Drones, Critical Infrastructure and Cybersecurity.

Next time you fly a DJI drone beware, foreign authorities may be watching what you’re watching.

SZ DJI Technology Co., the world’s largest maker of small civilian drones, has made its entry into industrial-grade drones for enterprise with the Matrice 200 (M200). With hugely useful features like ADS-B, dual and top-mounted gimbals, and IP43 classification this drone looks like a real threat to the likes of current industrial platforms such as the AscTec, senseFly, Intel, and Aerialtronics. However, some big questions remain with this and other DJI products. DJI has said in its discussions with the Chinese government that officials are keen to gain access to the trove of data its airborne devices siphon up via its app. 

That data includes location, flight records and possibly pictures and video shot by users and uploaded to its servers, said Zhang Fanxi, a spokesman for the company.

It’s unclear how future data requests may apply to U.S. and European customers, though the company will inform users if any of their information is handed over to authorities, Zhang said. 

DJI notifies users in its privacy policy that their personal data may be transferred to and from servers throughout China, Hong Kong, and the U.S. 

However, there are reports on internet message boards of users complaining about this issue, such as one user’s comment of “DJI Go running in the background when I'm not even connected to my Phantom”

Zhang, whose title is PR Specialist, told reporters at DJI’s headquarters in Shenzhen. “We are constantly having communications with our government and related departments”, “We have made suggestions to regulators and given them our advice, and said that we’re willing to share our data.”

DJI subsequently released a statement to clarify how it interacts with authorities, which it said is consistent with the privacy policy on its app and website.

“Should DJI receive a valid legal request from a government agency, we may provide user information to that agency, just as other companies do,” spokesman Oliver Wang said in the statement. “That is the case in the U.S., China or anywhere in the world where a valid legal request is made by authorities.”

The company said it doesn’t have any way to see images beyond those uploaded via the app.

DJI has not clarified: how long it keeps data, how it limits the types of information collected and outline how it handles customers by jurisdiction.

This puts customers especially commercial drone operators and governmental clients hoping to inspect critical infrastructure in a very difficult position with international intelligence concerns. These drones are collecting a lot of data, and it’s unclear at this point what the retention period is, and who is getting access to the data.

DJI requires its customers to register with the company, though it doesn’t share that information with the government, Chief Executive Officer Frank Wang said in February of 2015. It was then in talks with Chinese regulators about whether customers needed to register with the government.

Its newest drones use multiple cameras and software to sense and avoid obstacles. If the aircraft comes across something it can’t reasonably avoid, it will stop and hover until it receives further instructions. With such high-level onboard processing, a lot is possible.

“It’s a very intrusive form of surveillance,” said Professor John Bacon-Shone, Associate Dean of Social Sciences at The University of Hong Kong. “It’s one thing if it only applies to DJI’s products inside China, but what if it’s outside of China?”

“If people do not trust that this will only apply inside the mainland, I think it will have a major impact on the company.”

DJI is famous for quadcopters like the Inspire 2, which has a PCI-Express slot for attaching a 480GB drive with a write speed of 4.2Gbps.

The new M200 drones are compatible with DJI's existing intelligence and accessories, such as flight planning software, computer vision for data collection, subject tracking abilities, Zenmuse and other cameras. These drones can generate a lot of data via cameras, flight patterns, 3D mapping, and data collected in flight. The drone may need to access 3D mapping on storage and those maps could be uploaded through the app to DJI servers. 

Seagate Technology PLC, a leader in data storage is working with DJI Robotics on the new storage, and the partners hope to release the first joint product later this year. It estimates a 25-minute flight could generate 120GB of data, and the company wants to create new type storage for drones to capture and protect the data. Seagate declined to comment on what type of storage would be used in drones. 

DJI could act as an arm of the Chinese government. With the potential to build a botnet of micro machines they can use for intelligence gathering. We fly them, they collect data. Then as technology progresses, and when the time is right, they will pull the data most valuable to them creating a secret cyber weapon for intelligence gathering in this new era of cyber warfare. 

UM Inspections, LLC currently uses DJI products for surveying and is in the process of developing US-built drone hardware and software with a Maryland-based robotics company for inspections of critical infrastructure; in order to mitigate this new-found national and cyber security risk.

UM Inspections, LLC (UMI) located in Fort Worth Texas, is a surveying and inspection company, for infrastructure, property, right of ways and environmental projects. Our company focus is on providing superior low altitude aerial imaging services, including data collection, reporting, and modeling via Unmanned Aerial Systems (UAS) to companies in the Energy, Surveying, and Utility sectors, as well as to Government agencies.