Feds Issue Warning on Chinese-Manufactured Drones as Farmer Adoption Soars

Modern agriculture runs on data, much of it is now collected from low altitudes above America’s farms and ranches. Drones, also known as unmanned aerial systems (UAS), have become an essential tool for precision agriculture. Thousands are now in use by ag drone service providers, ag industry firms, academic researchers and individual farmers nationwide.

These drones often carry a range of camera and radar-based sensors to harvest information on crop health, soil and field conditions, emergence, seed development, weed and pest infestation or to map agricultural land. Others take chemicals aloft as alternatives to manned aircraft or ground rigs for application of crop protection products and fertilizer. 

The benefits from the data they scoop up are many but there’s a problem. Most are made in China. 

With their use rapidly expanding, U.S. government officials are concerned that American agriculture is unwittingly giving away vital competitive and national security information.

“We’ve been communicating our concerns with Chinese-manufactured UAS with our critical infrastructure partners since roughly 2019,” says Scott Parker, the chief of UAS security for the Cyber and Infrastructure Agency (CISA), an office of the Department of Homeland Security. 

Parker says that’s why there’s a need for ag drone users to “invest in secure-by-design technologies and apply cybersecurity standards to UAS,” like they would other types of information and communications technologies they’re operating “and not to look at them simply as another version of aircraft.”

In January, CISA and the Federal Bureau of Investigation issued an official Cybersecurity Guidance on UAS manufactured in China. The warning stresses the use of Chinese-manufactured UAS in critical infrastructure operations, “risks exposing sensitive information to the People’s Republic of China (PRC) authorities, jeopardizing U.S. national security, economic security and public health and safety.”  

While it doesn’t mention agriculture specifically, it lists three key vulnerabilities: data transfer and collection, patching and firmware updates, and peripheral device data collection. 

If agricultural drone users don’t maintain the integrity of the information they collect, “there is absolutely a potential for that information to be exploited,” Parker says. “That’s especially true with the Chinese drone industry.”

Agricultural Drones, U.S. Missile Fields and Chinese Law

The area around Great Falls, Mont., boasts a wealth of farms and ranches. Area farmland shares space with a very different activity — the intercontinental ballistic missiles maintained and operated by the 341st Missile Wing at Malmstrom Air Force Base. More than 150 underground missile silos housing Minuteman III ICBMs are located on land around the base, much of it in agricultural use. 

Like their counterparts nationally, Great Falls-area farmers, use drones, including Chinese-made drones from DJI, short for Da Jiang Innovations. Shenzhen-based DJI is the world’s dominant drone maker accounting for approximately 70% of commercial drone sales globally, according to Drone Industry Insights, a German commercial drone business intelligence company. 

The U.S. Department of Defense, U.S. Department of the Interior, the Federal Aviation Agency and the Department of Homeland Security (DHS) are among the federal agencies that have banned the purchase and operation of drones from DJI and fellow Chinese commercial drone makers XAG and Autel Robotics due to their potential for exploitation.

Among the concerns federal officials have about the use of insecure drones are data theft, intellectual property theft, detailed mapping of critical infrastructure and gathering of economic and other national security intelligence via cybersecurity activities and harvesting of data from proprietary cloud storage. 

Trent Emenecker who leads a drone-vetting program known as Blue UAS for the Pentagon’s Defense Innovation Unit says data from drones can be stolen in transmission if linked to wireless networks or via compromised software and hardware integral to the operation of commercial UAS. 

“Data is power — financial, economic and military power,” Emenecker stresses. “Who controls it and has access to it?  You have to think about that with a drone. Obviously, the [Department of Defense] is very interested in not having our data compromised by foreign sources. In agriculture, you’re talking economic and other data. The risk is significant.”

Stealing data isn’t the only way it can be acquired, adds Michael Robbins, chief advocacy officer for the Washington D.C.-based Association of Uncrewed Vehicle Systems International (AUVSI). 

“It’s required by Chinese law for companies to cooperate with the Party,” Robbins explains. 

Robbins is referring to three recently instituted Chinese laws — the National Intelligence Law of 2017, Data Security Law of 2020 and Cryptology Law of 2020 — that compel Chinese businesses, academic institutions, research service providers and investors to support and facilitate government access to the collection, transmission and storage of data.

