DJI Data Security: Chinese Drone Maker Scrutinized

DJI Datensicherheit has been a hot topic over the last number of years. Here is a detailed timeline of the scrutiny and actions taken against Chinese drone maker DJI in the U.S. from 2017 to present, along with DJI’s efforts to protect itself.

Timeline

2017

• August: The U.S. Army issues a ban on all DJI drones based on allegations that DJI’s drones were secretly configured to collect and send user data back to DJI.
• October: DJI responds by releasing Local Data Mode, which allows pilots to fly without any data being shared.
• November: An internal memo is leaked from the Department of Homeland Security saying that DJI is using its drones to collect sensitive information in the U.S. and share it with the Chinese government.

2018

• April: DJI hires San Francisco-based Kivu Consulting, Inc. to review its privacy practices. The resulting report absolves DJI of malicious or negligent data sharing practices, but privacy concerns linger.

2019

• May: The Department of Homeland Security (DHS) issues an advisory warning companies that their data may be at risk if they use drones made in China.
• June: DJI issues Government Edition, a line of drones made to ensure complete privacy of data. DJI also announces it will begin making drones within the U.S.

2020

• January: The Interior Department extends the grounding of its drones indefinitely due to Chinese spying concerns. DJI publishes a statement calling the action “politically motivated”.
• September: DJI expands Local Data Mode to more drone models and has an independent cybersecurity audit validate the feature.

2021

• January: The American Security Drone Act (ASDA) is included in the U.S. Innovation and Competition Act.
• June: A leaked Pentagon report determines that the DJI Government Edition drones have been cleared for government use.

2022

• February: News breaks that DJI receives funding from the Chinese government.

2023

• December: The ASDA becomes law as part of the 2024 NDAA, banning federal agencies from using Chinese drones.

2024

• January: The FBI and CISA issue a joint memo warning of the threats posed by Chinese-made drones.
• February: The Gesetz über Drohnen für Ersthelfer (Drones for First Responders Act) is introduced, which would impose tariffs on Chinese drones and use the money to fund grants for U.S. made drones.
• April: The Gesetz zur Bekämpfung von CCP-Drohnen is introduced by Rep. Elise Stefanik (R-NY) and Rep. Mike Gallagher (R-WI). It would ban new DJI products by prohibiting them from U.S. communications networks.
• May: DJI warns the drone community about the implications of the Countering CCP Drones Act and urges operators to get involved to oppose it
• June: The Countering CCP Drones Act passes the House and awaits a vote in the Senate. DJI announces it will stop recording flight records for U.S. customers.
• July: Skydio CEO Adam Bry denies that his company is lobbying the government to ban DJI, despite Skydio’s increasing lobbying spend. Rumors circulate online that Skydio, along with Brinc Drones and the Association for Uncrewed Vehicle Systems International (AUVSI), are behind the push to ban DJI.

Throughout this period, DJI has taken steps to address data security concerns, such as:

• Introducing Local Data Mode und DJI Government Edition drones with enhanced data protections.
• Implementing geofencing to restrict flights in sensitive locations
• Complying with the FAA’s Entfernte ID requirements for broadcasting drone location
• Conducting third-party audits and reviews of its data practices
• Engaging in lobbying efforts to advocate for its interests

However, DJI continues to face an uncertain future in the U.S. market as it battles allegations of ties to the Chinese government and possible data security risks. The outcome of pending legislation like the Gesetz zur Bekämpfung von CCP-Drohnen could determine whether American customers retain access to DJI’s market-leading drone technology going forward.

Independent Studies Into DJI Data Security

Several independent studies have been conducted since 2018 to assess the data security practices of DJI drones and whether they send sensitive user data back to China without permission. The key findings from these audits are:

Kivu Consulting (2018)

• Kivu analyzed DJI’s drones, mobile apps and servers purchased in the U.S.
• They found users have control over what data DJI drones collect, store and transmit.
• Data like photos, videos and flight logs are only transmitted if the user chooses to share them.
• The study concluded DJI provides tools to keep user data private and does not access it without permission.

Booz Allen Hamilton – UAS COE Audit (2020)

• Booz Allen tested DJI’s Government Edition Mavic Pro, Matrice 600 Pro, and Mavic 2 Enterprise drones.
• They found no evidence of data transmission connections between these drones and DJI, China, or any other unexpected party.

FTI Consulting (2020)

• FTI reviewed the source code of DJI’s apps and did a cybersecurity review of the drone hardware.
• When Local Data Mode was enabled, no drone or app data was sent externally to any third party, including DJI, validating DJI’s claims about the feature.

TÜV SÜD (2022)

• TÜV SÜD independently purchased and tested DJI’s consumer drones (Mavic 3, Mini 2, Air 2S) and the DJI Fly mobile app.
• They found the drones have comprehensive security features and sensitive data is encrypted in transit.
• The drones fulfilled key cybersecurity requirements from NIST and ETSI standards for protecting user data.
• A separate audit of DJI’s enterprise drones like the Matrice 300 RTK reached similar conclusions.

