Current Cyber Threats

FCC Bans DJI Drones Starting Today

Summary:
The Federal Communications Commission (FCC) has officially added DJI and other foreign drone manufacturers to its list of communications equipment deemed an "unacceptable risk to national security."

The ban was triggered by a deadline for a national security audit (mandated by the FY25 National Defense Authorization Act) that passed without the audits being conducted. Because no agency was tasked with the job, the audit never happened, leading to the automatic inclusion of these companies on the "Covered List" alongside firms like Huawei and Kaspersky.

The ban prohibits the FCC from granting equipment authorizations for new uncrewed aircraft systems (UAS) and critical components from foreign adversarial nations. The ban does not ground drones that people already own, nor does it immediately stop the sale of existing models already on store shelves. However, no new DJI models will be approved for sale in the U.S. moving forward.

The restrictions extend to other DJI electronics, including action cameras, gimbals, and microphones, as they are part of the broader communication equipment categories listed.

Security Officer Comments:
DJI estimates its products support roughly 460,000 U.S. jobs and $116 billion in economic activity. Industries relying on drones such as agriculture, construction, cinematography, and emergency services may face higher costs and reduced access to the most advanced technology.

The concerns surrounding foreign drones, particularly those manufactured by Chinese companies like DJI, center on the intersection of advanced hardware, cloud-based software, and Chinese national security laws.

While many of the concerns surrounding foreign drones are theoretical, the national security risks are concerning. Some concerning examples are below.
  • Drones are frequently used in the U.S. for inspecting bridges, power grids, dams, and telecommunications towers. High-resolution 3D maps and thermal imagery of these sites reveal structural vulnerabilities. In a potential conflict scenario, this data could be used to identify the exact points where a cyberattack or physical strike would cause the most damage to the U.S. power grid or transportation network.
  • Modern drones are sophisticated electronic devices that interact with various radio frequencies and Wi-Fi networks. Drones can be used to map the electronic environment of a sensitive area. By "sniffing" Wi-Fi signals or monitoring radio traffic near government buildings or military bases, they can help identify secure communication channels or find unsecured access points into private networks. A drone flying near a secure facility can act as a "man-in-the-middle," potentially intercepting data transmitted over local wireless networks that would otherwise be out of reach for a remote hacker.
  • Drones require apps to fly, and these apps often require user accounts, access to contacts, and location history. By tracking the accounts of drone pilots, the Chinese government could identify individuals working in sensitive sectors (defense, law enforcement, high-tech).
  • Drones are heavily used in agriculture, mining, and large-scale construction. Data on crop yields, mineral deposits, or the progress of secret industrial facilities provides a strategic economic advantage. For example, knowing the exact status of U.S. agricultural output before it is public knowledge allows for more informed moves in global trade markets.
  • Beyond data collection, there is a concern regarding the control of the devices. Because drones rely on proprietary software updates and cloud connectivity, there is a fear that the manufacturer could remotely disable (brick) the drones during a time of crisis.
The primary reason these technical concerns carry such weight is Article 7 of China’s National Intelligence Law (2017). This law states that "any organization or citizen shall support, assist, and cooperate with state intelligence work.” Even if DJI or other companies want to protect user data, the U.S. government argues they have no legal choice but to hand over data to the Chinese Communist Party if requested. While DJI has stated that users can opt-out of data sharing and that U.S. data is stored on U.S. servers, skeptics argue that software "backdoors" or forced updates could circumvent these protections at any time.

Link(s):
https://docs.fcc.gov/public/attachments/DOC-416839A1.pdf