- DJI's latest enterprise drones have a robust security suite to keep sensitive data safe and secure;
- Features include Network Security Mode, including Local Data Mode which enables a user's device to be operated completely offline;
- Other security measures include AES-256 video transmission encryption and one-tap clear all device data;
- This blog explores these data security features, explaining how to activate them and how they protect drone data;
- DJI says it builds privacy protections into its systems and gives users control over their data: Read DJI's statement and excerpts from third-party cybersecurity examinations which validate DJI data security.
Data security is a crucial consideration for enterprise drone operators, considering the unique role that UAS play as a data capture tool.
DJI's latest commercial drones are bolstered with a comprehensive suite of features to ensure users have control over the data they generate and that sensitive information is protected from hijackers.
As such, operators of the M30 Series, M300 RTK, and Mavic 3 Enterprise Series can utilise this robust architecture to secure their data.
These features include:
- Network Security Mode, including Local Data Mode
- One-tap Clear All Device Data
- AES-256 Video Transmission Encryption
- Cloud API
- SD Card AES Encryption
This blog explores these features, including how they are activated and how they improve the security and integrity of sensitive data.
As part of this, DJI continues to reiterate that its systems are safe and secure, the data security of its products is reviewed repeatedly, and has been independently verified. Read DJI's statement about drone data security at the bottom of this article.
Keeping User Data Safe: Network Security Mode
DJI says it will not access any user data unless given permission to do so.
Operators can grant or revoke permissions at anytime through Network Security Mode, found within the DJI Pilot ecosystem and accessed via the remote controller.
Permissions that can be activated or deactivated include access to device information; flight records; device logs; and whether DJI can share device location with third-party map service providers in order to display your location on the map.
There are three modes to choose from within Network Security Mode, offering different levels of customisation and permissions. These modes are:
1: Standard Mode
DJI Pilot will connect to the internet and work normally. The features and functions within Standard Mode can be turned on or off.
2: Restricted Network Mode
To protect operator data, many of DJI Pilot's features and functions are disabled and cannot be activated, with the exception of Map Service, Network RTK, and Third-party Cloud Services, which can be enabled or disabled.
If operators want to use a map without activating Map Service in Restricted Network Mode, they can use the MapTiler offline map to continue with a mapping service. This will prevent information being sent to third-party map service providers.
MapTiler's HQ is in Switzerland. Its maps contain no spy code, and IP addresses of MapTiler Cloud visitors are stored in memory only for a limited time needed for security checks; a maximum is 20 minutes, and then automatically destroyed. For more details, click here.
DJI has also used American-based Mapbox for this extra-secure method of accessing maps.
Other apps on a smartphone or tablet are not affected by the use of Restricted Network Mode.
3: Local Data Mode
Local Data Mode provides government and commercial customers with additional assurance that data generated during drone operations is effectively protected.
It is an internet connection 'kill switch' feature within DJI’s command and control mobile applications that, when enabled, prevents the app from sending or receiving any data over the internet.
The app will close all data services and will not send any network requests to protect data. The features and functions within this mode will be disabled, with no option to enable them.
Local Data Mode enables a user's device to be operated completely offline. In this case, there is no requirement for users to log into their DJI account.
With Local Data Mode activated, drone operators can easily and effectively cut off all network connections from DJI’s mobile applications and prevent any data from being transferred to DJI or other parties.
Turning on Local Data Mode - which is similar to Airplane Mode on smartphones and other mobile devices - should help to assure drone operators that all data remains local and entirely within their control.
To use maps in Local Data Mode, first download the map in Standard Mode, and then switch to Local Data Mode.
Please note that Local Data Mode is available in the DJI Pilot, DJI GO4 or DJI Fly control apps to provide enhanced data privacy assurance when flying sensitive missions.
Network Security Mode: Features In More Detail
The table below highlights the purpose of each Network Security Mode feature and how these are impacted by switching between Standard Mode, Restricted Network Mode, and Local Data Mode.
