I’m just going leave this here (ed)
Amazing work from Konrad_ Iturbe_, Andreas Makris, Jon (jcase) Sawyer and of course, Kevin Finisterre
How Chinese is a drone made by a Chinese company, running software developed in China, with chips made in China, with firmware updates hosted on a server controlled by a Chinese company, with Chinese IP, an with a remote controller which uses a mobile application developed by said Chinese company (with heavy anti reverse engineering obfuscation provided by a different… you guessed it… Chinese company!)
DJI is the world’s largest drone manufacturer with more than 70% of market share worldwide, per some reports.
In 2017 the Department of Defense, and other US government agencies banned use of DJI drones, two years later the Department of Interior followed suit.
It is undeniable DJI drones pose a threat to armed forces worldwide not only due to the fact that the company is headquartered in China, subject to Chinese laws (such as the infamous security law that would force DJI to “report to and cooperate with PRC authorities, and they must assist with state-directed intelligence and counterintelligence efforts.”) but also due to the carelessness displayed by their development team, wherein the data of all of their users was available to download by absolutely anyone who knew where to look, due to an exposed Amazon AWS S3 bucket. Ironically, it was the PLA that actually ended up with their DJI pics online….
DJI could be banned in the US by restricting their use of the electromagnetic spectrum, regulated by the FCC. As of 2025, it is a possibility that DJI ends up in the Covered List, just like ZTE and Huawei.
DJI is already listed as a Chinese Military Company by the DoD.
So what did DJI do in the face of a possible ban?
Created shell companies. Lots of them.
Keep upto date with this story on Github
Related
Discover more from sUAS News
Subscribe to get the latest posts sent to your email.
Founder & CEO of Coptrz
Back in the autumn, I flagged the UK Procurement Act 2023 as a seismic shift for public sector drone procurement. One of its most potent instruments is now in play: the Debarment List—a live register of suppliers barred from public contracts on grounds like national security and ethical misconduct.
You can view it here:
https://www.gov.uk/guidance/procurement-review-unit#debarment-list
Right now, the UK list is short. ZERO entries But make no mistake—the clock is ticking.
AUTEL, a Chinese drone manufacturer, is already sanctioned by the UK under the Russia sanctions regime. Meanwhile, across the Atlantic, bans on Chinese drone tech are accelerating across U.S. federal and state agencies.
So, the pressing question for everyone in the UK drone ecosystem is: Could DJI be next? And if so, when? Personally and at Coptrz we hope not.
For an industry that has grown up on DJI technology, the implications are profound. Would a ban protect national interests—or deal a body blow to UK PLC’s drone capabilities in an increasingly competitive global market?
What happens when the dominant player disappears overnight? Who fills the void?
This isn’t about vilifying DJI, which has undeniably led innovation in our sector. It’s about facing up to a fast-changing geopolitical and regulatory environment—one in which today’s procurement choices could become tomorrow’s liabilities.
Right now, we’re in a holding pattern. The debarment list exists, but it’s empty. There’s no clarity on when it will be updated—or who will appear. And that uncertainty is paralysing.
Budgets are being diverted. Procurement is slowing. Confidence is eroding.
Without decisive guidance, UK buyers, investors, and public bodies are left guessing—with long-term strategic risks stacking up.
Due diligence isn’t just advisable anymore—it’s essential.
The stakes are national. The consequences? Potentially catastrophic.
This is a slow-burning fuse that could detonate at any time.
I’d love to hear your thoughts—especially from those in public procurement, defence, or commercial drone operations.
Let’s not wait until the explosion to start the conversation.
Related
Discover more from sUAS News
Subscribe to get the latest posts sent to your email.
Next year, 2025 there will be two types of drone business in America, those that have considered alternatives to DJI and Autel and those that have put their head’s in the sand.
The clock is ticking for agencies to prove and promulgate facts that show that DJI and Autel present no security threat. If they don’t at the tail end of 2025 companies that didn’t care will be scrambling for new drones and answers.
Language around the drones that will be compliant should Autel and DJI be banned is confusing. For that reason I have prepared a rough guide to the terms here on the last day of 2024.
The water has been muddied with Donald Trump Jr joining the board of a company that is doing it’s best to sell to the military with NDAA flight controllers. But don’t be fooled it’s important to note that they have not designed anything. Not the hardware or software, they are dependant on other peoples work. If the slider moves towards higher standards they will have to move to meet them. Of course with a President in your pocket, NDAA, Blue and Green standards might stay lower for the next four years.
