As the United States panics about China’s dominance in the global drone industry, Europe has barely blinked.
In an era of paranoia over data security in which military officers and public officials warn of the reams of sensitive data collected by drones, European governments and militaries are increasingly looking to China, and its premier drone manufacturer DJI, for their needs.
The company insists it has access to “essentially none” of the data its drones produce, and has pushed back hard against allegations of parallels with Huawei, the telecommunications company the U.S. government suspects of spying on behalf of China.
But the value of data being generated — detailed imagery of critical infrastructure, military hardware, frontiers or nuclear sites, for example — coupled with a potential lack of protection from data regulations could make drones a prime target for cyberattacks.
As drone sales skyrocket — the industry is expected to add €10 billion annually to the EU economy — governments stretching from France to Denmark are using commercial off-the-shelf drones made in China for surveillance and inspection purposes.
While U.S. government agencies remain extremely wary in their use of DJI drones, that debate is not being mirrored in Europe.
“There is very little thinking along the lines of, ‘Is this something we should be concerned about?’” said Ulrike Franke, a policy fellow at the European Council of Foreign relations, who focuses on defense policy and technology. “No one is actually concerned,” she said.
Washington’s test
With drones now common use among government departments and militaries to help with search-and-rescue missions, border monitoring or marine patrols, the U.S. has done its utmost to avoid becoming reliant on Chinese technology.
Washington’s Department of the Interior — the agency responsible for managing government lands and natural resources — until July refused to employ DJI drones because they “did not meet UAS [unmanned aerial systems] data management assurance standards.” But the problem became a lack of alternatives: 3D Robotics, the U.S. company contracted instead, stopped making drones in 2016 as it got squeezed out by the competition, and like-for-like replacements are 10 times more expensive.
The U.S. government went back to DJI.
According to an interior department memo, the Chinese drones may now be used but a third party must be present when the software is updated, and the agency will “limit the use of approved aircraft to non-sensitive missions that collect publicly releasable data.”
DJI’s Director of Strategic Partnerships Jan Gasparic said the company took six to eight months to work with the U.S. government to ensure it meets its requirements, and is willing to work with the U.S. military as well. “We’re always engaging different stakeholders to develop standards,” he said.
Both the U.S. military and the Department of Homeland Security have so far maintained the ban, only allowing individual waivers on a “case by case” basis, Pentagon spokesman Mike Andrews told POLITICO in an email.
Some experts warn that DJI’s global monopoly — it has 74 percent of the world’s market, according to 2018 estimates — is a real danger. During a hearing this summer in the U.S. Senate on drone security, Harry Wingo, a professor at the National Defense University, said that DJI’s market access in the U.S. “literally gives a Chinese company a view from above of our nation.”
“DJI says American data is safe, but its use of proprietary software networks means how would we know?” said Wingo.
The company responded with a letter to the Senate committee calling the testimony “unsubstantiated speculation” and “inaccurate.”
“DJI drones do not share flight logs, photos or videos unless the drone pilot deliberately chooses to do so,” the company said in the letter. “They do not automatically send flight data to China or anywhere else.”
Eyes in the sky
While DJI told POLITICO it wouldn’t disclose details of contracts with governments, a number of European militaries and law enforcement authorities are confirmed to have agreements with the company.
The French military, which could not be reached for comment, employs commercial off-the-shelf DJI drones for surveillance and inspection purposes. The German navy also uses drones, and a military spokesperson said he was “not aware of any security issues” that have been raised by that drone use.
Conversely, the Dutch ministry of defense said in an email that concerns surrounding Chinese-built drones are “widely known in the Dutch military. For this reason we do not use the mentioned drones in a reconnaissance role.” The Netherlands uses the U.S.-built Raven drone instead, and uses Chinese-made drones “for different communications sections in order to make footage of exercises and deployments.”
A spokesperson for the Danish military confirmed: “A number of DJI drones have been bought for unclassified and non-operational use, such as news-production, inspection of drain-pipes and advertisement in connection to property sales,” adding: “For classified military purposes other systems are acquired.”
But any decision not to buy Chinese has consequences. The Raven, built by company AeroVironment specifically for militaries, costs $260,000. DJI’s Mavic Pro 2, which anyone can buy from Amazon, costs less than $2,000.
