Officials at the Federal Aviation Administration estimate that up to a million drones will be sold this holiday season , and it's making them very nervous. Let's face it: Some of these drone recipients — possibly even a few Vox readers — are likely to do something stupid with their new toys in the next few months.

In the past, noncommercial drone users have occasionally behaved foolishly and endangered others , but this hasn't been a big deal because there just aren't that many in the skies. If holiday drone sales don't disappoint, that will change.

So the FAA has convened a task force to explore new drone registration requirements that could for the first time implicate hobbyists who were previously exempt from regulation. Ordinary consumers who buy or receive drones might need to fill out DMV-style paperwork to operate within the law.

The task force is moving fast. It was only announced on October 19 and began its work on November 3. Its deadline for recommendations is November 20. Transportation Secretary Anthony Foxx has said that he aims to have the registration requirements in place by "mid-December."

But it'll be a big challenge for the FAA to have this scheme ready to go in time for the holidays. The agency is unlikely to be prepared for the flood of paperwork it would need to process or for the implementation the new IT systems a consumer-facing registry would need. And pushing new regulations out the door so quickly might be illegal. So might openly disregarding Congress’s instructions not to use drone integration as a pretext for expanding regulation of hobbyists.

Creating a decent drone registration scheme won't be easy

The motivation for creating a consumer drone registry is understandable. If somebody crashes a drone onto the interstate and causes a car accident, we need to know who was responsible so he or she can be held liable. Registration helps tie the operator’s identity to the downed drone’s wreckage.

But even a well-implemented registry has limited benefits. In many of the most feared scenarios, like the one in which a drone gets sucked into a jet engine and causes a plane to crash, there may not be much drone wreckage left to help identify the culprit, even if mandatory registration is in place.

There are a lot of open questions about what the drone registration system will look like. For example, we don't know if registration will happen at the point of sale (which could burden retailers) or merely prior to operation (which would make enforcement difficult). We also don't know how the law will handle drones built from kits, or very lightweight drones.

Kids who get Millennium Falcon drones for Christmas may have to wait until they are registered with the FAA to play with them

According to anonymous members of the task force, the recommendation will be for registration to be simple and free, and to apply to drones as small as 250 grams (about half a pound). After registering with the FAA, users would attach a registration number to their drone. "You can put it in indelible ink, you can bedazzle it," says one participant, according to the Wall Street Journal . "It just needs to be legible so (authorities) are able to read it." Users who do not comply could face fines and up to three years in prison.

Unless the FAA decides to exempt small, consumer drones, kids who get Millennium Falcon drones for Christmas may have to wait until they are registered with the FAA to play with them — or face jail time. In addition, aircraft registrations have to be renewed every three years, so families may have extra paperwork to fill out for as long as they own the drone.

The used drone market could also be complicated by the registration policy. What if someone you sell an old drone to on Craigslist never registers it and then crashes it into a crowd of people? Will the FAA come after you or the new owner?

Past experience with national registry systems suggests the policy may include some hiccups. For example, in 1995, Canada created a national gun registry with an estimated cost of CA$119 million. After cost overruns of more than CA$1 billion, the registry was finally scrapped in 2012. Drones have a lot in common with guns — they are small, cheap, and easily transferable. It seems probable that the FAA is underestimating the complexity and cost of keeping millions of drone ownership records up to date.

And it would be a huge challenge for the FAA to modernize its registration infrastructure by Christmas. Right now aircraft registration is still processed using carbon copy forms. This sort of paper processing isn’t going to scale to the hundreds of thousands of drones sold this holiday season. And while an electronic registration system obviously makes sense in the long run, big federal IT systems take a long time to get right.

Can the FAA even regulate model aircraft? It’s complicated.

In 2012, Congress passed the FAA Modernization and Reform Act (FMRA), which required that the agency develop rules for integrating commercial drones into the airspace by September 2015 — a deadline the FAA has now missed.Congress’s demand for rules for commercial drones threatened a small but surprisingly influential group: model aircraft enthusiasts. Modelers fly their small planes away from heavily trafficked airspace according to best practices the community has developed, and the FAA has largely allowed the community to self-regulate.

Because of concern that the new rules would also implicate these hobbyists, Congress included a carve-out in the FMRA for model aircraft. Section 336 of the Act provides that the FAA may not use any law related to drone integration to promulgate new rules for model aircraft, provided that the model aircraft is being flown for hobbyist purposes, weighs less than 55 pounds, and is being operated properly.

Small noncommercial drones fit that description, so the FAA can’t use its mandate or authority to integrate drones into the airspace to impose new regulations on noncommercial drones. However, the FAA can use other authority to do so. The agency has preexisting authority to require any aircraft to register — even paper airplanes — because its authorizing statute imposes a very broad registration requirement .

To date, the agency has exercised its discretion in not requiring model aircraft or ultralight aircraft (e.g., hang gliders) to register. Subject to the ordinary rules of administrative procedure, the agency can change its mind about which kinds of aircraft must be registered at any time. The only thing it can’t do, because of the FMRA, is use any "provision of law relating to the incorporation of unmanned aircraft systems into FAA plans and policies" as justification or means for accomplishing this.

Unbelievably, the rule the FAA issued to announce its drone registration task force falls on the wrong side of this constraint on the agency’s action. While citing its broad authority to require registration of any aircraft they want, it also opens the discussion by invoking its mandate to integrate civilian drones into the airspace under the FMRA. In addition, the point of contact for the registration task force listed in the rule is the agency’s Unmanned Aircraft Systems Integration Office.

The FAA is therefore doing exactly what Congress expressly forbid: using its broader drone integration plans and policies to impose new rules on hobbyists. This opens whatever registration scheme emerges from the task force to a fairly strong challenge in court.

Pushing out regulations by Christmas may be illegal

Noncommercial drones didn’t appear out of thin air . For years, the FAA has been aware of the coming drone revolution; for years, it's done little to support it. It was out of frustration with the FAA’s slow pace on drones that Congress included pro-drone language in the FMRA all the way back in 2012. Now, more than three years later, the FAA suddenly believes it is urgent to act on registration of noncommercial drones.

Federal agencies can’t issue regulations without public scrutiny. Under the Administrative Procedure Act, in order to enact substantive new regulations, they are required to go through a public notice and comment period unless they show good cause to dispense with it.

But if the goal is to have a substantive new rule enacted by mid-December, notice and comment will be impossible. The registration task force will have its recommendations ready by November 20. If the agency takes the time to turn this into a rule, conduct a cost-benefit analysis, publish it in the Federal Register, give the public a minimum of 30 days to comment, digest and respond to the public comments, and issue a final rule, that will easily take it into next year.

The good cause exception to notice and comment carries a heavy burden of proof, and it’s not likely the FAA can meet it in this instance. The agency may try to argue that going through a months-long process to enact registration regulations is contrary to the public interest. But the agency’s perceived deadline pressure is entirely self-imposed. The agency could have begun this process months or years ago instead of in mid-October. In the past, courts have rejected the argument that the urgent need to take action constitutes good cause for dispensing with notice and comment when agencies themselves contributed to that urgency through prolonged inaction.

Eli Dourado is a research fellow at the Mercatus Center at George Mason University and director of its technology policy program.