devices keep covering the entrances and equipment they were placed for. Patrols cover the terrain between and beyond them.
Your control room and operations team. Information goes to the people who already know the facility, and they keep the decisions.
Cybersecurity teams. Physical patrols don't touch your control systems. They complement your cyber program by showing what's happening on the ground around it.
Contractors and maintenance schedules. Patrol schedules can be built around outages, repairs and construction work.
Law enforcement and insurers. Time-stamped records give everyone the same account of what happened and when.
The aim is simple. The layers you already have keep doing their jobs, and patrols connect them into one continuous view of the site.
Why LandSkyAI for Hydroelectric Security
Dam operators have enough to manage with generation, water and regulators. They shouldn't have to build an aviation department too. LandSkyAI runs fully managed autonomous drone and robotic security, so the aircraft, automation, pilots and reporting are handled for you. We're hardware agnostic, so we match the platform to your site, and we'll tell you honestly if a drone isn't the right tool.
Ready to Look at Your Site From Above?
If you own or operate a hydroelectric facility or other water infrastructure, we'd like to walk through it with you. We'll look at your boundary, your remote areas, your regulatory requirements and what you already have in place, then show where patrols would add value and where simpler measures do the job.
Did you find this article useful? Are you interested in seeing us in action?
MissionControl is LandSkyAI’s ongoing town hall style webinar where you can get to know who we are, what we do, and how we’ve built our autonomous security programs. We also conduct a fully live remote drone demo, every time!
Our next event is on Wednesday, October 28th, 2026
Thank you for reading SkyBlog! Found it interesting? Hit that link 🔗 button and send to a friend! If you have questions or want to explore how these solutions apply to your environment, contact the LandSkyAI team below to start a conversation. ✌️
