DJI Makes Final Push for Security Audit Before Automatic Ban Triggers

We’ve been tracking DJI’s fight for a fair security review since Congress passed Section 1709 of the 2025 NDAA last December. Today, with just 13 days remaining until the December 23 deadline, DJI shared with DroneXL what may be its final appeal: two letters sent December 1 to top federal officials, urging them to actually conduct the audit they were mandated to complete.

The letters, signed by Adam Welsh, DJI’s Head of Global Policy, were sent to DHS Secretary Kristi Noem, FBI Director Kash Patel, NSA Acting Director Lt. Gen. William Hartman, ODNI Director Tulsi Gabbard, and Secretary of Defense Pete Hegseth. The message is blunt: the clock is running out, no agency has started the review, and 1,800+ law enforcement drone programs are about to lose access to their most effective tools.

“We are writing to follow up on our letters to you dated March 3, 2025 and June 18, 2025, urging that one of your agencies initiate the security review of DJI Technology products as Congress has mandated,” Welsh wrote. “With less than one month left before the December 23, 2025 deadline, we urge you to take up this audit immediately.”

Nine Months of Silence

This is the third round of letters DJI has sent to federal agencies in 2025. The company first formally requested the security review in March. They followed up in June. Now, in December, the situation has become desperate.

“Our position on this audit has never wavered: we stand ready to work with you, to be open and transparent, and provide you with the necessary information to complete a thorough review,” Welsh stated in the letters. “To date, these offers have gone unanswered, and public reports suggest that this audit has not yet commenced.”

The timeline tells the story of a company begging for scrutiny and a government refusing to engage:

The Human Cost: 1,800 Police Departments at Risk

The letter to Secretary Noem drives home what’s really at stake. More than 80% of the nation’s 1,800+ state and local law enforcement and emergency response agencies that operate drone programs use DJI technology. These aren’t abstract statistics. These are the drones finding missing children, locating suspects, documenting crime scenes, and saving lives.

“These programs will be at immediate risk if they no longer have access to the most cost effective and efficient drone technology available,” Welsh wrote to Secretary Noem.

DJI also referenced the economic impact: $116 billion in economic activity and more than 450,000 American jobs enabled by DJI products, according to a recent economic impact analysis.

A Glimmer of Hope from DHS

The letter to Secretary Noem references a potentially significant development from September. According to DJI, the Department of Homeland Security indicated through written communication its “willingness to work with DJI to ensure the Section 1709 security review is completed consistent with Congressional intent.”

This appears to be the only positive signal DJI has received from any federal agency in nearly a year. Yet even this commitment has not translated into action.

“We appreciate this commitment, and want to reiterate that we stand ready to work with you,” Welsh wrote, before adding the critical caveat: “Time is running out.”

A Mountain of Security Certifications

The letters detail the extensive security validations DJI has already undergone, including audits by Booz Allen Hamilton, FTI Consulting (conducted twice, in 2022 and 2024), Kivu Consulting, and TÜV SÜD. Government assessments include the U.S. Department of Interior and the Idaho National Laboratory (at the direction of DHS).

DJI products have also received security certifications including ISO 27001, ISO 27701, NIST FIPS 140-2 CMVP Level 1, and the American Institute of Certified Public Accountants SOC2 certification. A 2022 audit confirmed DJI products met NIST IR 8259 and ETSI EN 303645 standards for network security and privacy protection.

The technical protections are equally robust. DJI drones use AES-256-XTS encryption, the longest encryption key length established by NIST. U.S. users cannot sync flight logs to DJI servers at all. No images or videos are synced unless a user proactively chooses to do so. Users can fly offline or in “Local Data Mode,” which severs the internet connection entirely.

“If a security review is carried out, we are confident that DJI products will withstand your scrutiny,” Welsh stated.

What Happens on December 23?

If no agency completes the security review by December 23, Section 1709 triggers an automatic consequence: DJI products will be added to the FCC’s Covered List. This would block new DJI drones from entering the U.S. market, prevent new FCC authorizations, and potentially trigger retroactive enforcement actions against products approved after December 23, 2024.

“Doing so would lead to widespread consumer confusion and deprive American drone users of due process, and of answers about the safety and security of the DJI products they use every day,” Welsh wrote. “Failing to undertake the review further goes against Congressional intent for a security review to be completed.”

As we’ve reported previously, this creates a bureaucratic trap. Congress mandated a determination but didn’t assign which agency should conduct the review. The result is that DJI faces a ban not because of any security finding, but because no one in Washington will pick up the phone.

DroneXL’s Take

I’ve been covering this story for over a year now. What strikes me most about these letters isn’t DJI’s defense of its security practices. It’s the company’s evident frustration at being denied the very scrutiny its critics demand.

Think about that for a moment. DJI isn’t fighting the audit. DJI is fighting for the audit. The company has spent nearly $3 million on lobbying this year, not to avoid review but to make it happen. Adam Welsh spent weeks in Washington trying to get meetings with lawmakers. Most refused to even sit down with him.

This is not how security policy should work. If DJI drones genuinely pose a national security threat, then conduct the review and prove it. If they don’t, then stop punishing American businesses, first responders, and farmers for using the best technology available.

The GOP is split on this issue, with senators from agricultural and energy states pushing back against China hawks. The Commerce Department reportedly didn’t oppose an audit provision but saw sponsors walk away from negotiations. Meanwhile, Florida’s disastrous drone ban already showed what happens when security theater replaces evidence-based policy.

With 13 days left, a proper security audit is mathematically impossible. The only remaining question is whether anyone in Washington will grant an extension, or whether DJI will be banned through administrative neglect rather than any actual security finding.

The American people, as Welsh’s letter states, deserve no less than answers. Right now, they’re getting silence.

What do you think about DJI’s efforts to engage the government? Should agencies grant an extension to complete a proper security review? Share your thoughts in the comments below.