DJI drones transmit location data unencrypted; ‘open source AeroScope’ in the making

Contrary to previous claims by the world’s largest drone maker, DJI drones transmit their location and ID data unencrypted. This means that anyone with knowledge of the facts can receive and read this information. DJI has since confirmed that the AeroScope signal emitted by every DJI drone is unencrypted. It is now rumored that an ‘open source AeroScope’ will soon be on the market.

What is AeroScope?

AeroScope was introduced by DJI in November 2017 in response to growing government concerns about drone flights near airports and critical infrastructure. The system consists of a receiver on the ground that can detect, track and identify nearby DJI drones. To this end, all drones that DJI has launched on the market since 2017 send a signal that includes data relating to the current position of the drone, the position of the drone pilot, and the serial number of the flight controller of the drone.

Since the introduction of AeroScope, the system has been installed in many places, from airports to prisons and port areas. The system is also used in the Netherlands. For example, all drone flights in the Rotterdam region were monitored for some time and the municipalities of Enschede and Amsterdam also experimented with the ‘drone radar’ to get an idea of ​​the (illegal) use of drones over these cities.

O DJI AeroScope drone detection system entered the spotlight after Rússia invaded Ucrânia. Both the Russians and the Ukrainians make full use of DJI drones during the battle. But the use of AeroScope made it possible to detect enemy drone movements early, which entails the necessary dangers for the pilotos de drones. At one point, DJI was accused of remotely disabling the DJI Aeroscope drone detection systems on the Ukrainian side, but this was strongly denied by DJI.

DJI Aeroscope signal not encrypted

But now DJI has once again become discredited. According to DJI, the AeroScope signal was encrypted. But as it turns out, that wasn’t the case at all. This is shown by research by cybersecurity expert Kevin Finnisterre, who proved conclusively on March 31 that the DroneID packets that the drones transmit are not encrypted at all:

DJI spokesman Adam Lisberg tells The Verge himself that he has been misinformed all along about how AeroScope works by his Chinese R&D colleagues. It was only after senior executives sprang into action that his assumption that the data was encrypted was disproved. Former VP of Policy and Legal Affairs Brendan Schulman says he is not surprised and emphasizes that the mandatory Remote ID functionality in the future will also work based on unencrypted location data.

Implications of unencrypted DJI Aeroscope data

The fact that the AeroScope signal is not protected means that anyone with expert knowledge of software-defined radio (SDR) can make a receiver that can detect DJI drones in the area. According to Gary Mortimer of sUASnews, an open source version of AeroScope will be available soon, based on cheap hardware.

It goes without saying that the wide availability of such receivers has quite a few consequences. Not only can everyone with such a receiver see where drones are flying in the immediate vicinity, but also the location of the drone pilot or take-off location is revealed. It is not a very comforting thought that folks with an aversion to drones can access this information as well. For example, the deployment of emergency services drones with such a receiver in the area could also be tracked.

Cyber ​​security risk

The fact that DJI drones transmit their location data unencrypted has now been identified as a security risk by the American cybersecurity organization CVE.

This article first appeared on Dronewatch and is written by Wiebe de Jager who is also a DroneXL contributor.

Obtenha seu certificado Parte 107

Passe no teste e voe para os céus com o Instituto Piloto. We have helped thousands of people become airplane and commercial drone pilots. Our courses are designed by industry experts to help you pass FAA tests and achieve your dreams.

FTC: DroneXL.co uses affiliate links that generate income.* We do not sell, share, rent out or spam your email, ever. Our email goes out on weekdays around 5:30 p.m.

Stay in touch!

If you’d like to stay up to date with all the latest drone news, scoops, rumors, and reviews follow us on Twitter, Facebook, YouTube, Instagram, or… Subscribe to our Daily Drone News email.*