NDAA is around because of worries:-
NDAA Compliance:
Foreign Influence: A major driver behind the various drone-related regulations is the fear of foreign influence and control, particularly from China. The US government seeks to minimise reliance on potentially compromised technology. The “American Security Drone Act of 2023” reflects this by prohibiting government purchase card use for drones from identified “covered foreign entities”.
Data Security & Vulnerabilities: Concerns exist that foreign-made drones could be used for data collection, espionage, or to create backdoors into critical systems. The focus on cybersecurity in both the “Blue UAS” and “Green UAS” programs demonstrates this.
Critical Infrastructure: The wide usage of drones in essential sectors raises security risks. These range from critical infrastructure inspection to emergency response, which needs robust cyber security to prevent vulnerabilities.
NDAA Compliance:
Definition: NDAA compliance stems from Section 848 of the Fiscal Year 2020 National Defense Authorization Act (NDAA). It restricts the Department of Defense (DoD) from purchasing drones and drone components manufactured in certain foreign countries (primarily China, Russia, Iran, and North Korea) or by companies based in these countries.
Key Components: Compliance focuses on vital components such as “flight controllers, radios, data transmission devices, cameras, gimbals, ground control systems, operating software, and data storage”.
Supply Chain Security: The objective of NDAA compliance is to ensure supply chain security. This extends to ensuring that components aren’t sourced from untrusted entities.
Expansion: As of October 2024, these NDAA restrictions are expanding to include private companies undertaking contracts for the DoD.
The Blue program addresses all of these to a higher level.
Blue UAS Program:
DoD Initiative: The Blue UAS program is run by the Defense Innovation Unit (DIU) and aims to verify and scale secure commercial drone technology for the DoD. This helps simplify the DoD’s secure drone procurement process.
Stringent Security: Blue UAS certification involves rigorous cybersecurity assessments and supply chain security reviews in addition to verifying NDAA compliance.
Offline Operation: Blue UAS drones are often “offline” (i.e. not connected to the internet), which is a strong security measure but could limit the functionality of these drones in certain civilian sectors.
These people are holding he hoops that companies have to jump through for Blue UAS.
DIU (Defense Innovation Unit):
Facilitating Commercial Tech: DIU is a critical link for commercial tech companies seeking to work with the DoD. They aim to “minimize upfront costs” and “reduce the time to award.” They provide a streamlined approach that includes rapid decision-making and scalable prototyping contracts. They focus on addressing the current needs of their DoD partners.
Solicitation Process: Companies need to respond to specific solicitations on DIU’s website to work with them.
Agile Processes: DIU’s agile processes, contract authorities, and expert team help accelerate paths to revenue for companies.
The next one is a bit of a land grab from AUVSI. An organisation that had DJI on it’s board and happily took their shilling and now thinks otherwise.
Green UAS Program:
AUVSI scheme: Green UAS was developed to address non-DoD agencies, state and local governments, and private sector entities that require secure drones but might not require the stringent requirements of the Blue UAS.
Flexibility: Unlike Blue UAS, Green UAS permits more flexibility, including allowing internet connectivity, live streaming, and software updates, which are important features for commercial drone operators.
Cybersecurity Focus: Green UAS certification still adheres to strict cybersecurity and supply chain standards. AUVSI is responsible for the administration and certification for this program.
NDAA Compliance: Green UAS drones are also NDAA compliant ensuring they meet similar supply chain requirements. Green UAS represents an “essential middle ground” providing secure options for non-military users that require security and supply chain integrity without overly restrictive standards.
AUVSI (Association for Unmanned Vehicle Systems International):
Trusted Cyber Program: AUVSI’s Trusted Cyber Program has worked with DIU since 2022, collaborating to build shared commercial cyber standards.
Administering Green UAS: AUVSI administers the Green UAS certification program, providing an assessment and certification framework for commercial drones. This makes a more affordable alternative to Blue UAS certification, mainly for non-DoD customers.
Non Profit: AUVSI is a non-profit organization, but it does charge a fee for the certification in order to offset investment costs.
Bridge to Blue: Green UAS-certified companies may have an opportunity to opt-in to data sharing with DIU through AUVSI, making a smoother pathway for transition to the Blue UAS Framework list.
An important thing to have in the back of your mind.
The American Security Drone Act of 2023:
Prohibitions: Section 1826 states “Government-issued Purchase Cards may not be used to procure any covered unmanned aircraft system from a covered foreign entity”.
Covered Foreign Entity: The Act defines “covered foreign entities” as those on the Consolidated Screening List, entities subject to foreign government direction, those deemed a national security risk, entities domiciled in or controlled by China, and subsidiaries/affiliates of these entities.
