Dear Director Easterly and Principal Deputy Under Secretary Passarelli:
We write to request that you declassify certain information relating to potential national security risks posed by unmanned aircraft systems (UAS or “drones”) that have been produced, manufactured, or assembled in the People’s Republic of China (PRC), including those made by Da Jiang Innovations (DJI) or Autel Robotics (Autel). It has come to our attention that there are findings from Sandia National Laboratories (SNL) pertaining to national security risks associated with drones that have been produced, manufactured, or assembled in the PRC.
Additionally, on January 17, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory raising awareness of the significant risks posed by PRC-made drones to our nation’s critical infrastructure and U.S. national security. Alarmingly, the advisory states that, “”the use of Chinese-manufactured UAS in critical infrastructure operations risks exposing sensitive information to PRC authorities, jeopardizing U.S. national security, economic security, and public health and safety.” The findings of CISA’s and the FBI’s analysis were apparently concerning enough to warrant the publication and dissemination of this advisory to state, local, tribal, and territorial partners.
It is our understanding that the SNL’s analysis does not implicate any sensitive intelligence sources or methods that would otherwise caution against declassification. In any case, there are certain procedures in place for declassifying information—while safeguarding sensitive intelligence sources and methods—when keeping information classified is outweighed by the public interest,4 as is the case here. We therefore ask that the relevant Executive Branch departments or agencies, including CISA and the Department of Energy (DOE), declassify these and all related findings immediately so that lawmakers and the American public can fully understand the threats posed by drones that have been produced, manufactured, or assembled in the PRC, including those made by DJI and Autel.
DJI and Autel are UAS technology companies headquartered in Shenzhen, China, that control nearly 90 percent of the global UAS market. DJI drones, in particular, are well known for their quality, affordability, and advanced features, making them a popular choice for American hobbyists, businesses, as well as State, local, tribal, and territorial (SLTT) law enforcement agencies. In recent years, DJI has received the most attention from Congress given the company’s dominant market share. However, Autel’s growing footprint in the United States is equally alarming.
DJI and Autel’s commercial relationship with thousands of SLTT law enforcement agencies in the United States adds a layer of complexity to this issue. The widespread adoption of PRC drones by SLTT law enforcement agencies may inadvertently expose them to cybersecurity risks that are not well understood, while simultaneously undermining our national security. Multiple federal agencies have warned against or banned the procurement of certain UAS originating in the PRC, due to the risks they pose.7 However, the details of these UAS threats remain classified.
For example, in August 2017, Homeland Security Investigations (HSI) —the investigative component of U.S. Immigration and Customs Enforcement—issued an alert warning that DJI drones are “[l]ikely providing U.S. critical infrastructure and law enforcement data to [the] Chinese government.” This bulletin “assesse[d] with high confidence [DJI] is selectively targeting government and privately owned entities within [infrastructure and law Cong. R. Serv. (IFI2183), Procedures for Declassifying Intelligence of Public Interest (August 10, 2023), enforcement sectors] to expand its ability to collect and exploit sensitive U.S. data.” Further, the bulletin warned that DJI-established applications, when used with their UAS hardware, collect GPS locations and photographs taken by the device, register facial recognition data even whenthe system is off, and upload information to cloud storage located in Taiwan and Hong Kong, towhich our foremost adversary, the Chinese Communist Party, almost certainly has access.10 Thebulletin further states that a “foreign government with access to this information could easilycoordinate physical or cyber attacks against critical sites.”
Concurrently, in August 2017, the Department of the Army released a memorandum ordering a grounding on the use of DJI applications and products, citing an “increased awareness of cyber vulnerabilities associated with DJI products.”12 The following year, in May 2018, the Department of Defense (DoD) halted all procurement of commercial-off-the-shelf drones.
May 2019, CISA issued an identical warning that Chinese-made drones pose a “potential risk ofan organization’s information.”14 Further, in January 2020, following a review of its drone fleet,the Interior Department temporarily retired non-emergency drones. According to then Secretary of the Interior Bernhardt’s order, “information collected during UAS missions has the potential to be valuable to foreign entities, organizations, and governments.”
In December 2020, the Department of Commerce added DJI to its Entity List, which prohibits U.S.-based businesses from exporting technology to companies designated as a national security concern. In July 2021, DoD reiterated its position Da Jiang Innovations pose potential threats to national security.”18 Later, in December 2021, the Treasury Department added DJI to its Chinese-Military Industrial Complex list over reports that its UAS are used by Xinjiang Public Sector Bureau to surveil China’s Uyghur Muslimpopulation.
In light of these significant issues, there is a strong public interest in understanding the threats posed by PRC-manufactured drones. As several federal agencies and departments have taken considerable action based on classified information, it is well past time that Congress, SLTT law enforcement agencies, and the American public receive answers to questions relating to PRC drones that have remained outstanding for several years.
Furthermore, we request that CISA and DOE provide Committee staff with a briefingabout this request no later than July 2, 2024.
Thank you for your attention to this important matter.Sincerely,Mark E. Green, MD
Cathy McMorris RodgersChairman ChairCommittee on Homeland Security Committee on Energy and Commerce