Our Vision: To be the nationally recognized voice for the public interest, states and territories on aviation and the national aviation system.

Homeland Security Report: ‘DJI Likely Providing U.S. Critical Infrastructure and Law Enforcement Data to Chinese Government’

Special Agent in Charge Intelligence Program (SIP) Los Angeles generated a report in response to several requests for information received from the intelligence and law enforcement communities. According to the report, “It is based on information derived from open source reporting and a reliable source within the unmanned aerial systems (UAS) industry with first and secondhand access.” The report is dated August 9, 2017 but has only recently become publicly available.

The report stated that U.S. officials had “moderate confidence” that DJI’s commercial drones and software are “providing U.S. critical infrastructure and law enforcement data to the Chinese government.”

The Homeland Security report can be accessed here.

Below are a few excerpts detailing some the findings from the Los Angeles office of the Immigration and Customs Enforcement (ICE) bureau report.

(U//LES) DJI sells group one category (under five pounds) UAS intended for consumer and professional use. The UAS operate on two Android smartphone applications called DJI GO and Sky Pixels that automatically tag GPS imagery and locations, register facial recognition data even when the system is off, and access users’ phone data. Additionally, the applications capture user identification, e-mail addresses, full names, phone numbers, images, videos, and computer credentials. Much of the information collected includes proprietary and sensitive critical infrastructure data, such as detailed imagery of power control panels, security measures for critical infrastructure sites, or materials used in bridge construction. According to the source of information (SOI), DJI automatically uploads this information into cloud storage systems located in Taiwan, China, and Hong Kong, to which the Chinese government most likely has access. SIP Los Angeles assesses with high confidence a foreign government with access to this information could easily coordinate physical or cyber attacks against critical sites.

(U//FOUO) In August 2017, the U.S. Army issued a memo to its units to immediately discontinue the use of DJI UAS due to an increased awareness of cyber vulnerabilities associated with DJI products. Although the vulnerabilities are not specified in the memo, it could refer to how DJI is using the data collected. The memo also references a May 2017 U.S. Navy memo addressing operational risks related to DJI products.

(U//LES) The Chinese government is using DJI UAS as an inexpensive, hard-to-trace method to collect on U.S. critical assets, according to the SOI. The Chinese government directorates most likely receiving the data from DJI’s cloud are the offices responsible for defense, critical infrastructure, traffic controlling, and cyber offense, according to the same source.

(U//LES) SIP Los Angeles assesses with high confidence that outside of DJI’s goal to attain law enforcement customers, DJI’s criteria for selecting accounts to target appears to focus on the account holder’s ability to disrupt critical infrastructure.

(U//LES) Furthermore, the Chinese government is likely using information acquired from DJI systems as a way to target assets they are planning to purchase.

(U//LES) SIP Los Angeles assesses with high confidence the critical infrastructure and law enforcement entities using DJI systems are collecting sensitive intelligence that the Chinese government could use to conduct physical or cyber attacks against the United States and its population. Alternatively, China could provide DJI information to terrorist organizations, hostile non-state entities, or state-sponsored groups to coordinate attacks against U.S. critical infrastructure. The UAS capture close-up imagery and GPS information on water systems, rail systems, hazardous material storage systems, first responders’ activity, and construction of highways, bridges, and rails.

DJI has refuted the allegations in the Homeland Security report in a statement that can be accessed here.

Categories: News
Whether you are a state aviation official, staff member or a Friend of NASAO, there are opportunities for you to become more involved with NASAO through participation on one of our many Committees. See a complete list of opportunities and let us know where you would like to be involved. More
NASAO is one of the most senior aviation organizations in the United States, predating even the Federal Aviation Administration’s predecessor, the Civil Aeronautics Authority. The states first established NASAO to ensure uniformity of safety measures, to standardize airport regulations and develop a truly national air transportation system responsive to local, state, and regional needs. More
NASAO holds two formal conferences each year – our Annual Convention and Trade Show, typically held in September and a Washington Legislative Conference held in the nation’s Capital during the February/March timeframe. NASAO also has a presence at EAA’s AirVenture, held each year in Oshkosh, Wisconsin in late July. Whether you are looking to attend an interesting, informative and relevant conference or would like to exhibit or sponsor an event, let us know. More
Featured Business Partners