Senators alarmed over potential Chinese drone spy threat

Hundreds of Chinese-manufactured drones have been detected in restricted airspace over Washington, D.C., in recent months, a trend that national security agencies fear could become a new means for foreign espionage.

The recreational drones made by Chinese company DJI, which are designed with “geofencing” restrictions to keep them out of sensitive locations, are being manipulated by users with simple workarounds to fly over no-go zones around the nation’s capital.

Federal officials and drone industry experts have delivered classified briefings to the Senate Homeland Security, Commerce and Intelligence committees on the development, three people privy to the meetings said. A spokesperson for the Intelligence Committee — which has been kept closely apprised of the counterintelligence risks — declined to comment on the briefings. The other two committees did not respond.

This story is based on interviews with seven government officials, lawmakers, congressional staffers and contractors. They were granted anonymity because they are not authorized to speak publicly about private and sometimes classified discussions involving government officials.

The officials say they do not believe the swarms are directed by the Chinese government. Yet the violations by users mark a new turn in the proliferation of relatively cheap but increasingly sophisticated drones that can be used for recreation and commerce. They also come as Congress debates extending current federal authorities and adopting new ones to track the aerial vehicles as potential security threats.

“This is part of a trend of commercial drones for potentially nefarious reasons,” said Rachel Stohl, vice president of research programs at the Stimson Center think tank who closely tracks the global drone market. “We’re seeing in conflict zones, in other theaters, the reliance and use of commercial drones.”

“These may be just innocent data collection — or really just looking around, seeing what’s happening — and not in a systemized way,” she added. “But the potential, of course, is that eventually they could be more dangerous.”

It’s unclear what, if anything, Congress is likely to do to address the threat. Several pieces of legislation have been introduced, but most have not made it past the committee level. In addition, what limited authority exists for non-defense federal agencies to use counter-drone technology will soon expire unless lawmakers move to extend it. It’s currently carried on the continuing resolution that funds the federal government expiring Dec. 16.

And while officials believe Beijing is not overseeing the swarms, DJI has secured funding from investment entities owned by the Chinese government — a fact that DJI reportedly sought to conceal. And the ease with which recreational users can evade the flight restrictions means that their high-definition cameras or other sensors could also be hacked into for intelligence-gathering.

“Any technological product with origins in China or Chinese companies holds a real risk and potential of vulnerability that can be exploited both now and in a time of conflict,” Sen. Marco Rubio, vice chair of the Intelligence Committee, said in an interview about the potential threats posed by foreign-made drones. “They’re manufactured in China or manufactured by a Chinese company, but they’ll put a sticker on it of some non-Chinese company that repackages it so you don’t even know that you’re buying it.

“But anything that’s technological has the capability of having embedded, in the software or in the actual hardware, vulnerabilities that can be exploited at any given moment,” added Rubio (R-Fla.).

DJI maintains that it has no control over what customers do once they purchase its products.

“Unfortunately, while DJI puts everything in place to identify and notify our customers about areas in which they can't fly, we can’t control the end users’ behavior,” said Arianne Burrell, communications manager for DJI Technology, Inc.

“But we do everything from our end to ensure that they do follow the regulations that are set out by their localities,” she added.

‘Hacked or manipulated’ 

Chinese drone maker DJI is the world’s largest manufacturer of personal and professional drones and its products account for the majority of recreational drones in the United States.

Government and outside security experts have expressed concerns about potential Chinese government ties to the drone maker. The Pentagon banned the purchase of Chinese-made drones in 2017 and the Interior Department, which has the largest civilian drone fleet in the federal government, has banned their use except in emergencies. But thousands of federal, state and local law enforcement agencies still heavily rely on DJI drones, according to a 2020 study.

The study showed that public safety agencies in California, Texas, Illinois, Wisconsin and Florida have the greatest number of drones, the majority of which are DJI models.

All commercial drones, which use GPS for navigation, are designed so that they cannot operate within D.C.’s restricted airspace and come with instructions for users about the need to follow all such local regulations. But those restrictions can easily be bypassed.

“There’s Youtube videos that could walk your grandparents through how to update the software on one of these drones to be non-detectable and to do a whole lot of other things — get rid of elevation ceilings, all kinds of stuff,” said a government contractor who has helped to collect the data for federal authorities. “If you were to go buy a DJI drone at the store, it wouldn’t fly over airports or specific cities because of a specific no-fly zone. So, anything that we see in DC that is a DJI-manufactured product has been hacked or manipulated to enable flight in these zones.”

The frequent violation of those regulations could offer an intelligence boon for malicious actors.

The contractor described the potential threat as akin to “an eight-year-old kid or an unsuspecting adult who got a DJI for Christmas and is unwittingly collecting data for somebody who could become a serious adversary.”

“A more sophisticated user can use a drone for industrial espionage or cyber-attacks. One could land a drone on your house and start capturing all the wireless information that's being broadcast out of your home,” the contractor added. “Similarly, one could do that on a federal building, a power grid or other critical infrastructure. And the reality is, people on the tech side always said, ‘look, at any point in time the Chinese can take control of a DJI that’s flying in the air.”

