DOI/DOE did not ban DJI products, but …
On Friday I wrote a post entitled “Dept. of Interior Bans use of DJI products due to national security concerns.” DOI did not ban anything, but it is a) clear that DJI can collect sensitive information and b) that it is reasonable to assume that the DOI is unlikely to buy any products that have the ability to send telemetry about their sensitive sites to servers in China.
DJI has completely legitimate reasons for wanting to collect telemetry information from as many of its products as possible for sales, marketing, and most importantly, product support and development reasons. I agree with and support this desire.
Lest you think that DJI does not collect such data, the following is from a DJI legal document that a user must sign to unlock geofences:
The Recipient further understands and agrees that his data including, but not limited to, flight telemetry data and operation records could be uploaded to and maintained on a DJI-designated server under certain circumstances.
Can we agree that DJI would not include such language if they didn’t have the ability to collect the data?
When you choose to self-authorize or “unlock” flight operations on DJI hardware control applications (including DJI Go (the “DJI Go App”)) in locations that are categorized by DJI’s Geospatial Environment Online system as raising safety or security issues, we collect and retain geolocation information relating to your decision.
The two documents appear to be out of sync on what is, or may be, collected. I think it is time for some forensic analysis.
As I mentioned in the earlier post, DJI could add an “opt in” mechanism as many other products do and also fully document what is collected and when. Relatively easy to do, and would set a very good example.
DOE and corporate
DOE, and private companies, have completely legitimate reasons for not wanting telemetry information, particularly around sensitive areas, sent to servers in China owned by a Chinese corporation. China, and many other countries, uses commercial data as part of its intelligence programs. Why hand them such data on a platter?
A partially redacted email message appeared on Twitter supposedly refuting the email message from Dennis Bosak SSA. Here is that message:
So, “banned” was not the correct word. DOI does not ban products.
Please note – in a letter specifically addressing my original post the author ignores the two most important issues – do DJI products collect and send telemetry to China, and is the DOI concerned about the cyber security implications of such practices. The author is strangely silent on these points.
I think it is safe to assume that DOI will not buy products that send potentially sensitive data to servers in China.
If DJI wants to sell to DOI, and other government agencies, they will need to address this issue. Further, they must address this issue for everyone because commercial users certainly would prefer that information about their sensitive sites isn’t shared with potential competitors and intelligence agencies.
DOI didn’t ban DJI products. DJI does have the ability to collect information you might not want to share with them or with intelligence services. This is not unique to DJI by any means and many other firms face similar challenges. Addressing them in the design phase is more expensive up front but in the long run saves money on development, legal, PR, and sales. Bake security into the products, don’t bolt it on later when you have an issue.
In this case, if you want to collect sensitive information, do so via in country servers with appropriate legal protection for the owners of the data. And don’t argue semantics while avoiding the tough questions about cyber security.
For some additional thoughtful insight on the matter, I refer you to Christopher Korody’s reporting on the matter. Very much worth reading, in this specific instance but on UAV matters for many years.