A drone-in-a-box gives an onshore wind farm a patrol and alarm-check tool that covers the whole site without staff on site. The drone flies set routes past turbine doors, cable trenches and the substation. It takes off when an intrusion alarm goes off, so an operator can see what triggered it within minutes. Each turbine has a geofenced no-fly zone around its rotor.
- Copper cable theft from turbine towers has been reported in France, Germany and the UK, often by organised groups.
- Wind farms are large, remote and lightly lit, so fixed cameras and mobile guards cover only part of the site.
- Drone patrols can follow tracks and tower bases while geofences keep the drone out of the rotor area.
- An offline-first edge node keeps patrols working where mobile coverage is poor.
- Nestua's software runs in development builds. The drone and base station are still being built.
What security problems do wind farms in Europe face?
The main threat is theft of copper cable from inside turbine towers. As early as 2014, France 24 reported that a network of metal thieves had targeted around 20 French wind turbines. They forced the tower doors, climbed to the nacelle and stripped up to a tonne of metal from a single turbine. In Germany, the Lower Saxony state criminal police office (LKA Niedersachsen) recorded dozens of copper thefts and attempted thefts at wind turbines in 2024, according to a March 2025 report. Investigators described organised groups of up to eight people using climbing gear.
A turbine with its cabling cut stays out of service until repaired, so the cost goes well beyond the scrap value. Electricity producers may also fall under NIS2 and the CER Directive, which expects critical entities to consider measures such as perimeter monitoring and detection equipment (see regulation).
Why do static cameras and guard patrols leave gaps?
- Distance. Turbines stand hundreds of metres apart. Covering every tower door and cable route with fixed cameras needs many masts, each with power and backhaul.
- Response time. A mobile patrol that visits a remote site a few times a night leaves long periods with nobody watching. When an alarm goes off, the drive out may take longer than the theft does.
- Unverified alarms. Door contacts and SCADA alarms say that something happened, not who is there.
How would a drone-in-a-box patrol a wind farm?
One drone-in-a-box unit consists of the drone, a weatherproof base station and an edge node that controls that one drone. A large farm could use several units. In Nestua's design:
- Scheduled patrols. In the browser-based mission editor, operators draw routes and waypoints on a satellite map: along access tracks, past each tower door and over the substation compound. Missions are uploaded, started and stopped from the browser, and each of those actions is audited.
- Rotor no-fly zones. Each turbine gets a circle geofence, and polygon geofences mark other areas to avoid, such as neighbouring land or a road. A geofence breach either blocks the command or triggers return-to-launch, depending on policy. The live map shows the drone's position, heading and trail with the geofences overlaid.
- Alarm-triggered checks. When a door or perimeter alarm fires, an operator sends the drone to that turbine with a go-to command. A command only counts as successful once the drone's MAVLink acknowledgement comes back, and critical commands need typed confirmation.
- Person and vehicle detection. A YOLO model runs on the NPU of the edge computer and flags people and vehicles. AI rules turn a detection into an action: notify, record, hover over the scene or return to launch. Every action stays within the safety policy and geofences, and every action is logged.
- Verification in the browser. The operator watches low-latency WebRTC video, with HLS as a fallback. Recording runs locally into a ring buffer, and clips can be exported for the police or insurers.
- Weather and health. A weather monitoring service and a system health page help the operator decide whether a flight is sensible. The base station is designed to be IP65-rated, with robotic battery swap for continuous patrols.
Why does offline-first matter on a wind farm?
Many onshore wind farms sit on ridges, moors and farmland where LTE coverage is weak. A cloud-dependent drone stops when the link drops, which can be exactly when it is needed. In an offline-first design, everything needed to fly, watch and log runs on the edge node at the site. The optional cloud adds remote monitoring and command dispatch over a WireGuard tunnel. Remote access is off by default, enabling remote control requires admin re-authentication, and remote commands can be set to need local approval. Video, telemetry and control travel over Nestua's own encrypted radio link, which uses per-packet authenticated encryption and hard mutual pairing.
Regulatory and privacy notes
- Drone rules. Automated patrols from a box, without a pilot watching the drone, are normally beyond visual line of sight (BVLOS). That generally means the "specific" category under Regulation (EU) 2019/947 and an operational authorisation from the national aviation authority. Member States may also define UAS geographical zones under Article 15 that restrict flights. See our EU drone regulations guide.
- NIS2 and CER. Electricity producers appear in Annex I of NIS2 and in the Annex of the CER Directive. Whether a given wind farm operator is in scope depends on its size and national transposition. Under CER, Member States had until 17 July 2026 to identify critical entities.
- Privacy. Patrol routes near public roads, footpaths or homes can capture people. GDPR applies, and the EDPB Guidelines 3/2019 on video devices are the reference point. Keep routes and camera angles inside the site, set retention periods and consider a DPIA.
This page is general information, not legal advice.
What to evaluate for a wind farm
- How large is the rotor no-fly zone, and is it enforced by block or by return-to-launch?
- Is the flight time and range enough to reach the furthest turbine and come back? Ask vendors for tested figures.
- What are the wind, rain and temperature limits of the drone and base station, compared with your site's weather records?
- Does the camera perform well enough at night to verify a person at a tower door?
- Does the system keep working with no internet, and who can enable remote control?
- Can alarms from door contacts or SCADA trigger a verification flight, and is every action logged and exportable?
- Which authorisation route (STS, PDRA or SORA) suits the site, and who holds it?
Sources
- France 24, "Metal thieves pillage French wind turbines" (28 May 2014): france24.com
- t-online, "LKA Niedersachsen: Banden stehlen tonnenweise Kupfer aus Windkraftanlagen" (updated 4 March 2025): t-online.de
- Directive (EU) 2022/2555 (NIS2), Annex I: eur-lex.europa.eu/eli/dir/2022/2555/oj
- Directive (EU) 2022/2557 (CER), Articles 6 and 13 and Annex: eur-lex.europa.eu/eli/dir/2022/2557/oj
- Commission Implementing Regulation (EU) 2019/947, Article 15: eur-lex.europa.eu/eli/reg_impl/2019/947/oj
- EDPB Guidelines 3/2019 on processing of personal data through video devices: edpb.europa.eu