The pressing threat of Chinese-made drones flying above U.S. critical infrastructure
Just look up on a clear day and there’s a good chance you’ll see one. Small and inexpensive drones have become omnipresent. While hobbyists use them for photography or racing, professionals now fly them to capture TV and film footage, conduct surveys or perform building inspections. While drones aren’t necessarily inherently dangerous or undesirable, the global market and supply chains that enable their production and sale are another story.
Drones, or unmanned aerial systems, have been employed for decades in both military and civilian applications. Early UAS were large, expensive, custom designed for a specific purpose and required trained operators, limiting the market mostly to nation-states. As the price point dropped, users found innovative ways to leverage drone capabilities for improved operational efficiency, security and public safety.
Cost-effective quadcopters — or multirotor drones — have become popular with infrastructure and public safety organizations, especially as developments in miniaturization have enabled smaller, less expensive fleets of drones without sacrificing capability. China has moved to capitalize on the miniaturization movement and the demand for compact, economical, high-performance drones. China dominates the global market for commercial drones, with a majority produced by DJI, or Da Jang Innovations, a technology company started in 2006 in Shenzhen, China, by young technology entrepreneur Frank Wang.
In less than a decade, DJI quickly eclipsed global competitors in market share for low-cost, reliable drones. As late as 2021, DJI controlled more than 70% of the U.S. hobby drone market, and up to 90% of the U.S. commercial drone market, which includes many public safety agencies and infrastructure operators. The company’s rapid growth and market dominance led observers to speculate that the Chinese government had been investing in the company, helping it both to scale production and accelerate impressive technological advantage.
DJI maintains that it is privately held and that it has not received “direct” investments from the Chinese government. However, research by IVPM, an independent physical security technology research organization, found that DJI received infusions from at least four investment firms “owned or administered by Beijing” since 2018, including one from a Chinese state asset manager that plays a key role in Chinese military-civil partnerships.
DJI’s massive U.S. market share, and in particular its popularity among public safety organizations and infrastructure owners and operators, combined with compelling evidence of strong ties to the Chinese government, has raised concern among national security experts and government officials alike. DJI also has access to cheap microprocessors and raw materials, as well as cheap labor. This access, arising from its proximity to China’s “Silicon Valley’ and alleged subsidies from the Chinese government, provide DJI a significant advantage over most companies and entrepreneurs.
Because of how they are deployed operationally, drones have inherently unique access to sensitive system and enterprise information. Organizations use this information to improve operations, secure U.S. critical infrastructure, identify and mitigate vulnerabilities, conduct search and rescue operations, and respond to natural disasters. Drones provide the data and imagery used for vital decision-making and planning. However, in the hands of the adversary, that same data offers the potential for data exfiltration, espionage and exploitation. And this is exactly the concern with Chinese-manufactured drone technology, specifically DJI.
DJI’s high-resolution optical and thermal cameras, advanced sensor packages, access to enterprise wireless networks, small size and high maneuverability make them sophisticated systems for spying as well. Simply put, DJI drones provide potential platforms for Chinese espionage and sabotage.
Citing “increased awareness of cyber vulnerabilities associated with DJI products,” the U.S. Army Aviation unit instituted a partial grounding of the platforms in August 2017. In May 2018, again citing cybersecurity concerns, the Department of Defense suspended all procurement of commercial off-the-shelf drones. Referencing the 2018 action, in 2021, the DOD reaffirmed the position that “systems produced by Da Jiang Innovations pose potential threats to national security.” Further, the Fiscal Year 2020 National Defense Authorization Act codified into law a provision banning the purchase and use of drones and components manufactured in countries known to be national security threats. The 2023 NDAA prohibits the DOD and its contractors from using Chinese-manufactured surveillance drones.
The security concerns and guidance extend to industry, as well. In May 2019, the Cybersecurity and Infrastructure Security Agency issued an alert to industry highlighting the cybersecurity concerns of Chinese-manufactured drones. Later that year, the Department of the Interior grounded its entire fleet of Chinese-manufactured drones, citing national security concerns. In 2020, the Department of Commerce added DJI to its Entity List, which bans US-based companies from exporting technology to companies designated as a national security concern. DJI was subsequently prohibited from exhibiting at CES, one of the biggest annual tech events, because of its designation on the Commerce Entity List
But that’s not enough. In addition to continuing to press for implementation of the mitigation measures outlined in CISA’s 2019 alert to industry, the U.S. government and regulatory agencies should prohibit the new procurement of Chinese-manufactured drone technologies and urge all regulated critical infrastructure owners and operators to immediately remove such technologies from their fleets. Furthermore, the U.S. government should clearly and emphatically advise all public safety agencies of the risks of Chinese manufactured drone systems and encourage them, in coordination with state and local officials, to discontinue use in a manner that does not further endanger public safety. Agencies and legislatures with jurisdiction should also move expeditiously to prohibit new acquisition of Chinese-manufactured drone technologies and identify alternative capabilities to support public safety operations.
The urgency around this threat could not be greater given the mission-critical roles of infrastructure owners and operators and public safety organizations. We therefore ask lawmakers and policymakers not only to revisit the issue, as Sens. Mark Warner, D. Va., Marsha Blackburn, R. Tenn., and a bi-partisan group of their colleagues urged in a letter to CISA last week, but also to work with industry, as well as state, local, tribal and territorial governments, to outline and implement a comprehensive approach to enable the elimination of all drones manufactured by companies with ties to the Chinese Communist Party from critical infrastructure and public safety inventories and supply chains.
Brian Harrell is the former assistant secretary for infrastructure protection at the U.S. Department of Homeland Security.
Travis Moran is a retired federal law enforcement officer and security adviser for the electricity subsector.