| Feature | Purpose | Standard Mode | Restricted Network Mode | Local Data Mode |
| Map Service | Displays the location of your mobile device and DJI devices on the map in real-time while your aircraft is in flight. Enabling Map Service allows third-party map service providers to access the location information of your mobile device and DJI devices. |
Toggle on or off | Toggle on or off | Off |
| Network RTK | Provides RTK data to your DJI devices from a third-party RTK service provider. Network RTK helps you use your DJI devices with high-accuracy positioning data. Third-party RTK service providers will gain access to your devices' location information only when you are using Network RTK service. Your DJI devices' location information will be used for requesting data from nearby RTK base stations. |
Toggle on or off | Toggle on or off | Off |
| Third-party Cloud Services | Supports GB28181 protocol, RTMP, RTSP and DJI IoT API. Only when you choose Third-party Cloud Services will DJI Pilot sync DJI device serial numbers, GPS location information, flight speed, real-time image transmission, aircraft attitude, camera attitude, sensor data, and livestream protocol to DJI servers in accordance with livestream protocol. |
Toggle on or off | Toggle on or off | Off |
| Device Update | Includes checking for updates and downloading update packages for your DJI devices and DJI apps. Keeping your DJI devices and apps updated helps ensure optimal user experience. Enabling Device Update allows DJI Pilot to sync the following information for checking updates and downloading update packages: Account information, DJI devices firmware versions, and DJI apps versions. |
Toggle on or off | Off | Off |
| Sync Logs | A convenient tool for uploading DJI device logs. DJI Pilot will sync your account information and DJI device logs to DJI servers only when you choose to upload them. The logs contain various DJI device status information, including, but not limited to, the DJI device serial number, flight trajectory, flight speed, and sensor data. This information will only be used to help DJI Support locate issues with the device. |
Toggle on or off | Off | Off |
| Sync Flight Records | A convenient tool for syncing DJI device flight records. DJI Pilot will sync your account information, DJI device serial numbers, location information, flight trajectory, flight speed, and sensor data to DJI servers only when you choose to update them. |
Toggle on or off | Off | Off |
| FlightHub 2 Cloud Platform | Only after DJI Pilot users log in to FlightHub 2 will Pilot sync data such as account, device, GPS location, aircraft speed and attitude, and real-time image transmission data to FlightHub 2. Sharing data with team members through FlightHub 2 can increase team efficiency. |
Toggle on or off | Off | Off |
| DJI Product Improvement Project | DJI would like you help to improve the quality and performance of its products by collecting and sending device diagnostics and usage data. No DJI account details or personal information will be collected for this purpose. |
Toggle on or off | Off | Off |
| Fly Safe |
Includes update checks and downloads for the Precise Fly Safe Database and unlocking licence synchronisation.
Enabling Fly Safe allows DJI Pilot to sync your DJI device information, the Precise Fly Safe Database version information, and GPS fuzzy location information to DJI servers for checking for and downloading updates and for updating temporary geo-zone data. |
Toggle on or off | Off | Off |
Network Security Mode: Enabling And Disabling Features
The below screen shots show how this plays out within DJI Pilot 2 - the most recent DJI Pilot app.
For instance, the next set of images show Network Security Mode's Map Service and Network RTK features, and how Standard Mode, Restricted Network Mode, and Local Data Mode impact their usability.
In Standard Mode, users can choose to enable or disable Map Service and Network RTK...
...which is also the same in Restricted Network Mode...
...but in Local Data Mode, Map Service and Network RTK are off by default and there is no option to activate them.
This next set of images shows how other features within Network Security Mode - in this case, Device Update - can continue to be switched on and off in Standard Mode...
...but are now deactivated, with no option to activate, in Restricted Network Mode...
...as well as in Local Data Mode.
How To Access Network Security Mode
So, how do you choose your preferred Network Security Mode settings?
Again, taking DJI Pilot 2 as the example, click on the shield at the top left of the screen on the remote controller...
...to bring up this menu within the Data and Privacy section. Click on the Standard Mode box on the right to activate a drop down to choose between this mode, Restricted Network Mode and Local Data Mode.
AES-256 Video Transmission Encryption For Enhanced Security
Data transmitted between the drone and the remote controller on the ground is protected by the AES-256 encryption algorithm.
The communication between the DJI Pilot app and the server is also protected by HTTPS or WebSockets over SSL/TLS (WSS) protocol to prevent hijacking by third-parties and protect against man-in-the-middle attacks.
How AES-256 Encryption Works To Protect Your DJI Drone Data
AES encryption has become the industry standard for data security. AES comes in 128-bit, 192-bit, and 256-bit implementations, with AES-256 being the most secure.
The three types of AES also vary by the number of rounds of encryption. AES-128 uses 10 rounds, AES-192 uses 12 rounds, and AES-256 uses 14 rounds. The more rounds there are, the safer the encryption.
This is why AES-256 - which is utilised by DJI - is considered the safest encryption there is.
AES-256 encryption protects the OcuSync communication system (used in DJI drones), as well as DJI's 4G LTE communication (on drones such as the DJI M300 RTK) which protects users against near-field and remote communication hijacking, man-in-the-middle attacks, and communication encryption.
SD Card Encryption - Secure Device Media Storage
Setting a security code helps to ensure the secure use of media files. This can be done via the Data and Privacy page on the remote controller within the Pilot app.
