DJI Security Fears: Debunking the Rumors (Again)

They say no good deed goes unpunished.  That certainly seems to be the case for the world’s largest drone manufacturer, Chinese-based DJI.  DJI security rumors revived after the company donated drones to law enforcement and emergency services departments across the country to assist with coronavirus response efforts, as part of their Disaster Relief Program.

DJI’s donations are being used for many different applications – importantly, for whatever application the recipient agency wants.  Among the new applications for coronavirus that law enforcement agencies have come up with is one that has given drones more public visibility: social distance monitoring.

Drones flying in public areas and issuing a message recorded by the local law enforcement agency led one political figure to complain that DJI is “spying” – somehow making data gathered by the drone’s camera (in this case, of random groups gathering on sidewalks) available to China’s government.  Despite an independent U.S.-based audit that concluded there was no risk to data, a Government edition drone and further efforts to ensure that operators can choose not to be connected in any way to the cloud, DJI has been forced to respond again to the rumors.

In a letter to the recipients of DJI’s Disaster Relief Program, the company addressed the issue, pointing out that the source of the rumor was not actually a drone user:

We want to address one area of concern that emerged over the weekend. The spokeswoman for the Republican National Committee tweeted links to an MSNBC story about the program and a 2017 New York Times story about DJI and commented, “US using Chinese drones to spy on and lecture Americans about a virus caused by communist China.” This message was picked up in several other stories that ran on conservative websites. Whatever your political leanings, this may cause questions for your internal and external stakeholders. So here are the facts:

• As you know through your hands-on experience with DJI hardware and software, you have control over the photos, videos and flight logs you generate during your flights. This data is not transferred to DJI unless you deliberately choose to do so. We recently published this online guide to the privacy settings on DJI consumer and enterprise products, to help you understand how to manage the data you generate.
• The news story refers to a leaked 2017 draft memo written by an office of U.S. Immigration and Customs Enforcement, based on the word of a single unnamed source. Many of its claims are obviously false or easily disproven, and DJI has repeatedly debunked it, while ICE has never publicly released the memo or validated its contents. DJI also engaged an independent security research firm which analyzed the data security of our products and confirmed that DJI customers control how their data is collected, stored and transmitted.
• DJI products designed for sensitive government uses have been independently reviewed and tested by U.S. cybersecurity consultants, U.S. federal agencies and the Idaho National Laboratory. Our drones exceed the U.S. Department of Homeland Security’s recommended risk mitigation strategies for drone use in critical infrastructure. While the concerns about DJI are clearly motivated by political sentiment, this post on our corporate blog explains the facts behind them.

DJI is not the only victim in the rumor campaign.  Commercial drone pilots report being refused access to worksites and having long standing contracts canceled as a reaction to these fears, in an increasingly troubling trend for an industry already hit by the pandemic.

Another rumor has claimed that DJI is leaving the U.S., closing down their significant U.S. presence.  This also is untrue, as DJI confirms:

“DJI remains committed to supporting our customers around the world. We have made some organizational changes in order to adapt to today’s challenging economic environment, but we remain open for business everywhere we operate. Our employees are working remotely in areas where offices must remain closed, and our sales, repair and customer service networks continue to operate within the restrictions required by local and regional regulations. Our commitment to serve our customers with the products they want and need remains unchanged. We are not going anywhere.

“In the United States, where DJI drones are a standard tool for business and government as well as photography and recreation, we have enhanced our commitment to the market through the DJI Disaster Relief Program. We have provided 100 drones to 43 American public safety agencies to help them protect their communities and their own personnel during the COVID-19 pandemic, supporting the public safety professionals who rely on DJI to keep them safe. We are proud to help the heroes at the front lines of this crisis, and to show we are ready to serve all of America’s drone users.“