Covered Unmanned Aircraft Systems: This term references the definition in section 44801 of title 49 of the United States Code.
Effective Immediately: The prohibition took effect immediately when the act was signed.
Cyber Security Frameworks:
Frameworks: Green UAS certification is measured against 4 main areas: corporate cyber hygiene, product & device security, remote operations and connectivity and supply chain risk management.
Cyber Hygiene: Covers a company’s cyber security strategy including alignment with standards like ISO and NIST.
Device Security: Ensures drones and components are designed and manufactured to protect data supporting operations.
Remote Operations: Ensures command and control is only conducted by authorized operators and transmitted data is protected.
Supply Chain: Includes physical vulnerability assessments, bill of materials review, and NDAA compliance verification.
This is the one that everyone has been getting their knickers in a twist over, some say its defeated, some say it’s still coming.
The Countering CCP Drones Act:
House Approval: Passed in the House, which seeks to add DJI to the FCC’s Covered List.
FCC Covered List: Inclusion means new DJI drones would be banned from operating on US communication networks
Senate Review: Currently under review by the Senate as part of the NDAA for 2025.
Reasons: The act is based on national security concerns including data collection, backdoors and the potential disruption of critical infrastructure. It also is based on the economic need to reduce reliance on Chinese tech.
If you are a commercial operator, or fancy becoming one in America, start following the words. You might just need them.
Related
Discover more from sUAS News
Subscribe to get the latest posts sent to your email.
Transport Canada has restricted Autel drones from operating in all controlled airspace in Canada. This means they cannot be flown near airports, populated areas, or other sensitive locations without special permission.
This restriction effectively renders Autel drones unusable for most commercial applications and recreational flights that require controlled airspace access.
What changed? Canada has a list of drones that it says can be used, that list has shrunk in the last week from 642 to 548, it might be more as you read this. The manufacturers that have disappeared have not sent in the required paperwork to stay on the list or proved that their machines meet requirements.
I don’t for a second think that Autel drones would not be compliant. Somebody at Autel might be having a long weekend crossing the i’s and dotting the t’s.
The current approved list is at the link below, more on this story as I wake up and realise what other big brands have gone.
https://tc.canada.ca/en/aviation/drone-safety/learn-rules-you-fly-your-drone/choosing-right-drone
The RPAS Safety Assurance tells you what advanced operations your drone is approved for.
These include flying your drone:
- in controlled airspace
- near or above people
You must operate your drone within the limits outlined in the RPAS Safety Assurance declared by the drone manufacturer. Manufacturers may self-declare to Transport Canada that specific models of drones meet the requirements for advanced operations.
Drones are listed only if they have an RPAS Safety Assurance declaration submitted by their manufacturer. If your drone isn’t listed, the manufacturer may have yet to submit the declaration or the declaration is yet to be reviewed. You’ll be issued a new registration certificate if the declaration is submitted. Contact your drone’s manufacturer to ask if a declaration will be submitted.
Note: RPAS Safety Assurance declarations may be invalidated after being listed below. If you have a registered RPAS that has been invalidated, you will be notified by email that it no longer qualifies for Advanced Operations and you will be issued an updated registration certificate.
Categories of advanced operations:
- Controlled airspace – flying your drone within airspace controlled by air traffic control (Class A-F)
- Near people – flying your drone within 30 metres (100 feet) and 5 metres (16.4 feet) of any person not associated with the operation
- Over people – flying your drone within 5 metres (16.4 feet) or directly over any person not associated with the operation
A bit of an outlier, Florida Senate Bill 44 (2021), is now in force and as such drones made by DJI and Autel are out of bounds for Floridian emergency services.
There is an approved list of companies that Fire, Police and Rescue can use in Florida
- Skydio
- Parrot
- Altavian
- Teal Drones
- Vantage Robotics
The list is small with perhaps only Skydio and Parrot having any sort of ecosystem that might be able to be leveraged by software that public services already use. Altavian, Teal and Vantage were very much focused on the Blue sUAS list in development and military use cases.
DJI were very clever early doors in seeding their drones into American emergency service hands and leveraging them for marketing purposes. By extension they then have embedded real users feeding back requirements to DJI and those users then show colleagues how they used the equipment. I can’t fault DJI’s methods. It cannot be denied that Chinese drones have saved American lives.
Major factors in DJI and Autel’s favour were the ability to walk into high street retailers and replace batteries and established service and replacement departments across America.
This will have generated high expectations of the favoured vendors to match and better, I wonder if they are all up to the job.
]]>