When the password function is enabled, data stored in the SD card or onboard storage can be accessed only after the user-defined password is provided.
The security code will be required when accessing content on the SD card via DJI Pilot and DJI Pilot 2.
It is interesting to note the following:
- Security code is neither saved on device nor accessible by DJI. This means that the password cannot be retrieved if it is forgotten by the user.
- It is not possible to reset security code. If security code is lost, format the memory card for reuse.
- Memory card will be formatted if security code is disabled.
Security code settings are only available for Zenmuse H20 series, Matrice M30, and Mavic 3 Enterprise Series cameras. Other cameras, such as Zenmuse L1 and P1, as well as third-party payloads, are currently not supported.
Erasable Data - One-tap Clear All Device Data
Users can choose to erase any data generated during their use of DJI devices. To erase your data, go to the DJI Pilot or DJI Pilot 2 app to clear the logs and cache on your device and the app.
Press the Clear All Device Data button via the Clear DJI Device Log tab.
This resets the remote controller operating system and will clear flight records, brief flight records, app logs, and local media data, flight route files, and other data.
The cache can be removed by pressing the DJI Pilot Cache tab.
If you decide not to use DJI’s services anymore, email support@dji.com to ask DJI to delete all the data associated with your account.
Cloud Data Storage Security
DJI's data centres are built on Amazon Web Services (AWS) and Alibaba Cloud. Alibaba Cloud is used only for customers in Mainland China. Amazon Web Services is used for all other regions.
Both are known for their security qualification and high reliability. AWS has certification for compliance with ISO 27001/27017/27018, and Alibaba Cloud has certification for compliance with ISO 27001, CSA STAR certification, and SOC (Service Organisational Control) independent audits.
Amazon Web Services describes itself as the most secure cloud computing environment available today and a network architected to protect information, identities, applications, and devices. For more details about AWS, visit the official website.
DJI users are not required to store any data with DJI. If they choose to do so, their data is kept in DJI's data centres which are equipped with a multi-layer protection mechanism.
DJI says that it will not transmit users' personal information or data across data centres or share any data with third parties. Sensitive information, such as email addresses, mobile numbers, and location information, is given additional AES-256-CBC encryption.
Cloud API
The launch of the Cloud API mainly solves the problem of developers reinventing the wheel.
For developers who do not need in-depth customisation of the app, they can directly use DJI Pilot 2 to communicate with the third-party cloud platform, and developers can focus on the development and implementation of cloud service interfaces.
Based on the common standard protocols such as MQTT, HTTPS and Websocket, DJI Cloud API abstracts the function set sufficiently and isolates the complex hardware operations logic in the drone, and makes it possible for DJI's developers to focus on their own business without caring about the underlying flight logic.
What's more, DJI Cloud API can adapt to any network as long as the DJI Pilot 2 or DJI Dock is allowed to access the third-party platform server.
DJI Drones Device Data Security
DJI drones have robust device data security.
Data is generated, processed, and stored during the use of the drone.
The specific data types and detailed descriptions are as follows:
| Data Type | Description | Storage Location | Usage |
| Flight Log | Sensor data, GPS information, and user control data during flight. |
Onboard storage | User can export flight logs through DJI Assistant 2, and the flight logs will be encrypted by the export process on the drone. |
| Live Flight Status | Environmental information and real-time information of the drone during flight, such as current altitude, latitude and longitude, power voltage, etc., and does not contain any user information. |
Not stored | Live flight statuses transmitted to the app are encrypted by the drone when the drone is in operation. |
| Device Log | Device log is generated during the operation of the drone to locate and solve a system bug | Onboard storage | User can export device logs through DJI Assistant 2, and the device logs will be encrypted by the export process on the drone. |
| Media Data (onboard) | Photos or videos taken by the user | Onboard storage | If device password protection is enabled, a password is required to access onboard media data. |
| Media Data (SD card or SSD) | Photos or videos taken by the user | SD or SSD | User accesses media data via physical connection only (i.e., card reader). If SD card media data encryption is enabled, a PC tool called “DJI Decrypt Tools” can be used to enter password and decrypt the data. |
| Update Package | Drone system firmware | Onboard storage | The firmware is encrypted and signed by DJI and transmitted to the drone via the app or DJI Assistant 2. |
DJI SDK Security
DJI produces several SDKs including Mobile SDK, UX SDK, Onboard SDK, and Payload SDK.
DJI Mobile SDK
By using the Mobile SDK (MSDK), developers can build iOS and Android applications that interface wirelessly with drones. The MSDK creates a customised mobile app to unlock the potential of the aerial platform that helps realise developers’ innovations.
