One year ago, officials at the Federal Aviation Administration rang in the holidays as only bureaucrats can: writing new regulations forcing drone owners to register themselves with the federal government before their first flight.

And because nothing says “Christmas” quite like criminal fines and jail time, the agency promised $277,500 in civil and criminal penalties and three years’ imprisonment to any overeager youngster who rushed out to play without first thinking about the wishes of a distant bureaucracy.

The FAA’s recreational registry was, and remains, one of the most egregious acts of regulatory overcriminalization in recent memory. Even the agency’s own registration task force reported that the criminal penalties drone owners would face were disproportionate in the hobby drone context. Nevertheless, the FAA charged ahead, releasing its interim final rule to the public just three weeks after the task force report, and a scant seven days before going into effect.

Before it could regulate, though, the agency first had to get around the Congress. In 2012, legislators passed the FAA Modernization and Reform Act, plainly stating that the FAA “may not promulgate any rule or regulation regarding model aircraft” flown for recreational purposes.

The agency responded that the registry is not really a regulation, and that drones are not really model aircraft; they are “aircraft” for the purposes of federal law, so the agency always had the authority to require registration. Never mind that this claim contradicted all prior agency guidance on drone regulation.

Once it twisted itself in a knot to get around Congress’ prohibitions, the FAA then had to figure a means to bypass the public notice and comment process mandated by the Administrative Procedure Act, as well.

That standard rulemaking process can take months or years. It is designed to give the public a chance to review proposed rules and to ensure that administrative agencies are responsive to public concerns. Notice and comment brings at least a modicum of accountability and transparency to the regulatory process.

It also serves to ensure that citizens are not caught unaware by new rules that are promulgated suddenly and without warning—an especially grave concern when, as with the drone owners’ registry, they contain criminal penalties.

But the FAA got around these restrictions by using the narrow “good cause” exemption. If agencies can show that the normal process is “impracticable, unnecessary, or contrary to the public interest,” it can skip public participation and issue a final rule.

In this case, the FAA claimed America’s skies were about to be overrun by hoards of drones that, like a modern take on a Hitchcock classic, would wreak havoc and endanger the national airspace. Because of this exigent threat, officials claimed, public safety demanded swift regulatory action.

There were some flaws to this line of reasoning. First, the FAA could not, and still cannot, point to a single collision between a drone and a civilian airliner.

Officials frequently cite figures that they claim demonstrate a rising incidence of near-collisions, but analysis has concluded that in only a tiny fraction of these purported instances did the pilot feel the need to take evasive action. In fact, in many cases, the object originally identified as a drone turned out to be something else altogether.

The FAA’s exigency argument fails because the skyrocketing popularity of drones was hardly surprising. Congress legislated on the subject three years before the FAA announced its registry. It seems reasonable enough that an agency specializing in aviation safety should have been able to anticipate the issue. Somehow, the “failure justifies fiat” argument worked—subject to a lawsuit pending in the D.C. Circuit Court of Appeals, over whether the drone registration is illegal.

Finally, despite claiming that exigent threats to the national airspace required prompt action, the registry does nothing to deter or prevent bad actors from using drones to commit crimes or acts of terror, similar to how gun rights restrictions generally haven’t stopped bad actors from committing gun violence. Drone owners are not registered automatically at the point of sale, but instead are supposed to register at home before sending their drones on their first flight.

Someone buying a drone to use it for illicit purposes can also easily evade the registry requirement with little risk of penalty after the fact, because if the drone is crashed into an aircraft, explodes, burns, or otherwise evades capture, tracing the unmarked drone back to its owner will be virtually impossible.

Even for those who do comply, FAA-assigned unique personal ID numbers can be placed inside the drone, making remote identification impossible. Ultimately, the drone would have to crash, largely intact and in an area where it could not be retrieved by its owner, for the registry to be useful in tracking down responsible parties.

Certainly, for those who already want to fly responsibly, a registry may be a means of discouraging reckless conduct and reinforcing safety. But for those who want to use drones for ill purposes, the deterrent value is nil.

Fortunately, the FAA’s lawless actions have not escaped notice and scrutiny. Aside from the legal challenge to the registry requirement, the House Freedom Caucus recently identified the recreational rule as one of over 200 Obama-era regulations that should be repealed when the incoming Trump administration takes office in January.

Concerns about safety, whether to aircraft in the national airspace or to people and property on the ground, are not invalid, and should not to be taken lightly. Fortunately, a wide array of technology-agnostic criminal, tort, and property laws exist that address many of the harms and risks of drones. For example, it is already a federal crime to damage, destroy, or interfere with an aircraft.

The FAA should reconsider how it might work with partners in critical military and civil infrastructure, long-standing and self-regulating hobbyist communities, and technology groups to fashion sensible rules to address drone-specific harms or drone-related conduct that existing laws and regulations do not reach.

And of course, any restrictions on recreational drone activities must be authorized by Congress.

A year ago, the FAA began the process of overcriminalizing and over-regulating drones—a process that continues beyond just the recreational registry. Its redefinition of the term “aircraft” has exposed children to 20-year prison sentences for crashing toys. Its burdensome and restrictive commercial drone regulations have driven innovation and development abroad.

Clearly, the FAA won’t be stopping itself anytime soon. It’s time to rein them in.