That means any user of a Chinese data-gathering drone who creates an account with the manufacturer and uses its cloud storage servers is potentially exposing information gathered or used by the drone to the Chinese government. 

DJI’s Mavic 3, Mavic 3 Enterprise and Terra ag drones are in use across American agriculture, capturing high-resolution optical, thermal and hyper/multi-spectral imagery of crops, livestock and farmland, as well as vital ag infrastructure, such as grain storage facilities, food and animal processing plants, railway facilities and nearby non-ag infrastructure. 

The company’s line of Agras aerial application UAS use sophisticated LiDAR sensors to create precise three-dimensional maps of the areas they fly and spray over and phased array radars to navigate and avoid obstacles. Information from these activities is routinely stored in DJI’s Agras Intelligent Cloud.

Federal Focus 

U.S. Air Force spokeswoman Ann Stefanek says the service is “aware of the many risks to U.S. national security posed by drone operation near sensitive national security infrastructure,” including Malmstrom AFB’s missile field.

The Air Force points out that management of the airspace adjacent to military facilities is the responsibility of the FAA, though DHS and the U.S. military regularly assess risks arising from otherwise lawful operation of such drones as well.

“It is our expectation that U.S. farmers and others operating drones near and around sensitive U.S. military installations are aware of and adhere to their legal obligations under applicable local, state, and federal laws and regulations,” Stefanek adds. 

A spokesman for Senator Jon Tester (D-Mont.), acknowledged the risk too.

“The Senator is concerned about espionage efforts from the Chinese government, whether it’s on American soil or through an ag drone and will continue to work with Republicans and Democrats to make sure our adversaries cannot undermine our national security.”

It's one reason the FAA and other agencies work together to build GPS-based geofences around critical infrastructure, including large- and medium-sized (Class B and Class C) airports and active military installations such as those in Montana. Reportedly, these fence-out locations are incorporated into DJI's flight software (with regular updates) and will not allow the drone to traverse into that airspace. 

However, there are dozens of resources online and in YouTube videos that tell DJI owners how to unlock geofencing in their drones. Asked about geofencing in DJI drones, the FAA would not address questions about how compliant or secure the Chinese manufacturer's software actually is.

Upcoming FAA Remote ID requirements, which will allow government agencies to track drones, will go into effect this spring. The cost of being detected in the wrong airspace is a $30,000 fine and loss of the Part 107 drone license. Part 107 operators will be required to only operate FAA Remote ID-compliant drones upon the rulemaking enactment in March 2024. 

However, the requirements are primarily to do with airspace safety according to the FAA. "Safely integrating drones into the National Airspace System is a key priority for the FAA. The agency is working to ensure drone pilots know their aircraft must be Remote ID compliant by March 16, 2024."

Further, the FAA declined to answer questions about whether it has the resources to enforce Remote ID Requirements, how it could prevent drones from flying in restricted airspace in real time or why the airspace around Malmstrom AFB is not restricted according the agency's UAS Data Map.

CISA’s Parker acknowledges that exploits of ag drones and other precision ag technologies can yield current intelligence on the economic condition of U.S. farming with potential consequences for trade negotiations and international initiatives. They can also yield more material dangers.

“We’re definitely concerned with the weaponization of UAS, whether it’s an improvised explosive device or a sprayer that sprays some type of toxic or any types of chemicals over people,” Parker says. “The same goes with someone using a drone in a criminal sense to spray crops with a pathogen or something else.”

The Drone Operator’s View

Mariah Scott is the CEO of Rantizo, an Iowa-based company that provides aerial application services nationally via a network of service providers flying drones that spray a wide variety of crops.

She explains Rantizo’s service providers are licensed under the FAA’s Part 107 and Part 137 rules. “Each applicator is required to be licensed by the state in which they are operating. That’s the same pesticide applicator license that would apply to a manned ground or aerial application.”

Pilots registered with FAA are known to the agency, she says. That includes submitting a driver’s license, social security number and signing off on a TSA Security background check before being approved or denied a license.  

Which types of drones do Rantizo service providers fly? 

“Almost all of our service providers are flying DJI drones,” Scott says. “The majority of the spray drones in use in the U.S. are manufactured by DJI.”

Do they upload information to DJI’s Agras Intelligent Cloud? “Yes,” Scott answers.