When developers use DJI MSDK to develop applications, or users use applications developed by DJI MSDK, the following functions will trigger network interactions:
| Function | Description | Optional |
| SDK Registration and Activation |
When developing an app via the MSDK for the first time, or when the user runs an app developed by the MSDK for the first time, the MSDK will connect to a DJI server for activation. | No |
| Firmware Update Check | When the user connects a device with an app developed by the MSDK, the latest firmware information will be pulled by the MSDK from the server and the user will be promoted to update. |
No |
| Geo Zone Database Update | When the user connects a device with an app developed by the MSDK, the latest Geo Zone database will be pulled by the MSDK from the server to help flying in accordance with local laws and regulations. |
No |
| Country Code | The current user’s country code will be obtained. This information will mainly be used to set up the remote controller’s frequency band. |
No |
| User Experience Information | When the user uses an app developed by the MSDK, the MSDK will record API calling status to optimise and improve functionality. Recorded statistics only include API calling status and do not contain any personal information. If the user turns off user experience information in the privacy settings of the app, then this data will not be uploaded. | Yes |
| DJI FlightHub | (Optional) When the developer calls the DJI FlightHub related API in the MSDK, communication with the DJI FlightHub server will be established. |
Yes |
| DJI User Centre | (Optional) When the developer calls the DJI User Centre related API in the MSDK, communication with the DJI User Center server will be established. |
Yes |
| Third-Party Network RTK Service |
(Optional) When the developer calls the API in the MSDK that interacts with a third-party network RTK service, communication with the third-party network RTK service will be established. |
Yes |
Considering some agencies require high standards for privacy, Local Data Mode (LDM) is provided by DJI MSDK. Developers can equip apps with LDM mode.
When LDM mode is enabled, network links will be cut off. Please note, for both normal apps and LDM-equipped apps, users must complete the SDK registration and activation when using the app for the first time.
Activation only needs to be completed when using the app for the first time. For LDM-equipped apps, after the activation is completed, users can enable the LDM to cut off all network links.
DJI Onboard SDK
DJI Onboard SDK (OSDK) helps to build automated drone applications for supported DJI enterprise grade aerial devices as well as the A3 and N3 Flight
controllers.
When developing applications based on the OSDK, developers need to apply for an ID and its corresponding key on the DJI Developer Website.
Every time users use the applications developed by the OSDK, they need to enter the ID and the key applied by the developer for activation. A network connection is required when activating for the first time. After successful activation, the flight control module will record the ID and subsequent activation can be performed offline until the ID is erased by the flight control module.
When using the flight control API through the OSDK, relevant flight commands and flight statuses will be recorded by the flight log.
During the activation process, the flight control module will also record the user ID into the flight log. The user can actively export the flight log by DJI Assistant 2, and the exported flight log will be encrypted.
Part of the DJI OSDK code uses open source. Refer to the following links:
- github.com/dji-sdk/Onboard-SDK
- github.com/dji-sdk/Onboard-SDK-ROS
- github.com/dji-sdk/Onboard-SDK-Resources
DJI Payload SDK
DJI Payload SDK (PSDK) is an SDK type that enables third-party manufacturers to develop application-specified payloads that seamlessly integrate with DJI flight platforms.
Developers need to register a DJI PSDK enterprise account first, which is used to bind the application developed by DJI PSDK with the DJI SKYPORT adapter.
After the binding is completed and the third-party payload is connected, communication between the payload and the aircraft will be transmitted through the adapter.
A log is automatically generated during the use of the PSDK, mainly recording commands and errors related to PSDK functions. The log does not include user data, and can be exported by users according to their needs, while not being uploaded automatically.
A log is automatically generated during the use of SKYPORT, mainly recording information such as CPU usage, interface bandwidth, device type, power supply voltage, and activation status.
Users can manually export logs according to their own needs while not be uploading automatically.
During the use of PSDK, the following functions may trigger network interaction:
| Function | Description | Optional |
| PSDK binding with SKYPORT | When developers develop an app via the PSDK, the app needs to be bound with DJI SKYPORT. During the process, the SKYPORT adapter will verify information such as user account, product name, and product ID with the server through the MSDK. | No |
| PSDK unbinding with SKYPORT | PSDK applications can also be unbound from DJI SKYPORT. During the process, the SKYPORT adapter will also verify information such as user account, product name, and product ID with server through the MSDK. | No |
| User experience data | This data mainly records the usage time of each PSDK function, version information, developer information, GNSS location information after reducing accuracy (reduce accuracy to a 10 km radius), etc. Users can turn off the authorisation of user experience data upload in the Privacy Settings tab in the app or DJI Assistant 2. | Yes |
DJI UX SDK
DJI UX SDK provides UI elements for all core functions, which enables developers to build mobile applications swiftly with no additional lines of code.
