FBI, DHS–both DJI users–urge avoiding Chinese drones as risks

The walls appear to be steadily closing in on DJI in the US – and perhaps, users of its drones as well – following official warnings issued by the Federal Bureau of Investigation (FBI) and the Department of Homeland Security’s Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency over alleged security threats China-produced drones pose to operators.

The advisory Wednesday came less than a month after the  American Security Drone Act of 2023 was signed into law as a component of the National Defense Authorization Act of 2023. As DroneDJ has reported in the past, measures within the former prohibit procurement or use of drones made in China by US federal agencies, or third parties they provide funding to. Those restrictions were based on claims by political and industry backers that UAVs like those made by DJI and Autel leak data collected back to the Chinese government for potentially nefarious purposes. 

Thus far, supporters of the broadening blacklisting effort have failed to provide objective evidence to substantiate what should be – and are – very troubling accusations that detailed data on US public and private infrastructure is being supplied to Beijing from the craft. Both Autel and DJI have denied those and other claims against them.

In their notice Wednesday the FBI and CISA largely repeated those allegations. They also warned public administrations, law enforcement, and even private company users of the craft in the US to change to drones considered secure – a clear inference of American origin. 

Indeed, in its “Mitigation” advice section, the communiqué suggests operators “consult the Department of Defense’s Blue UAS Cleared List to identify UAS compliant with federal cybersecurity policies.” 

That list is comprised almost exclusively of US-made craft. Those are generally considered more expensive and less effective than DJI and Autel alternatives – a major reason why enterprise and consumer pilots have made them dominant in the American and global markets.

Ironically, under questioning in Congress last year, officials of both the FBI and Department of Homeland Security acknowledged the agencies continue using DJI drones as virtually irreplaceable assets in their work critical to protecting public security. 

As in the blacklisting initiatives that have banned their operation in official work, DJI and Autel risk becoming major collateral victims in the intensifying diplomatic fight between the US and the People’s Republic of China (PRC). 

Though not mentioned by name, they are alluded to in discussing a “2017 National Intelligence Law, (which) compels Chinese companies to cooperate with state intelligence services, including providing access to data collected within China and around the world.”

That’s a part, it continued, of a wider program by Beijing to compel Chinese businesses to do its spy bidding. 

“The 2021 Data Security Law expands the PRC’s access to and control of companies and data within China and imposes strict penalties on China-based businesses for non-compliance,” the notice says. “The data collected by such companies is essential to the PRC’s Military-Civil Fusion strategy, which seeks to gain a strategic advantage over the United States by facilitating access to advanced technologies and expertise… The PRC’s collection of sensitive information and potential network access obtained from Chinese-manufactured UAS may result in significant consequences to critical infrastructure security and resilience.”

As a result, the document says, both public and private drone users are advised to stop deploying craft made in China – a grounding of what some estimates put at of 70% of all UAVs currently in operation that are made by DJI – and buy alternatives considered secure. Failing that, it offers some advice about deploying, maintaining, and updating firmware to limit the margin for third party data piracy of the craft.

While the FBI and CISA warning and recommendations are not binding, they do come at a time when rising blacklist movements – often also motivated by protectionist economic and political objectives – are removing DJI and Autel from official US operation. 

A bill introduced in Congress last year seeks to go beyond just that. It looks to create a de facto ban on private company and individual DJI and Autel operator use by calling for ubiquitous Federal Communication Commission transmission assets necessary for piloting the craft to be prohibited to China-made drones.