By Michael Tallent
•
February 5, 2025
DJI's Efforts to Distance Themselves from Chinese Ownership and Ensure Data Security In recent years, DJI, the world's leading drone manufacturer, has faced increasing scrutiny over its Chinese ownership and concerns about data security. In response, DJI has taken several significant steps to address these concerns and reassure users that their data is secure. Distancing from Chinese Ownership One of the most notable efforts by DJI to distance itself from Chinese ownership is the establishment of Anzu Robotics, a Texas-based startup. Anzu Robotics claims to have no business relationship with DJI, yet it sells drones that bear remarkable similarities to DJI's products. This move was seen as an attempt to bypass the impending U.S. ban on Chinese drones. However, Anzu Robotics has since stated that it has no business relationship with DJI, following an investigation by the U.S. House Select Committee on the Chinese Communist Party. Ensuring Data Security DJI has implemented a range of measures to enhance data security and privacy for its users. These measures include: 1 . Trusted Execution Environment (TEE) : DJI employs TEE and FIPS-certified DJI Core Crypto Engine for strong chip and hardware security. a. Isolation : The TEE creates a secure environment that isolates critical security functions from the main operating system. This isolation helps protect sensitive data and cryptographic operations from being tampered with or accessed by unauthorized parties. b. Secure Boot : The TEE ensures that the drone's firmware and software are securely booted, preventing unauthorized modifications or malicious software from compromising the system. c. Data Protection : By using the TEE, DJI ensures that sensitive data, such as flight logs and user information, is stored and processed securely. This helps prevent data breaches and unauthorized access to personal information. . d. Cryptographic Operations : The TEE supports cryptographic operations, such as encryption and decryption, using the FIPS-certified DJI Core Crypto Engine. This ensures that data is encrypted and decrypted securely, providing robust protection against potential attacks. e. Hardware Security : The TEE is implemented at the hardware level, making it resistant to software attacks and providing a secure foundation for the drone's security architecture. f. Data Encryption: Drone data shared with DJI is TLS-protected, and personal data is further secured with AES-256 encryption in storage. 2. Independent Security Audits: Since 2017, DJI has conducted regular independent security audits to validate its data security practices. These audits have consistently affirmed DJI's alignment with industry best practices. DJI has been proactive in ensuring the security of its products through regular independent security audits. Since 2017, DJI has engaged multiple federal agencies and private sector firms to validate its data security practices. Here are some key audits: a. FTI Consulting Audit (2024) : This audit assessed the DJI Mavic 3T, Pilot 2, and RC Pro, reaffirming that when U.S. operators choose to share flight data with DJI, the data resides within U.S.-based servers. It also validated that Local Data Mode (LDM) resulted in no outbound traffic. b. TÜV SÜD Audit (2022) : TÜV SÜD conducted an audit of DJI consumer drones (Air 2S, Mini 2, Mavic 3) and the DJI Fly app, confirming compliance with NIST IR 8259 and ETSI EN 303645 standards for network security and privacy protection. c. Booz Allen Hamilton Audit (2020) : This audit focused on DJI commercial drone products (Mavic Pro GE, Matrice 600 Pro GE, Mavic 2 Enterprise) and validated DJI's adherence to industry best practices. d. ISO 27001 Certification (2023) : DJI FlightHub 2 obtained ISO 27001 certification from the British Standards Institution (BSI), ensuring compliance with information security management standards. e. FIPS 140-2 Certification (2022) : The DJI Core Crypto Engine received NIST FIPS 140-2 certification, validating its security standards in design and implementation. f. These audits provide independent validation of DJI's robust data privacy practices and reinforce the company's commitment to maintaining high security standards. 3. Bug Bounty Program : DJI was the first drone maker to introduce a Bug Bounty Program, encouraging security researchers to detect and report potential vulnerabilities. 4. Local Data Mode (LDM) : This mode ensures that no outbound traffic occurs when U.S. operators choose to share flight data with DJI. Local Data Mode is a privacy feature introduced by DJI to give users more control over their data. When activated, LDM disables internet connectivity for the DJI app, preventing any data from being sent to or received from DJI or third-party servers4. Here are some key details: a. Functionality : LDM acts as a "kill switch" that blocks all outbound traffic from the DJI app, ensuring that no flight data is transmitted over the internet. b. Data Security : Independent audits by FTI Consulting confirmed that LDM effectively blocks all data transfers, except for map data when the "Map Request" feature is enabled. c. User Control : Users can choose to enable LDM to ensure that their data remains on their device, providing an additional layer of security for sensitive operations. d. Availability : LDM is available in the DJI Pilot app and has been expanded to other DJI apps, including DJI GO4 and DJI Fly. e. By implementing Local Data Mode, DJI empowers users to manage their data privacy and provides assurance that their flight data remains secure. DJI's commitment to data security and privacy is evident in its ongoing efforts to enhance privacy controls and engage with the drone community to strengthen its systems. By implementing these measures, DJI aims to build trust with its users and ensure that their data remains secure. In conclusion, DJI's efforts to distance itself from Chinese ownership and ensure data security demonstrate its commitment to addressing user concerns and maintaining a high standard of data protection. As the company continues to innovate and expand its product offerings, it remains dedicated to providing a secure and reliable experience for its customers.