Since the major function of UX SDK is to provide UI elements, internet connection is unnecessary during the use of UX SDK.
However, when using the DJI Map Kit, users can embed a third-party map widget, which can trigger an internet connection with the third-party map during use.
UX SDK is an open source project. Users can download relevant source code from DJI Developer Website or DJI SDK official GitHub.
DJI Statement On Drone Data Security Concerns
These features show how DJI take data security seriously and enable users to keep their sensitive data safe.
And in a comprehensive statement, DJI issued its approach to data security.
It reads:
'DJI builds privacy protections into its systems and gives all users control over how their drone data is collected, stored, and transmitted.
'Flight logs, photos, and videos taken during drone use are never automatically transmitted to DJI or anywhere else, and users always control whether to share that data with anyone.
'Operators can also take additional steps to ensure the security of the data collected by their drones.
'For example, DJI drones can be operated without an internet connection, providing a simple, effective, and easily verifiable way to guarantee that no drone data is sent anywhere – even inadvertently.
'It is important to note that enterprise customers don’t have to use DJI software because we are not in the data collection business. We are providing hardware and are not profiting from user data.
'If an agency prefers the security configurations and features of drone software developed by other companies around the world, they can choose from dozens of third-party options. DJI serves to build a better world by continuously promoting human advancement - safely and securely.
'For the above reasons, DJI products are safe and secure when flying even the most sensitive missions.'
DJI Solutions 'Trusted Around The World'
DJI says that, by February 2023, there are more than 750 public safety entities, which includes national, regional, and local police forces in Europe alone, as well as fire departments and search and rescue organisations, which use and trust DJI drones.
DJI's data security statement continues:
'Governments and businesses around the world trust and use our products because they keep their data safe.
'A wide range of independent security validations, from government agencies as well as private cybersecurity firms, have confirmed that DJI products are built with robust safeguards for data integrity.
'We are aware of critics and competitors who have claimed otherwise; simply put, their claims are false.
'We are also aware of various claims made over the years by cybersecurity researchers who have found vulnerabilities in our products, as happens with all software from all manufacturers. DJI has addressed this challenge forthrightly, and led its competitors by developing the first Bug Bounty Program in the drone industry.
'To date, DJI has paid more than $100,000 to more than 100 researchers who have responsibly identified vulnerabilities so we could fix them.
'The data security of DJI products has been reviewed repeatedly, and the fundamental strength of their security architecture remains unchallenged.
'The fact that drone users in government and critical industries continue relying on DJI illustrates that when our products are evaluated on a factual and technical basis, not headlines or innuendo, their utility and security remains unmatched.'
Excerpts From Third-Party Cybersecurity Examinations Of DJI Drone Products
In the statement, DJI mentions that independent security validations have confirmed that DJI products are built with robust safeguards for data integrity.
Some of the findings are below:
2022: US Department of Commerce
Key Quote: 'Products which use a cryptographic module identified below may be labelled as complying with the requirements of FIPS 140-2.'
Further Reading: DJI Achieves Encryption Recognition from U.S Department of Commerce
2020: FTI Consulting
Key Quote: 'No data that was generated by the application was sent externally to infrastructure operated by any third party, including DJI.'
Further Reading: FTI Consulting, DJI Cybersecurity Assessment, Executive Summary
2020: Booz Allen Hamilton
Key Quote: 'This security-focused testing did not identify data connections made by the drone platforms to DJI or Chinese servers.'
Further Reading: DJI Cybersecurity Risk Assessment Final Report - Executive Summary
2019: Idaho National Laboratory (for the US Department of Homeland Security)
Key Quote: 'There are no major areas of concern related to data leakage'.
Further Reading: Aviation Cyber Initiative Unmanned Aircraft System Information Security Risks Limited Scope Test and Evaluation
DJI Security Features: Summary
DJI drones are a great data collection tool, but it is crucial that operators feel confident about the integrity and security of this information.
Recognising this, and utilising the DJI Pilot app ecosystem, DJI's most advanced enterprise platforms feature robust processes to ensure users have control over the data they generate and that it is encrypted and protected from hijackers.
And DJI's security architecture is sure to evolve in the coming months and years to provide operators with even greater protection and reassurance about their drone data.
To download DJI's white paper on data security, click here.
The heliguy™ enterprise team is available to discuss data security with your operations and security teams. Contact us for more information.
Leave a comment