‘Counter-drone’ company Department 13 attacks DJI’s Aeroscope solution

Last Thursday, ‘counter-drone’ company Department 13 published the white paper: “Anatomy of DJI’s Drone Identification Implementation” seemingly attacking DJI’s Aeroscope, a drone ‘license plate’ solution, that was introduced to the US market in Washington D.C. in October. In the document, Department 13, a company that sells expensive ‘counter-drone’ solutions and whose share price has dropped by 20% since the launch of Aeroscope, argues that there are many weak spots in DJI’s Aeroscope solution. Today, it was DJI’s turn to respond and they did so by issuing this statement: “Understanding DJI’s AeroScope Solution“.

We went through both Department 13’s white paper as well as DJI’s public response to provide you with a summary of what’s going on here.

What is wrong with DJI’s Aeroscope?

Well, according to Department 13, there are a number of things wrong with Aeroscope.

1) Security concerns. First, drone ID data gathered today may be exploited in the future and secondly, there is the potential for drone ID system hacking. Department 13 advises DJI to:

“to put the Drone ID technology implementation up for examination via a public review Request for Comments (RFC). The fact that DJI has not put out an RFC, a common practice, may draw criticism from the security community as DJI pushes forward to have their work become the Remote Drone ID standard.”

2) Lack of community involvement. Department 13 claims that DJI is ‘playing God’ with data from the community and that DJI disregards any outcomes for the community. According to the ‘counter-drone’ company, the community should assemble a watchdog group to push back and assert transparency.

3) Aeroscope is vulnerable to hacking. Department 13 claims that DJI’s Aeroscope is susceptible to hacking and has tried to demonstrate this with the help of a DJI reverse engineering group. According to the company, this is significant because it showcases how the system can be compromised and opens the possibility of malicious use.

4) Privacy concerns and comparing Aeroscope to automobile license plates. DJI’s comparison of Drone ID technology to automobile license plates is alarming according to Department 13, given the existing privacy controversy surrounding Automated License Plate Reader (ALPR). Secondly, fundamental differences between the ALPR and Aeroscope make this a flawed comparison. For instance, Aeroscope would work through walls whereas ALPR does not, i.e. it could not detect a license plate on a car parked in a garage.

5) Spoofing. Drone ID packets can be received by anyone, but they can also be transmitted by anyone, making the system vulnerable to spoofing. Unlike ADS-B, it is legal for anyone to transmit Wi-Fi packets that contain Drone ID information. According to Department 13 the difficulty for anyone to do so is low due to the Wi-Fi technology used as the foundation of Aeroscope.

Department 13 concludes that:

In conclusion, it is clear that marketing for various future Drone ID-based solutions will mandate a close inspection by qualified subject matter experts before the technology is adopted. In this case, it has been proven that various security attestations may be viewed in a different light when examined by security experts. It is simply not enough to take the word of a company spokesperson, without also examining the practices that have been implemented by the company’s engineering team. Both security and privacy hinge on the minute details of each implementation.

DJI defends Aeroscope in public statement

Today, Chinese drone manufacturer DJI issued a public statement: “Understanding DJI’s AeroScope Solution”, defending its Aeroscope solution as it wishes to correct the inaccurate or misleading claims being spread by Department 13.

1) Consider the source

First of all, DJI points out that Department 13 sells a $340,000 drone detection system with a $44,000 annual maintenance fee and that they are likely concerned about the competition that Aeroscope poses to their business. This seems a legitimate concern as Department 13’s share price has dropped about 20% since Aeroscope was announced.

2) Privacy rights of drone pilot

Governments around the world have expressed their intentions to have drones transmit some form of identification and telemetry information. DJI is a proponent of having a public debate about this to balance the authorities’ concerns and the privacy of drone pilots. DJI has been the only drone company to date to express concerns about the privacy rights of drone operators. Department 13 critiques DJI but offers no alternative solution.

3) Spoofing concerns

First, a drone registration system presumes that most people will comply. It will not stop “bad-actors” from circumnavigating the system. Second, to “jailbreak” a drone is something most drone owners will not do. Third, once a Remote ID is a legal mandate there will be a way for authorities to verify the information being transmitted between the drone and its pilot. Currently, there are no legal requirements defined.

4) The ability to turn off parts of the remote ID information

In the current version of Aeroscope certain information can be turned on or off by the user. This is by design. Once the government implements a remote identification requirement, some of their user options will be removed so that required information will always be transmitted.

DJI’s conclusion

Department 13’s white paper does not discuss other remote identification solutions nor provide insightful recommendations. DJI understands and expects that being first to market with a comprehensive and effective remote identification technology will subject AeroScope to scrutiny. A useful evaluation of remote identification technologies would also examine alternative methods, which from our perspective are more invasive, more burdensome, more costly, and potentially less secure than AeroScope.

DJI intends for other companies to build receivers that can detect and identify DJI drones as well as drones from other manufacturers, so that the solution to drone ID policy challenges can be accessible and affordable to the authorities who require it. Our goal is very clear: We are seeking to solve a problem and enable drones to become more accepted by society to enable amazing applications, not to make a huge profit from the concerns raised by a small number of unauthorized drones in sensitive locations.

DroneDJ’s take

It is understandable that ‘counter-drone’ companies, such as Department 13, feel that their business is threatened by the launch of a drone tracking and identification solution such as Aeroscope. Especially when it is launched by the largest drone manufacturer, DJI. However, some of the arguments in Department 13’s white paper seem a bit far-fetched and create the feeling that they are trying to make Aeroscope look bad.

DJI has made clear that their system is preliminary and awaiting final legislation, as such it is not a final version and will be subject to change. Is Aeroscope perfect? Probably not, or at least not yet. However, currently, DJI is the only drone company that has come up with a working solution, and one that tries to balance the privacy of drone pilots and the security concerns of governments. Furthermore, Aeroscope is not meant to be a profit center for DJI and the platform is open to other drone manufacturers as well.

We think that Aeroscope is a step in the right direction and we applaud DJI for launching it as a non-profit driven, open platform that aims to resolve the security concerns of governments and take into account privacy concerns of drone pilots.

What do you think about Aeroscope? Do you think it goes too far or not far enough? Let us know in the comments below.