DJI Ban Debate Forces Police and Fire Agencies to Build Drone Programs That Can Survive Washington

A detailed governance framework published by Police1 makes the case that the central challenge for U.S. public safety agencies is no longer whether DJI belongs on a federal watchlist — it’s whether agencies have built drone programs capable of surviving a policy shock without losing operational capability. The analysis, authored for Police1 by Dr. Lestrange, arrives as the FCC’s December 2025 Covered List action — which added foreign-produced unmanned aircraft systems on a forward-looking basis — has left roughly 25,000 DJI drones already flying in U.S. public safety fleets in a state of regulatory limbo. Those drones are not retroactively grounded, but every procurement decision from here forward is more complicated.

The FCC Decision Left Existing Fleets Flying But Changed Long-Term Planning

The FCC’s late December 2025 Covered List update went further than DJI alone, targeting foreign-produced UAS and foreign-produced critical UAS components on a forward-looking basis. Existing aircraft already authorized and in use are not subject to retroactive grounding, as DRONERESPONDERS confirmed shortly after the decision — a finding also cited in the Police1 framework. But that legal safe harbor doesn’t resolve what happens next. Batteries degrade. Parts wear out. Replacement cycles arrive whether agencies are ready or not. As DroneXL reported when the FCC carved out Blue UAS exemptions in January 2026, the ban was always going to force a procurement reckoning — the question is how quickly, and how expensively.

Oregon put actual numbers to that reckoning. A white paper compiled through the National Association of State Aviation Officials found 25 states reporting 467 restricted drones and up to $2 billion in national exposure. That figure reflects replacement hardware, retraining costs, payload integration, and updated procedures. It’s not an abstract policy figure. It’s what happens when an agency buys new aircraft and discovers the fleet swap is a multi-year operational rebuild.

Drones Are Flying Computers, Not Just Aircraft

The Police1 framework argues that most agencies originally treated drones as equipment — another line item alongside thermal cameras and patrol vehicles. That framing was always wrong. UAS platforms contain radios, software, data pathways, onboard storage, and update mechanisms. CISA has described UAS explicitly as ICT devices where every connection point can represent a potential cyber target. The agency also notes that best practices reduce risk but cannot eliminate it entirely.

DJI enterprise platforms do include practical mitigations. Local Data Mode, documented in DJI enterprise documentation, disables network requests and prevents synchronization with external servers when active. DJI’s Trust Center cites independent audit findings that data was not transmitted externally during sessions with that mode enabled. DroneSense, widely deployed in Drone as First Responder programs, publishes configuration instructions for DJI enterprise controllers that prevent DJI Pilot 2 from launching automatically, allowing alternative software to run instead. None of these measures replace internal governance, but they give agencies auditable controls they can document today.

The Lenovo Parallel Shows Tiered Controls Beat Blanket Bans

The Police1 analysis draws a comparison to the 2006 State Department response to concerns about Chinese-manufactured Lenovo computers. Rather than a blanket prohibition, the department restricted Lenovo hardware to unclassified and non-sensitive networks while allowing continued use elsewhere. Two decades later, Lenovo products still appear in GSA procurement programs. The lesson the framework draws: governments have a long track record of managing technology risk through tiered controls and network segmentation rather than outright bans.

That pattern maps directly to what some public safety agencies are already doing with drone fleets. Mixed configurations — blue-listed systems for critical infrastructure inspections or high-visibility events, existing platforms for routine life-safety calls — spread risk without abandoning operational capability. Kansas City’s Drone as First Responder launch, built around DJI hardware despite the federal debate, is a live example of an agency making that procurement call during an active policy dispute.

Agency Leaders Want American-Made Systems — If the Products Actually Compete

DRONERESPONDERS survey data cited in the framework found that a large majority of public safety respondents said they would prefer U.S.-manufactured systems if cost and performance were comparable. That “if” carries serious weight. The Pilot Institute survey of 8,056 operators published in January 2026 found that DJI’s dominance is not a preference — it’s a performance and price reality that no domestic manufacturer has yet matched at scale. Skydio’s DFR Command platform hitting 10 million calls is a genuine milestone, but it doesn’t resolve the hardware cost gap for agencies running on municipal budgets.

The Police1 framework also raises a pointed question that rarely surfaces in congressional hearings: municipal public safety agencies are not typically the ones inspecting critical infrastructure. Utilities, energy companies, and transportation operators handle those missions directly. If the national security concern is about infrastructure data, the policy focus on municipal police and fire appears to be aimed at the wrong sector of the drone market.

DroneXL’s Take

I’ve been covering the DJI ban from every angle since well before the December 22 FCC vote, and this Police1 framework is one of the more honest assessments I’ve read. It doesn’t pretend the security concerns are fabricated, and it doesn’t pretend a blanket ban is a workable public safety strategy. Both of those things are true simultaneously, and most commentary picks one side and stays there.

What I keep coming back to is the governance gap the framework identifies. I’ve spoken with Drone as First Responder program managers who run extremely disciplined flight operations — specific geofences, offline data handling, restricted app configurations — yet have no formal cybersecurity documentation to show an auditor. They’re doing the right things without the paper trail that would protect their program if a congressional staffer ever came knocking. That’s the fixable problem.

The FCC’s March 2026 move to exempt the first four drone systems from the Covered List shows the regulatory architecture is not static. As I wrote in “DJI and the American Drone Delusion”, the U.S. is not on a path to replacing DJI on a timeline that matches the urgency the ban’s proponents are claiming. By the end of 2026, at least a dozen public safety agencies will document operational gaps caused by the transition through state legislative testimony or budget filings, and that pressure will accelerate the carve-out process the FCC has already started.

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.