The French military used the earlier model of the Mavic Pro in operations in the Sahel, and said the drone “can be launched instantaneously,” noting it has the ability to parse through a wooded area before the military sends people in. The drone “exemplifies the new combat methods brought by micro-drone technology and demonstrates to what extent drones can facilitate operations,” according to the French army magazine Fantassins.
According to the U.S. interior department, U.S.-made alternatives to DJI’s drones “were up to 10 times less capable for the same price, or up to 10 times more costly than similarly capable DJI aircraft.”
While the British military said it does not employ Chinese-built drones, the country’s police forces do — frequently. In a DJI blogpost, a police official for Devon and Cornwall said they mostly use the drones for missing people searches, firearms operations, road traffic collisions, crime scenes and major events (such as football matches or large music festivals) and fire safety.
A police spokesperson told British media in May: “There is a possibility that data is being captured without our knowledge, but within our unit, DJI drones are only used within areas of policing that are considered non-sensitive.”
Vulnerabilities
It’s difficult to prove how vulnerable the data produced by drones actually is, and governments are reticent to detail how exposed they are to danger. The 53-page report from the U.S. interior department did not make public test results from the Pentagon, and it is unclear on what evidence the U.S. military made its decision not to buy Chinese.
In May, a 13-year old hacker known as Cyber Ninja made a live demonstration at a conference in South Africa out of hacking into and controlling a drone. Last year, sensitive data from U.S. military drones was stolen and sold online. DJI itself was exposed to a security flaw that allowed potential hackers to log into DJI consumer accounts without needing a password. The company said it fixed the flaw.
Under Europe’s General Data Protection Regulation, the EU has rules detailing companies’ responsibility to protect private data, but a 2o14 EU study acknowledged information from drones might still be difficult to secure. Drone technology “is not a reliable method of ensuring confidentiality of the data as data security and integrity can be endangered by modes of transmission such as satellites, Wi-Fi, and other broadcast technologies,” it said. As drones proliferate, the risks of misuse increases.
When asked about the protections, a spokesperson for the European Commission said: “It’s up to member states to decide on what drones to buy and to ensure that the data they gather with these drones is secure.”
Under GDPR, companies are allowed to move data outside of the EU under so-called standard contractual clauses, with the approval of the Commission. That means DJI can send data collected by its drones to its offices in China.
Manufacturers argue it is in their interest to protect customer data. “We want our customers to use our products and services,” said Paula Iwaniuk, speaking for the Drone Manufacturers Alliance Europe, of which DJI is a member. “Without solid data protection and cybersecurity standards, that would not be possible.”
For its part, DJI says it is doing everything it can to make sure drones are secure. In June it unveiled a so-called Government Edition product line with enhanced security, to give government agencies “total control over their data,” said Mario Rebello, the company’s vice president and regional manager of North America.
Gasparic, DJI’s strategic director, said the company accesses data only in exceptional cases — if a customer complained that the drone malfunctioned, for example, the company would check to see what happened. As part of its privacy policy, DJI said it can also collect “information about your non-DJI device” that would include IP addresses, hardware or geolocation data, as well as “any photo or video … submitted using DJI products and services.”
“Drones generate very sensitive data and vast amounts of it,” said Arthur Holland Michel, the co-director of the Center for the Study of the Drone, a U.S.-based research institute. “And all data is vulnerable.”
Industry wars
The concerns in the U.S. have left Washington scrambling on alternatives. “The domestic production capability for small unmanned aerial systems is essential to the national defense,” U.S. President Donald Trump is reported to have said in a June 10 memo.
Taking their lead from the president, U.S. software developers in July said they would stop working with Chinese manufacturers.
That could prove lucrative for DJI’s competitors, including companies in Europe: French company Parrot was in May selected by the U.S. Department of Defense to build short-range reconnaissance drones, despite competition from DJI. The French military in June contracted Novadem, another French company, to build 50 drones that weigh 1 kilogram and will be used for surveillance operations.
But it may already be too late, given the effective monopoly DJI has. “DJI drones are just so much more available,” said Holland Michel.
“Our drones are readily available, affordable, and do 80 percent of what they are supposed to do,” said DJI’s Gasparic, adding that they are an automatic fit for the work that public safety agencies need drones to do.
“We want to be a proactive and responsible custodian,” he said.
Source: Politico