DJI Tightens Security to Ease Data Vulnerability Fears

DJI has announced the development of a new option for pilots concerned over recent data security issues. The new feature, Local Data Mode, will enable flight without any internet data transfer, ensuring that enterprise customers and sensitive government operations remain secure.

The announcement is in response to recent stories suggesting that the US Army had grounded all operations using DJI equipment due to concerns over ‘Cyber vulnerabilities’. The company is now keen to provide assurances to users all over the world that their data is secure.

In practice, Local Data Mode will stop internet traffic to and from its flight control apps. In a statement, DJI has admitted that its flight control apps “routinely communicate over the internet to ensure a drone has the most relevant local maps and geofencing data, latest app versions, correct radio frequency and power requirements, and other information that enhances flight safety and functionality.”

While this is nothing new for what is essentially a technology company, questions were raised over what kind of data was collected and where it was being sent.

With Local Data Mode enabled, DJI apps will stop sending or receiving any data over the internet. The aim is to give customers enhanced assurances about the privacy of data generated during flights.

Assurances for Enterprise Customers

“We are creating Local Data Mode to address the needs of our enterprise customers, including public and private organizations that are using DJI technology to perform sensitive operations around the world,” said Brendan Schulman, DJI Vice President of Policy and Legal Affairs. “DJI is committed to protecting the privacy of its customers’ photos, videos and flight logs. Local Data Mode will provide added assurances for customers with heightened data security needs.”

The Drawbacks of Added Security…

Because it blocks all internet data, Local Data Mode means DJI apps will not update maps or geofencing information, will not notify pilots of newly-issued flight restrictions or software updates, and may result in other performance limitations.

However, for many pilots that will be a price worth paying for the enhanced level of data assurance during sensitive flights.

“We are pleased about how rapidly DJI’s customer base has expanded from hobbyists and personal drone pilots to include professional, commercial, government and educational users,” said Victor Wang, DJI Director of Safety Technology. “As more of these customers have asked for additional assurances about how their data is handled, DJI has moved to address their needs by developing local data mode to provide enhanced data management options for customers who want to use them.”

Continuing, the statement reads:

DJI recognizes the importance of data privacy to its customers. DJI does not collect or have access to user flight logs, photos or videos unless the user chooses to share those by syncing flight logs with DJI servers, uploading photos or videos to DJI’s SkyPixel website, or physically delivering the drone to DJI for service.

DJI publicly committed to protecting its customers’ data privacy in April 2016. In a March 2017 white paper, DJI became the first major drone manufacturer to advocate for protecting the privacy of drone users as the United States and European governments develop regulations to monitor drone flights. No other civilian drone manufacturer there has been as vocal as DJI in protecting the operational and data privacy interests of drone users.”

“Local data mode will allow customers to get the most out of their DJI flight control apps while providing added assurance that critical data is not inadvertently transmitted over the internet,” Schulman said. “We are pleased to be able to develop Local Data Mode as part of our drive to serve our customers’ needs as well as advocate for their interests.”

Local Data Mode: An Immediate Rollout

Although the topic of DJI’s data security has come to the fore in recent weeks, the company has confirmed that Local Data Mode “has been in development for several months”.

It will be included in future versions of DJI apps, starting in the next several weeks. DJI’s apps include DJI GO, DJI GO 4, DJI XT Pro, DJI Pilot and Ground Station Pro, which run on smartphones and tablets that control the drone or connect to the drone’s remote control unit. The local data mode feature may not be available in locations where an internet connection is required or highly advisable due to local regulations or requirements.

The Local Data Mode feature may not be available in locations where an internet connection is required or highly advisable due to local regulations or requirements.

Will This Solve DJI’s Security Problems?

This move will go a long way to reassuring DJI customers that their most sensitive flights and data can and will be kept secure. However, questions remain over the presence of backdoors that allow background patching in both the Android and the iOS DJI applications. Although these are now due to be removed following their discovery.

More than anything, this is perhaps recognition from DJI that both its security and communication have not been up to scratch on the issue of data and ‘vulnerabilities’ in its applications. We’ll have more insight on this in the coming days.