DJI drones, Ukraine, and Russia — what we know about AeroScope

Last week, the world's leading drone maker was accused of allowing Russia to target innocent civilians with missiles.

If you read those words, you might think that Russia is using drones from DJI to watch its missile systems. That isn't even remotely what the request is about. The system for locating drones and their operators is called DJI AeroScope, and it is being used by Russia to find and wipe out Ukrainian drone pilots.

If a rogue DJI drone gets near an airport runway, a stadium full of people, or a political rally, law enforcement can warn people and find them. The AeroScope system allows specialized receivers to decipher the position and pilot of drones by broadcasting an escort signal. It's as simple as planting a receiver and monitoring the signals if police need to track down pilots of drones.

In 21 days of the war, russian troops has already killed 100 Ukrainian children. they are using DJI products in order to navigate their missile. @DJIGlobal are you sure you want to be a partner in these murders? Block your products that are helping russia to kill the Ukrainians! pic.twitter.com/4HJcTXFxoY

— Mykhailo Fedorov (@FedorovMykhailo) March 16, 2022

Even in peacetime, that idea might sound a little bit risky: what if a bad actor gets access to an AeroScope receiver and goes around harassing, assault, or stealing from people whose eyes legally have to be glued to their drones in the sky? They are only sold to valid law enforcement and security agencies.

When a valid buyer pairs them with a guided missile battery in wartime, DJI didn't plan for what might happen. The consequences of Aeroscope may have emerged now that Ukrainian civilians have been enlisted to defend against the Russian army. If Aeroscope gives the Russian military the location of the Ukrainian drone pilot, they could use that information to hit the pilot.

We haven't found any confirmed reports of this happening, even if the story is spreading around parts of the internet. Fedorov is asking DJI to block Russia's DJI gear after it was confirmed that some of Ukraine's AeroScope receivers weren't working properly.

The US believes that China might provide assistance to Russia instead of being neutral because of the fact that it is a Chinese company and China is broadly aligned with Russia. The USA has accused it of being funded by the Chinese government, and recently the US Treasury named it one of eight non-SDN Chinese Military-Industrial Complex Companies.

We talked with several people about AeroScope, including a DJI spokesman, a drone forensics expert, and a director of operations at a prominent Aeroscope dealer.

What is DJI AeroScope, and how does it work?

The AeroScope system has two main elements.

1. An encrypted signal, automatically broadcast by every DJI drone sold since 2017, that provides the drone’s position, altitude, speed, direction, serial number, and the location of the pilot
2. The receivers that can pick up those signals up to 50 kilometers (31 miles) away

A short-range football of a portable unit, with its own case, screen, antennas and batteries, and a long-range stationary unit are the types of receiver that DJI sells.

Image: DJI

There are many ways to set up a Stationary Unit, from sending data to the public server hosted by Amazon, to an owner's private cloud, or even an offline server for security. The Portable Unit doesn't even have the option of internet, according to Aerial Armor.

The range of the Stationary Unit is 50 km, but the Portable Unit only has a tenth of that. On a clear day with no solar flares, a totally rocking antenna, and something, 50 kilometers is the upper bound of what I have heard, according to DJI.

The G8 Stationary kit sells for between $25,000 and $150,000 and the portable unit sells for $10,000. It should cost under $10,000 for a full installation.

Wait, are you telling me that my position is quietly broadcast to anyone who buys one of these gadgets?

It is a system where the user of the drone is signing a EULA acknowledging that their information will be made available.

The Aeroscopes can only be sold to legitimate operators, police have made clear since the start.

Is there a military version of the AeroScope receiver that Russia has?

Troiak tells me explicitly, and Vice PM Fedorov seems to imply it in his letter to DJI.

Image: DJI

When the right antennas are attached, 50 kilometers is the same range that DJI already quotes for its Stationary Unit.

Both Russia and Ukraine have access to the long-range Stationary versions of AeroScope.

Is it possible that DJI disabled or weakened Ukraine's AeroScope receivers?

The evidence is shaky at best. Troiak, who appears to be acting as middleman between their operators and DJI, showed me some emails that he said showed several AeroScope receivers going offline after Russia invaded Ukraine. Vice PM Fedorov's office didn't respond to requests for comment after Troiak suggested his sources might be killed or jailed if he put them in touch.

The company denies that it had anything to do with the AeroScope receiver going offline.

The allegations that the AeroScope was adjusted to help some parties or hurt other parties are completely false, according to the author.

Some of the non-working AeroScope receivers have been brought back online by DJI, but we have not been able to diagnose or fix them.

Why can't the Aeroscope signals be shut off so pilots aren't targeted?

This isn't something that DJI can switch off over the internet, and the drones themselves are broadcasting the AeroScope signals to any nearby receiver that's listening. They are not being sent over the internet.

The same data packet that you can use to control the drones is also used to turn them off.

AeroScope was added to some early DJI drones as a firmware update, so it's possible that a new update could turn it off again. The public safety purpose of AeroScope might be defeated by that. Bad actors could use it to hide their drones.