She emphasizes the company’s drones are not connected to any networks while in operation. However, aerial application drones use prescription maps for spraying, frequently gathered by other imaging drones. That means it’s likely the maps and field data used by Rantizo’s service providers are winding up in DJI’s cloud.

Scott says she hasn’t heard much concern about cybersecurity/security in the ag drone community, but she notes Rantizo is evaluating other drone companies, including American makers of aerial application drones. 

“We’re also looking at whether there are risks we need to mitigate with training, with the way we handle data ourselves,” she says.

Eric Taipale, the founder and chief technology officer of Sentera, a Minnesota-based firm that makes sensors for drones that gather high-resolution imagery for enterprise customers such as Bayer and John Deere, is keenly aware of the risks associated with drone data gathering. 

“They’re phenomenal productivity-enhancing tools,” Taipale says. “But farmers need to understand the risks that are inherent in deploying any data gathering asset onto their farm and make sure they’re working with a trusted partner end to end, from data to answer.”

He explains that Sentera’s sensors are segregated from the drones they fly on, including DJI-made examples. Software blocks are included with Sentera’s sensors and its “Field Agent” data management product.

“We’re using separate data links to offload and we’re obviously not going through any third-party cloud software whether it’s U.S.-based or not,” he adds.

Customers are concerned about foreign actors stealing or acquiring data, Taipale says, but they also emphasize protecting highly proprietary and competitive data from their competitors. 

“Farming is a manufacturing business, and it would be unusual for Toyota to put a bunch of cameras inside their factories and let the folks from Honda take a look.”

Awareness and Outreach

The federal government is aware of the risks of insecure drones to American farming, but it’s just now putting the industry on notice with its latest guidance.

CISA oversees 16 critical infrastructure sectors, including the Food and Agriculture Sector. The sectors combine federal leadership, from FDA and USDA in this case, with private participation from trade associations and firms specific to each sector. The partnerships serve as an information bridge between government and industry where potential risks/threats to critical infrastructure can be shared. 

Parker says CISA has reached out to agriculture via the Sector to share information on the cybersecurity risk of owning and operating Chinese-manufactured drones.  
However, Clay Detlefsen, senior vice president for Environmental and Regulatory Affairs at the National Milk Producers Federation who served as the chair of the Food and Agriculture Sector’s sector coordinating council until the end of December, say neither CISA nor USDA or FDA have communicated with the industry associations and ag firms that are part of the council.

“Nobody’s told the sector that this is something that is really big for ag,” Detlefsen says. “That’s never happened.”

Questions to USDA on whether it has communicated with America’s ag industry about the risks of insecure drones produced little response, though USDA spokesman Allan Rodriguez indicated the agency is cognizant of the growing usage and importance of UAS in agriculture, as well as their privacy and security implications.

Ag Drone Vetting

The Defense Innovation Unit’s Blue UAS program, an effort dedicated to examining the design, cybersecurity and funding streams underpinning UAS producers, produces a list of vetted drones approved for purchase and operations by the U.S. military.

A complimentary program known as Green UAS is now being stood up by AUVSI.

One of the biggest issues plaguing businesses looking for options besides DJI is there aren’t a lot of good alternative U.S.-made options. U.S.-based 3DR folded years ago and left a bad taste in a lot of drone pilots' mouths in the process. Parrot is a French company with good equipment, but the outfit continues to struggle against DJI’s firm grip on the market. DJI also has APIs that integrate popular flight planning and image processing platforms such as DroneDeploy, John Deere Operations Center, Corteva and other FMIS solutions. These data links make the image acquisition to useful data workflow much easier for farmers and agronomists.

Parker says agriculture should adopt a drone vetting program similar to Blue UAS. In the meantime, anyone can go to the Blue UAS website to see drones “that have been tested and their supply chains reviewed and determined as secure options.”

Taipale agrees. “I think it would be tremendously useful so long as the entity doing it is funded well enough to stay commercially relevant. The worst thing that would happen is if there’s a perception that a regulatory body is not fast enough to allow customers to leverage technology as it comes into play. That’s when customers start to ignore it.”

By Jan Tegler  wingsorb@aol.com

Jan Tegler has been writing about defense and the aerospace industry for more than 20 years. His reporting typically includes national defense, cyber security and electronic warfare. The intersection of those topics with agriculture has become a newly discovered passion.