Beyond Drones: How a 7,000-Unit Vacuum Hack is Fueling the DJI Ban

The Foundation for Defense of Democracies (FDD), a hawkish national security think tank with a documented history of opposing Chinese technology in U.S. markets, has filed a formal response with the Federal Communications Commission (FCC), urging the agency to reject DJI‘s petition to be removed from the FCC’s Covered List. The filing is detailed, sourced, and blunt: DJI’s petition should be dismissed on its merits. Having followed this regulatory saga since well before the Section 1709 deadline, I can say this document is one of the more thorough public rebuttals to DJI’s legal arguments I’ve read yet.

• The Development: FDD submitted a formal opposition to DJI’s FCC petition for Covered List removal, arguing the company failed to address documented security flaws, PLA ties, and nearly a decade of bipartisan regulatory action.
• The “So What?”: If the FCC accepts FDD’s argument and dismisses DJI’s petition, it closes the most direct administrative path DJI has to restore U.S. market access through the commission itself — with the Ninth Circuit lawsuit and the D.C. Circuit DoD appeal as the remaining active legal fronts.
• The Stakes: DJI claims the FCC ban will cost the company $1.5 billion in lost U.S. sales of communications and video surveillance equipment.
• The Source: The full FDD filing is available here.

FDD’s Core Argument: DJI’s Filing Omits What Matters Most

The FDD filing argues that DJI’s petition to the FCC is built on selective omissions. DJI failed to acknowledge documented cybersecurity vulnerabilities in its products, dismissed national security concerns raised by multiple federal agencies, and incorrectly claimed the FCC’s Covered List designation was both unlawful and based on flawed analysis. According to FDD, none of those claims hold up.

The document traces the regulatory timeline back nearly a decade. In 2017, the U.S. Army banned DJI drones citing “cyber vulnerabilities associated with DJI products.” That same year, China enacted its National Intelligence Law, which requires private Chinese companies to hand over collected data to the government upon request. DJI, as a Chinese-registered firm, is subject to that law. FDD argues this creates an irresolvable jurisdictional problem that no amount of third-party auditing can fix.

DJI has pointed to its 2021 Booz Allen Hamilton security audit as evidence of clean data practices. FDD’s response: other independent auditors have found significant vulnerabilities in DJI controllers and products that those audits didn’t catch. The filing cites one striking case — a user accidentally reverse-engineered a single DJI vacuum cleaner and gained access to live audio and video feeds from 7,000 other units. It’s an unusual data point, and the logical leap from a consumer appliance flaw to drone-based intelligence collection is a long one. But it does show how DJI’s connected product ecosystem can fail in ways that are hard to predict and harder to contain.

Agency After Agency Has Called DJI a Risk

FDD’s filing maps a consistent pattern of federal concern about DJI across four administrations and multiple agencies. The Commerce Department added DJI to its Entity List in 2020 due to ties to human rights abuses. The Department of Justice restricted grant recipients from purchasing DJI products, citing the company’s potential compliance with China’s National Intelligence Law. The Department of Defense listed DJI as a “Chinese military company” in 2022 — a designation that survived a district court legal challenge in September 2025. The FBI and CISA have both warned publicly that Chinese-manufactured drones, including DJI’s, may expose sensitive information to PRC authorities.

Congress acted too. The FY2025 National Defense Authorization Act (NDAA) banned state, local, and tribal governments from using federal funds to buy DJI drones. Section 1709 of that same law directly directed the FCC to add DJI to its Covered List. Florida and Nevada passed complementary state-level legislation blocking local law enforcement purchases of DJI equipment. FDD notes that DJI tried to argue in its petition that Congress hasn’t shown the same sustained interest in restricting DJI as it did with TikTok. The legislative record, FDD says, contradicts that claim directly.

DJI’s Due Process Argument Doesn’t Hold Up, According to FDD

One of DJI’s central legal arguments is that the FCC violated its right to due process. FDD rejects this. Section 1709 of the FY2025 NDAA was a public law, debated publicly, before DJI was ever added to the Covered List. DJI had access to unclassified evidence and was given multiple platforms to rebut the government’s case. FDD’s position: DJI knew this was coming and chose to challenge the outcome of a legitimate process rather than the process itself.

DJI also tried to lean on the Fifth Circuit’s 2021 Huawei precedent, arguing the FCC’s approach to its Covered List designation was procedurally inconsistent with how Huawei was treated. FDD says the comparison doesn’t apply. The Huawei designation ran concurrent with the FCC’s rulemaking. DJI’s designation was driven primarily by a congressional directive in the NDAA — a different legal mechanism entirely.

On the $1.5 billion loss figure: FDD’s filing notes that most of that claimed damage comes from congressional action, not FCC action. DJI is trying to pin losses stemming from legislative restrictions on the FCC’s administrative decision, which FDD argues is a misreading of where the actual legal authority lies. We covered the broader context of what the FCC ban actually covers when it was first announced in December 2025.

Where This Fits in the Larger Legal Fight

This FDD filing is one piece of a much larger legal battle running on three simultaneous fronts. DJI took the FCC to the Ninth Circuit in February 2026 and hired Biden’s former Solicitor General and a former Obama-era FCC enforcement chief to lead that effort. The D.C. Circuit appeal on the DoD “Chinese military company” designation remains active as well. The FCC petition for reconsideration — which this FDD filing directly opposes — is the third track. We analyzed what DJI’s broader legal strategy means for the U.S. drone market in late February.

DJI called concerns about its data security “not grounded in evidence” when it first responded to the FCC action in December 2025. The FDD filing is the government-aligned counter-argument: there is substantial public evidence, it spans nearly a decade, and DJI’s petition ignores most of it. The Avata 360 is likely the last DJI drone U.S. buyers can purchase under the current regulatory structure.

DroneXL’s Take

I’ve been covering DJI’s regulatory situation closely since before Section 1709’s trap-door structure became clear, and the FDD filing does something DJI’s own petition conspicuously avoids: it reads the full record. Not selectively. All of it. And the full record is not favorable to DJI’s position.

That said, reading the full record also means acknowledging what’s missing from the government’s case. No agency has ever publicly demonstrated that DJI products transmitted data to Beijing. The Army ban, the Entity List addition, the DoD military company designation — they’re all based on structural risk assessments, not documented incidents. FDD’s filing is legally sound and well-sourced. But the absence of a confirmed data exfiltration event remains the hole in the government’s argument that DJI keeps pointing to.

Worth noting: the FCC’s Covered List authority under the Secure and Trusted Communications Networks Act doesn’t require a confirmed data transmission to Beijing. It requires a finding of national security risk. DJI is holding the government to a criminal evidentiary standard that the administrative listing process was never designed to meet. That’s a strategic framing choice, not a legal rebuttal.

The vacuum cleaner anecdote is telling in a different way than FDD intends. It shows that DJI’s connected product security can fail badly. It doesn’t show that DJI engineered those failures for Beijing’s benefit. Those are different claims.

Where does this go? The FCC is unlikely to grant DJI’s petition for reconsideration with filings like this in the record. The Ninth Circuit is where the outcome will actually be decided. Federal appellate litigation at this complexity level typically runs 12 to 24 months from filing — expect a ruling in late 2027 at the earliest. Whatever direction it goes, that ruling will reshape how the U.S. government can use administrative listing mechanisms against foreign technology companies going forward. This case has implications well beyond drones.

Editorial Note: AI tools were used to assist with research and archive retrieval for this article. All reporting, analysis, and editorial perspectives are by Haye Kesteloo.