In summary, multiple independent cybersecurity audits from 2018-2022 have consistently found no evidence that DJI drones surreptitiously send user data back to China. The studies concluded DJI employs strong data protections and gives users control over what information is collected and transmitted by the drones and apps. DJI points to these audits to push back on claims its drones pose data security risks.

States Take Action

Based on the provided search results, here is a summary of the key federal and state-level restrictions on DJI and Chinese-made drones since 2017:

Federal Restrictions

• In 2017, the U.S. Army issued a directive for its units to stop using DJI drones due to cybersecurity vulnerabilities.
• The 2020 National Defense Authorization Act banned the Department of Defense from using federal funds to purchase Chinese drones.
• In late 2022, the American Security Drone Act was included in the 2023 National Defense Authorization Act, banning the federal government from purchasing Chinese drones.
• In April 2024, the Countering CCP Drones Act was introduced in Congress. If passed, it would prohibit DJI drones from operating on U.S. communications infrastructure, effectively making them unusable in the U.S.

State Restrictions

Arkansas

• In October 2023, Arkansas passed Act 525, which prohibits state agencies from purchasing or using drones made by China and other “covered foreign entities” starting in 2027.
• Agencies have a 4-year grace period to phase out their use of foreign drones. They can apply for a waiver through the secretary of transportation if they believe their drones can last beyond 4 years.
• The law primarily targets DJI, which accounts for 70% of the global civilian drone market. Lawmakers cited national security concerns about DJI’s links to the Chinese government and military.

Florida

• In 2023, Florida passed a law banning the use of state funds to purchase Chinese drones and requiring agencies to rapidly phase out Chinese drones.
• As of July 2024, the law has caused frustration among Ersthelferinnen und Ersthelfer who rely on DJI drones for public safety operations but now face grounding their fleets.
• Some local laws in Florida cities like Miami and Orlando place additional restrictions on flying drones near large public events and venues.

Mississippi

• In 2023, Mississippi enacted the Uncrewed Aircraft Systems’ Rights and Authorities Act, which requires state agencies to buy American-made drones.
• The law codifies that the FAA has ultimate authority over state airspace and prevents local governments from creating additional burdensome drone regulations.
• While not explicitly targeting DJI, the preference for U.S. drones would preclude agencies from using DJI products.

Tennessee

• In May 2023, Tennessee passed Senate Bill 776, which prohibits state agencies, local agencies, and law enforcement from purchasing drones made by foreign companies banned under the 2019 National Defense Authorization Act.
• This effectively prohibits these agencies from buying or using DJI drones, as DJI was blacklisted by the Pentagon in 2022.

All four states have recently enacted laws that either explicitly ban government agencies from using DJI drones (Arkansas, Tennessee) or strongly discourage their use by prohibiting state funds from being used to buy Chinese drones (Florida, Mississippi). The laws cite national security concerns about DJI’s ties to the Chinese government. Some provide grace periods for phasing out DJI drones, while others like Florida’s have already impacted public safety drone programs that rely on DJI products.

Other states considering restrictions on Chinese drones as of 2023-2024 include:

• Arizona (bill passed state senate but appears to be dead)
• Connecticut (considering Senate Bill 3 to ban drones from “covered foreign entities”)
• Kansas (considering HB 2820 to institute a state ban on Chinese drones)
• Missouri (debating a law in the state legislature)
• Kalifornien, Hawaii, Washington, Texas und Alabama are also implementing measures to prohibit agencies from using Chinese drones

There has been a growing trend of federal and state-level restrictions on DJI and Chinese drones since 2017, with the pace accelerating significantly in 2023-2024. While some laws focus on government procurement, others like Florida’s and the proposed federal Countering CCP Drones Act could effectively ground DJI drones for all users if enacted.

Politicians Involved Against DJI

Based on the provided search results, here are the key federal and state-level politicians who have played a significant role in trying to restrict or ban DJI drones in the Vereinigte Staaten since 2017:

Federal Level

• Rep. Elise Stefanik (R-NY): Introduced the Countering CCP Drones Act in April 2024 to ban DJI drones from operating on U.S. communications infrastructure. The bill passed the House in June 2024.
• Rep. Mike Gallagher (R-WI): Co-sponsored the Countering CCP Drones Act with Rep. Stefanik.
• Sen. Mitt Romney (R-UT), Sen. Mark Warner (D-VA), Sen. Marco Rubio (R-FL), Sen. Richard Blumenthal (D-CT), Sen. Marsha Blackburn (R-TN), Sen. Christopher Murphy (D-CT), Sen. Josh Hawley (R-MO): Co-sponsored the American Security Drone Act of 2023, which would prohibit federal agencies from purchasing drones made by Chinese government-linked countries.
• Rep. Dusty Johnson (R-SD): Advocated in July 2024 for Congress to ban DJI drones.

State Level

• Arkansas: In March 2023, Arkansas passed Act 525, prohibiting state agencies from using drones made by China and other “covered foreign entities”.
• Florida: In 2023, Florida passed a law banning the use of state funds to purchase Chinese drones and requiring agencies to rapidly phase out Chinese drones.
• Mississippi: In 2023, Mississippi enacted a law requiring state agencies to buy American-made drones.
• Tennessee: Recently passed a bill restricting government agencies’ use of Chinese-manufactured drones.

