- Leading drone makers deny accessing data without permission
- DHS, FAA officials say terms of service threaten sensitive videos
Drone manufacturers may be scooping up sensitive videos of crime scenes, electric grids, and other critical infrastructure under terms of service that give them access to the data, Department of Homeland Security and Federal Aviation Administration officials say.
More than a million unmanned aircraft systems (UAS) have taken to the sky in the U.S. in recent years, with many flown by first responders and companies inspecting bridges, railways, and utilities. Some of the manufacturers’ terms of service give them access to video and data collected by drones, posing a privacy and security risk for users that would otherwise lock down access to that data, the officials said.
“Some of those terms of agreement, you essentially can’t operate the UAS unless you enable that manufacturer to basically share, capture, transmit, and store your data anywhere they’d like to,” Angela Stubblefield, deputy associate administrator for security with the FAA, said on the Oct. 18 panel held by CyberScoop media group.
For their part, industry representatives said they don’t know what prompted the government officials’ concerns.
The Chinese company SZ DJI Technology Co. responded that it doesn’t access user data without permission. The manufacturer commands at least 70 percent of the U.S. market for non-hobbyist drones, according to a November 2017 study by the Bard College Center for the Study of the Drone that relies on FAA drone registration data.
“DJI customers have complete control over whether to share any of the data they generate during their flights, and DJI provides customers the tools they need to ensure the integrity of their data,” company spokesman Adam Lisberg told Bloomberg Government in an email.
Threats to Law Enforcement
Stephen “Herbie” Hancock, first responders group director at the DHS Science and Technology Office, said at the CyberScoop event that the threat is greater for smaller police forces, for example, that don’t have the resources of larger cities to purchase more expensive drones with tighter privacy policies.
“The local Mayberry R.F.D. guy can’t afford that,” Hancock said on the panel. “He’s buying the $1,000 drone system, the $2,000 drone system.”
Neither Stubblefield nor Hancock specified which manufacturers had sparked their concerns. A DHS official did not respond to an emailed request for further comment. An FAA spokesperson declined to comment on the source of concerns.
“The U.S. government, which also uses commercial UAS, is also closely examining these issues and engaging with other government and industry partners on best practices for data protection,” the FAA spokesperson told Bloomberg Government in an email.
Hancock said DHS is working with the FAA and local law enforcement agencies to change laws and regulations to ensure data from drones is protected for their needs.
Chinese Spying Fears
In April, DJI published an independent analysis of its data security practices in response to media reports alleging U.S. Immigration and Customs Enforcement was concerned the company was sending critical infrastructure and law enforcement data to the Chinese government. The DJI report said “users have control over the types of data DJI drones collect, store, and transmit.”
ICE officials did not immediately respond to email and phone requests for comment.
U.S. Army spokeswoman Maria Njoku said the branch currently bans DJI products because of “security concerns,” but that commercial industry improvements to bolster cybersecurity “are always welcomed and encouraged.”
A congressional aide from a committee with jurisdiction over drones suggested the flags raised at the Oct. 18 panel were a continuation of these concerns.
Intel Corp.also told Bloomberg Government in an email the company, which manufactures the Falcon 8+ drone, does not have access to captured data.
Other drone companies with top-selling models in the U.S. over the past several years, such as 3DR, Yuneec International Co., and GoPro Inc., did not immediately respond to emailed requests for comment. A spokesperson from Parrot SA said the French company follows “extremely strict” EU privacy policies. A spokesperson from Autel Robotics Co. said owners have the right to block the company’s access to data.
A spokesperson from industry trade group Association for Unmanned Vehicle Systems International said its drone members set their own terms of agreement, and declined to give further details.
Shaun Courtney in Washington also contributed to this story.
To contact the reporter on this story: Michaela Ross in Washington at firstname.lastname@example.org