$500 Million Is Moving for Drone Defense. Read What the Statute Actually Buys.

If your agency has been waiting to send someone to the federal counter-drone schoolhouse before you do anything else, the appropriation that funds this work was written in a way that should change your sequencing.

What Congress actually appropriated

The money comes from Public Law 119-21, section 90005, under the Homeland Security Act grant authority at 6 U.S.C. 605. The operative text:

"(A) $500,000,000 for State and local capabilities to detect, identify, track, or monitor threats from unmanned aircraft systems (as such term is defined in section 44801 of title 49, United States Code), consistent with titles 18 and 49 of the United States Code" [STATUTE-VERBATIM, P.L. 119-21 sec. 90005]

Read the verbs. Detect, identify, track, monitor. The statute does not appropriate this money for disrupting, seizing control of, disabling, damaging, or destroying an aircraft — the five things that make up the mitigation tier under 6 U.S.C. 124n(b)(1)(C), (D) and (F).

That matters because of how the training rule splits certification. Mitigation authority runs through resident instruction at the national schoolhouse — the FBI's National Counter-UAS Training Center, which the interim final rule designates the "sole certifying authority" for it [REG-VERBATIM, 91 FR 41466]. Detection and warning does not: that curriculum "is delivered online at no cost through the NCUTC training portal, and certification issues automatically upon completion" [REG-VERBATIM].

(A note on a number you will see elsewhere: the residential course is widely described as two weeks long. That duration appears in none of the primary sources pinned for this piece — the rule says only "resident instruction" and "resident courses" — so it is not asserted here. An earlier draft of this article stated it as fact; that was an error, corrected before publication.)

And then the awarding department said something else

The statutory text is one document. The Department that administers the money published another, and it does not use the statute's four verbs:

"Recipients can use this money to strengthen their ability to detect, identify, track, or mitigate unmanned aircraft systems, also known as 'drones.'" [VERIFIED, DHS award release, December 30, 2025]

That is a direct conflict on the question a budget officer actually has, and it is not going to be smoothed over here. The appropriation Congress wrote names four detection verbs. The press release announcing the awards names mitigation as an allowable use. Both are quoted above; they were retrieved the same day from government sources; they do not agree.

BOTTOM LINE: the statute's own text funds the detection verbs, and the detection tier is the one with the free online certification rather than the residential queue — but DHS's award release says recipients may also mitigate, so do not treat the narrow reading as settled. CONFIDENCE: MODERATE, downgraded deliberately. The reading of the statutory text alone would be HIGH; the DHS sentence is what makes it MODERATE, and an article that quoted the statute and hid the press release would have earned a confidence level it had not earned.

What to actually do with that: the binding document for your award is the Notice of Funding Opportunity and the terms your State Administrative Agency passes down — not the statute in the abstract and not a press release. Read the allowable-cost language there before you scope a purchase.

The same section carries three other lines worth knowing, since they compete for the same attention: $625,000,000 for 2026 FIFA World Cup security, $1,000,000,000 for the 2028 Olympics, and $450,000,000 for Operation Stonegarden [STATUTE-VERBATIM].

Where the first half went

DHS describes the program as "providing $500 million in federal funding over two years" and the December announcement as "the first $250 million" [VERIFIED, DHS release]. FEMA's program page confirms $250 million available in Fiscal Year 2026, a Notice of Funding Opportunity published October 28, 2025, and awards announced December 30, 2025 [VERIFIED, FEMA program page].

The FY2026 allocations, by risk tier:

| Tier | Recipient | Allocation | |---|---|---| | 1 | California | $34,591,628 | | 1 | Texas | $30,276,431 | | 1 | District of Columbia (for DC, Maryland, and Virginia) | $28,266,328 | | 1 | Florida | $23,636,511 | | 1 | New Jersey | $21,764,005 | | 1 | Georgia | $20,284,936 | | 1 | New York | $17,731,725 | | 1 | Kansas | $5,341,058 | | 2 | Massachusetts | $21,891,527 | | 2 | Washington | $19,504,506 | | 2 | Missouri | $14,240,568 | | 2 | Pennsylvania | $12,470,777 | | | Total | $250,000,000 |

[VERIFIED, FEMA program page, retrieved 2026-08-27. The twelve figures were summed independently and total exactly $250,000,000.]

Twelve recipients. Eight in Tier 1, four in Tier 2. The concentration tracks the 2026 World Cup host geography, which is the honest explanation for why Kansas and Missouri appear on a list that has no other Midwestern entries.

If your state is not on that list, the relevant sentence is the next one in the DHS release: "Next year, the remaining $250 million will be distributed to all U.S. states and territories with an expanded focus on building detection and response capacity nationwide" [VERIFIED, DHS award release]. That is the round to be ready for, and readiness is a policy, an operations plan, and an accredited agency — none of which are quick.

The sequencing this implies

If the money funds detection, and detection certification is free, online, and automatic, then the ordinary constraint on getting started is neither money nor training slots. It is the agency-side work: accreditation, a counsel-reviewed implementation policy, and an operations plan.

There is a further category that sits outside the certification requirement entirely. Systems that intercept no communications — cameras, acoustic sensors, radar operated under FCC authorization — do not require the Act's authority at all, so "detection and warning activity conducted using systems that do not require the authority of 6 U.S.C. 124n is not subject to this requirement" [REG-VERBATIM].

CONFIDENCE: MODERATE on the sequencing advice itself. The reading of the statute and rule is HIGH-confidence, but whether detection-first is right for a specific agency depends on its threat picture, its counsel's read, and its spectrum posture. The Act did not waive the Communications Act; radio-frequency-emitting equipment still needs FCC authorization on a separate track.

What we could not verify, and are not going to assert

Secondary summaries of this program state a 97 percent local pass-through requirement, a no-cost-share term, and a 45-day sub-award deadline. None of those terms appears in the appropriation, the FEMA program page, or the DHS release as retrieved on August 27, 2026. They may be in the Notice of Funding Opportunity itself. Until that document is pulled and checked, treat those figures as unverified — including when you read them here in someone else's summary.

If you are building a budget against this program, read the NOFO your State Administrative Agency is working from rather than any article about it. This one included.

The clock nobody has moved

Two dates worth putting on the wall. The comment period on the training rule closes September 4, 2026, at 11:59 p.m. ET — the electronic docket accepts comments "until 11:59 p.m. Eastern Time on that date" [REG-VERBATIM, 91 FR 41466]. And the authority itself is temporary — the state, local, tribal, and territorial authority terminates December 31, 2031 under 6 U.S.C. 124n(j)(2), while the general federal covered-asset authority terminates earlier, on September 30, 2031, under 124n(j)(1). Those two sunsets are different dates and are routinely conflated.

Roughly five and a half years of authority — but the money has a shorter clock than the authority does. The same appropriation states that the funds are "to remain available until September 30, 2029" [STATUTE-VERBATIM, P.L. 119-21 sec. 90005(a)(1)]. Three years to obligate, against five and a half years of authority. If your program plan assumes the funding line outlives the authority, it has it backwards.

Brian Rutherford is a Marine Corps Reconnaissance veteran and a certified combat marksmanship and foreign weapons instructor, an FAA Part 107 certificated pilot, and a former federal government contracting CEO (2009-2013). He founded DELALLi, which builds readiness training for state, local, tribal, and territorial agencies. DELALLi does not certify anyone under this rule; the FBI's National Counter-UAS Training Center is the sole certifying authority. Every figure above is quoted from a pinned primary source. Bold emphasis inside quoted regulatory text is added for readability unless the source itself emphasises it; the words are unaltered.