There has been a growing bipartisan effort at both the federal and state levels to restrict or ban DJI drones due to national security concerns. Key politicians driving these efforts include Rep. Elise Stefanik and Rep. Mike Gallagher at the federal level, along with various state lawmakers in Arkansas, Florida, Mississippi, and Tennessee who have successfully passed laws limiting DJI drone use by government agencies.

Privacy Concerns

The privacy and security concerns around Chinese-made DJI drones are not unique, but rather part of a broader set of risks associated with many internet-connected consumer technologies today.

If someone is worried about DJI drones potentially collecting and sharing sensitive data with the Chinese government, they should probably have similar concerns about a wide range of other smart devices and online services, many of which have documented privacy issues:

• Smartphones track your location, collect personal data, and can be vulnerable to hacking and malware, regardless of the manufacturer. Chinese phone makers like Huawei have faced particular scrutiny.
• Home security cameras and video doorbells like Amazon Ring have a troubling record of sharing user data with law enforcement and third parties for advertising without clear disclosure. There are also cases of these cameras being used to surveil neighbors without consent.
• Smart TVs, speakers, and home appliances are constantly collecting data on your usage habits and can have security flaws that allow snooping. Even non-Chinese brands have had issues.
• Satellite images and weather balloons.
• Using almost any internet service or app means trusting the provider with your personal info, which they may analyze, sell or hand over to authorities. U.S. companies do this too, not just Chinese firms.

So while DJI specifically has faced accusations around its data practices and ties to the Chinese state, these risks are not necessarily greater than those posed by smartphones, Ring cameras and other ubiquitous technologies. DJI has issued detailed rebuttals of the spying claims, citing their strong data protections and multiple independent security audits.

Ultimately, using any internet-connected device or service today requires weighing convenience against privacy tradeoffs. Singling out Chinese drones overlooks that digital surveillance is now a society-wide concern, not limited to any one company or country. Being an informed consumer means scrutinizing the data practices of all your devices, regardless of origin.

The most privacy-conscious approach is to limit your use of smart devices and services altogether. But if you do choose to benefit from this technology, it’s worth securing your devices, reading privacy policies, and holding all companies and governments accountable for responsible data practices. Suspicion of Chinese products is valid, but only part of the bigger picture around technology and surveillance today.

Shenzhen, a Drone Ecosystem

Based on the information provided, creating a Shenzhen-like environment for drone manufacturing and innovation in the United States would be extremely challenging, but not impossible with the right level of government support, investment, and regulatory coordination. Here’s what it would likely take:

Significant Government Support and Incentives

• The U.S. government would need to provide substantial financial incentives, subsidies, and grants specifically targeted at growing the domestic drone industry, similar to what China has done for Shenzhen.
• A CHIPS Act-style package of incentives focused on drones, with funding for research, development, and manufacturing, could help jumpstart the industry.
• Consistent grant funding to build up manufacturing facilities and capabilities would be essential to reach the scale needed to compete with Shenzhen.

Streamlined and Coordinated Regulations

• The current patchwork of federal, state, and local drone regulations in the U.S. creates uncertainty for the industry. A more streamlined and nationally coordinated regulatory framework would be needed.
• Formalizing the roles and authority of federal vs state governments over drone operations is critical. A repeat of the failed 2017 task force effort should be avoided.
• Faster processing of regulatory waivers and approvals for advanced operations like BVLOS flights would accelerate the industry’s growth.

Concentration of Talent and Supply Chain

• Developing a deep pool of engineering and manufacturing talent specifically for the drone industry would be key. Partnerships between companies, universities, and government to establish training centers could help.
• Building up a robust domestic supply chain for drone components and related technologies is essential to reduce reliance on Chinese suppliers. This will take time and investment.

Culture of Rapid Innovation and Iteration

• Shenzhen’s success is built on a culture of ultra-fast innovation cycles and close collaboration between designers, manufacturers, and customers. Replicating this in the U.S. would require a mindset shift.
• Establishing Shenzhen-style electronics markets and R&D centers where new drone designs can be rapidly prototyped, tested with users, and iterated would accelerate innovation.

Long-Term Commitment and Patience

• China’s drone industry dominance took years to build up. Even with aggressive government support, it would likely take the U.S. at least 5-10 years to reach a comparable scale and sophistication.
• Sustaining the political will and funding to support the industry over this period will be challenging, especially across changes in administrations and economic cycles.

While the U.S. has the technological capabilities, talent, and resources to potentially create a Shenzhen-like drone ecosystem, it would require a concerted whole-of-government effort sustained over many years. Significant financial incentives, regulatory reform, investments in talent and supply chain, and a shift in innovation culture would all be needed. Even then, catching up to China’s head start and cost advantages in drone manufacturing would be a formidable challenge. But with the right strategic approach and long-term commitment, the U.S. could build a more competitive domestic drone industry.

.

Insert text about the Drone Advocacy Alliance