The U.S. government has accused DJI of having financial ties to the Chinese government and public records list Beijing-backed individuals among its investors. The Pentagon cited such links when blacklisting DJI drones.

Burrell denied any financial ties to the Chinese government. “We are a private company. We don’t take any money from the Chinese government,” she said.

Burrell also said the company remains committed to following all U.S. laws and regulations. “DJI is active in ensuring that we should be at the forefront of regulations that are coming out about the drone industry,” she said, “because we’re really passionate about flight safety.”

The Federal Aviation Administration says more than 870,000 drones are registered in the United States — three times the number of piloted aircraft.

And it estimates that 2.3 million unmanned aerial systems — about 1.5 million recreational drones and model aircraft and 800,000 commercial drones — will be registered to fly in the United States by 2024.

Users are increasingly flying drones where they are not supposed to.

In July, Samantha Vinograd, acting assistant secretary of Homeland Security, told the Senate Homeland Security and Governmental Affairs Committee that since 2018, the U.S. Secret Service has encountered “hundreds of drones” violating temporary flight restrictions meant to protect the president.

Vinograd also warned that commercially available drones can “be used by hostile foreign intelligence agencies or criminals to collect intelligence and enable espionage, steal sensitive technology and intellectual property, and conduct cyber-attacks against wireless devices or networks.”

“The potential implications can be significant for sensitive U.S. facilities, the defense industrial base, technology firms, and others,” she added.

‘Most secure airspace in the world’

The appearance of so many Chinese-made drones in protected airspace over Washington presents a new challenge.

The data recently shared with Congress highlights more than 100 incursions in a recent 45-day period but the sources requested that specific numbers, locations and frequency not be published for security reasons.

Still, that’s far more than has been publicly acknowledged, such as an intrusion this summer that briefly halted flights into Ronald Reagan Washington National Airport.

“There are a lot more drones flying in our airspace than you would expect,” the contractor said.

But it’s not simply the number of drones, which are also commonly reported in even higher numbers in metropolitan or recreational areas around the country.

“You’ll see hundreds of them over that same time period but the biggest difference is obviously the national capital region is the most secure air space in the world,” the contractor said.

The Special Flight Rules Area around D.C. is a roughly 55-mile ring that begins at Reagan National, according to the FAA. Drone operators must obtain waivers from the FAA to fly inside the area.

The FAA maintains it is taking additional steps to detect drones and ensure they do not interfere with commercial aircraft or pose other safety hazards.

It adopted a “remote identification rule” last year that requires drones to be identifiable with a “digital license plate” that will help law enforcement agencies “find the control station when a drone appears to be flying in an unsafe manner or where it is not allowed to fly,” the FAA said.

The FAA is also testing new technologies around airports to better detect drones that might pose safety risks.

The FAA, asked specifically about the rise in drone activity over sensitive federal buildings, said that while it is responsible for managing the restricted airspace over D.C., it does not have the role of defending it. It deferred those questions to the Secret Service.

“Due to the need to maintain operational security, the U.S. Secret Service does not comment on the means, methods or resources used to conduct our protective operations,” a Secret Service spokesperson said.

Congressional concern

The drone activity over D.C. has unnerved members of Congress with oversight of national security and aviation.

“Everybody is very concerned and trying to figure out what to do,” said the contractor.

Rubio introduced legislation in February to add DJI to a Federal Communications Commission list designating it as a national security threat. The designation would restrict DJI drones’ ability to link to U.S. telecommunications systems, though it hasn’t gone anywhere yet in Congress.

He proposed the measure after it was reported that the company sought to conceal its funding by the Chinese government. Partnering with Democrats, Rubio has also sought to prohibit U.S. government entities from using federal funds to purchase Chinese-made drones. That legislation has also stalled out.

Sen. Gary Peters (D-Mich.), who chairs the Homeland Security and Governmental Affairs Committee, led a bipartisan bloc in July in introducing legislation that would expand the authorities of the Departments of Homeland Security and Justice, as well as state and local law enforcement, to detect and counter drones that present a potential security threat.

The bill also calls for creating a database of “security-related” incidents involving unmanned aerial systems inside the U.S.

Some of the provisions have sparked concerns among privacy groups, which worry that a nationwide drone tracking system could infringe upon First Amendment rights.

The American Civil Liberties Union for example, has argued that "such a system threatens to erase any possibility of anonymous operation of drones so that, for example, an activist wishing to record corporate malfeasance or police actions at a protest might be targeted after the fact, or chilled before it.”

But even some of the federal government’s current authorities to counter drones are set to expire next month and the Biden administration is urging Congress to quickly restore them.

“We have located hundreds of drones that have been acting in violation of federal law each time, and as the threat continues to grow, we’re investigating even as we speak several incidents, even within the U.S., of attempts to weaponize drones with homemade [improvised explosive devices],” FBI Director Christopher Wray told Peters’ committee on Nov. 17.

“That is the future that is here now, and this authority desperately needs to be reauthorized.”