Ukraine wants the AeroScope signals to be turned on, so it isn't actually asking DJI to shut off the signals.

What is Ukraine asking for?

Vice PM Fedorov wants the company to give him information about every product they sell in Ukraine, as well as a map of their locations, and to block products from Russia, Syria and Lebanon.

Is there a map of where the products are?

The company doesn't have a way of knowing where an AeroScope is.

They don't have immediate visibility, if any, into the clients we sell to.

Photo by Vjeran Pavic / The Verge

Is it possible for DJI to see the positions of the drones? Is it tracking flight data as well?

That was the theory in the year 2017, but it isn't happening at all.

I was one of the people who accused them of doing that five years ago. According to the drone forensics expert, there were strong indications that the data was coming from the drone and through the app.

The short version: in 2017, a hacker named Kevin Finisterre discovered that DJI had left some of its AmazonAWS cloud data publicly accessible, with Ars Technica writing that it included flight logs from accounts associated with government and military domains.

The data uploaded in 2020 appears to show an online heat map of drone activity around the globe, something that would be impossible for DJI to generate without some sort of tracking. The ominous name didn't help.

It was an internal proposal that didn't go anywhere.

It doesn't have your flight data unless you own it. I was able to confirm that the current US version of the app has turned off the auto-sync feature.

The app pushes you into sharing your location of your own drone, hardware info, and your device's diagnostic and usage data, but you can opt out. Consultants and US government agencies have had security audits that have found nothing of the sort.

He says that people have looked at the traffic, but have not been able to come to a conclusion about the data flowing across the link.

Couldn't DJI find the data the Ukrainians want?

If Russia or Ukraine set their Aeroscope receivers to upload their data to the public cloud, then the same information that Ukraine's own receivers can already get would be uploaded to the public cloud by DJI. It depends on where the data is hosted. In his experience, AeroScope dealers tend to put their clients on the cheaper cloud more often than not.

Some of the AeroScope stations use a private cloud, which is likely to be used to secure military data. They would need to get a new digital certificate once a year to operate.

Even if it had the data, it wouldn't give it to the other side of the war.

Wouldn't it be better if DJI just shut the AeroScope receivers off?

Maybe. It was not something that we contemplated, but Lugo confirms that an AeroScope sensor will drop offline if its certificate is not renewed.

It's not clear if a certificate can be revoked before it expires. Since many Stationary Units aren't connected to the internet, it wouldn't be possible to cut them off early.

Shutting down the AeroScope receivers is not what Ukraine is asking for, and DJI is trying to maintain a neutral stance.

Couldn't the company establish a neutral no-fly zone for its drones?

Yes, but not very effective. One of the few things that DJI has offered to do in response to Ukraine is set upgeofences.

pic.twitter.com/ZoCXQIDOyt

— DJI (@DJIGlobal) March 16, 2022

There are software hacks that can be used to disabling the latest software update. Troiak is suggesting that Ukrainian pilots block the antenna from seeing satellite signals or disabling the gps positioning entirely to avoid being spotted by Russia. The drones would still broadcast an AeroScope signal, but it wouldn't give the exact coordinates of the pilot.

How are the Ukrainians using their drones?

Civilians have been using the aerial cameras to track Russian convoys and then relay the images andGPS coordinates to Ukrainian troops, according to the Associated Press. The pictures only show a beer bottle being dropped by the drone.

Ukraine has a history with makeshift drones. Coffee or Die reported that the Ukrainian National Guard was using drones to drop homemade bombs in 2020 and that the custom-made fighting drones of Ukraine were being reported on.

Inexpensive military-grade drones from Turkey have been used by the Ukrainians. The US is sending drones to Ukraine as well.

Is there a stop to sales in Russia or Ukraine?

We have always told our distributors and dealers that they have to follow any applicable export control laws in any country where they are operating.

The Russian military would still be able to track down the drones even if AeroScope sales were stopped. Russia has hundreds of them, according to Troiak. State-level militaries have figured out how to decode that information as well.

Over 400 companies have left Russia in protest. Will it happen?

No.

For the past 15 years, DJI has tried to stay out of politics.

What kind of oversight keeps an AeroScope station owner from selling nearby flights?

It seems nothing.

We are not a data company. We don't want to be the repository for our customers' data. We offer data hosting as a convenience for customers who want to use it and who have no security concerns about it. It's yours to use and control the data you generate with our products.

Is the AeroScope system a good idea?

The situation in Ukraine shows that the company's drones don't belong in a warzone. AeroScope was not designed for that.

It's a bad idea in this situation because people are fighting for democracy. It's a horrible idea. It was an excellent idea to protect our critical infrastructure.

He compares it to other unforeseen uses of technology that have unfortunate implications for their owners, like how Toyota might be associated with images of rebels with machine guns mounted to its trucks or Caterpillar with their bulldozers demolishing settlements in the West Bank.

The message was delivered that if solutions like this weren't developed, the government would regulate them.

According to a 2020 Businessweek feature, one country clearly delivered that message was China.

New FAA Remote ID rules could be shaking that up again soon, as they are just part of a larger conversation about who and what should be able to identify a drone and its owner.