Chinese Commercial Drones as Dual-Use Technology

Chinese Commercial Drones as Dual-Use Technology: The DJI Problem

In 2017, the US Army issued a stop-work order on DJI products, citing cyber vulnerabilities and data security concerns. The order covered all DJI systems in Army inventory and halted new procurement. At that point, the Army had been issuing DJI Phantoms and Inspires to brigade and battalion commanders for local reconnaissance because there was nothing else available at comparable price and capability. That is the DJI problem in a sentence: the best affordable drone in the world is manufactured by a Chinese company subject to Chinese data law, and the US military found this out after it had already become dependent on those drones.

Five years later, DJI drones are the most-used reconnaissance platform in the largest land war in Europe since 1945. On both sides.

Why DJI Dominates

DJI's market dominance is not primarily the result of Chinese government support or predatory pricing, though both have played some role. It is primarily the result of building genuinely excellent products and iterating faster than competitors.

The original Phantom 1, released in 2013, was the first consumer drone that a non-hobbyist could actually fly reliably. GPS-stabilized hover, automatic return-to-home, and integrated camera mount—capabilities that required significant expertise to achieve in 2010—were packaged into a product anyone could learn to operate in an afternoon. DJI correctly identified that the limiting factor in drone adoption was not cost or regulation but the skill required to fly. GPS stabilization solved that problem.

Subsequent generations executed rapidly: the Phantom series for consumer photography, the Mavic series for portable professional use, the Inspire series for high-end cinematic work, the Matrice series for enterprise applications. Each generation improved on capability, battery life, transmission range, and camera quality. Competitors—including US companies like 3DR and French manufacturer Parrot—could not match the pace of development or the price points DJI achieved through Shenzhen manufacturing economics.

By 2020, DJI's market share was estimated at 70–80% globally. No competitor had a clear path to dislodging them on either price or capability in the sub-25 kg segment.

The Battlefield Transition

The Russia-Ukraine war provided the most extensive demonstration to date of commercial drone military applications, and DJI was at the center of it.

Ukrainian territorial defense forces began using DJI Mavic 3 drones as artillery spotters within weeks of the February 2022 invasion. The workflow is straightforward: a drone operator hovers a Mavic at 200–400 meters altitude behind friendly lines, uses the camera's optical zoom to observe a target area, and provides real-time adjustments to artillery operators on the radio. The alternative—sending scouts forward on foot—risks casualties and is slower. The Mavic operator sits in relative safety and provides better observation than a forward observer could achieve on foot, with thermal imaging to detect camouflaged or dug-in positions.

Russian forces adapted to this quickly and began doing the same thing. By mid-2022, DJI Mavic 3s were being used simultaneously by both sides to spot for artillery, observe trench systems, and coordinate tactical movements. The same firmware, the same spare parts supply chain, the same manufacturer's technical manuals—opposing forces using identical equipment against each other.

The weaponization step—adding munitions to the drone—followed naturally. Commercial payload release mechanisms, sold for wildlife tagging and seed delivery agricultural applications, allowed Mavic pilots to drop grenades with enough accuracy to hit individual personnel or vehicle hatches. Ukrainian media has documented Mavic 3 pilots achieving consistent hits on targets at ranges exceeding 100 meters, a level of accuracy that transforms a $2,000 reconnaissance drone into a close-support precision munitions delivery system.

The Data Security Problem

The operational concern about DJI drones divides into two distinct issues that are often conflated: data exfiltration and remote control vulnerability.

Data exfiltration refers to the possibility that flight data, imagery, and operator location data collected during drone operations is transmitted to servers accessible to Chinese authorities. DJI stores flight logs, video, and telemetry data on cloud servers, and under China's 2017 National Intelligence Law, Chinese companies are required to provide access to this data to state intelligence services on request. DJI has disputed characterizations of this as active surveillance, arguing that cloud storage is optional and that locally-stored data is not transmitted. Independent security researchers at the US Army Cyber Command found in 2017 that DJI software was transmitting data to DJI servers in ways not fully disclosed to users. Subsequent analysis has been mixed, with some researchers finding evidence of continued transmission and others finding that claimed data handling improvements are genuine.

For military applications, the relevant question is not whether DJI is actively surveilling specific operators but whether flight data from military operations—including positions, camera footage of military facilities and personnel, and operator locations—could be accessed by Chinese intelligence. The risk is not theoretical: if Chinese intelligence knows when, where, and for how long a specific US military unit is operating drones, that information has intelligence value independent of the content of any specific flight.

Remote control vulnerability is the concern that DJI could remotely disable or modify drone behavior through firmware updates or remote commands. DJI demonstrated this capability in April 2022 when it implemented geofencing restrictions over Ukraine and Russia, making drones unable to operate in designated areas. This was framed as a neutral action to prevent civilian casualties, but it proved that DJI can exert operational control over drones already in users' possession—a capability that is strategically unacceptable for military operators. Both Ukrainian and Russian forces developed firmware modifications to bypass these restrictions, but the fact that they needed to do so reveals the dependency.

US Legislative Response

The US has addressed the DJI problem through a series of procurement restrictions that have progressively tightened but not eliminated the vulnerability.

The 2020 NDAA prohibited DoD from purchasing commercial off-the-shelf drones manufactured in China, specifically designed to capture DJI and other Chinese manufacturers. The legislation defined covered systems broadly to include those with "significant" Chinese-manufactured components, which complicated implementation—most of the drone industry uses Chinese-manufactured components to some degree.

The 2023 NDAA and associated American Security Drone Act extended restrictions and directed the FAA to develop certification processes that could distinguish secure from insecure commercial drones. The FCC proposed adding DJI to its "Covered List" of national security threats, which would prohibit FCC authorization for new DJI products—effectively blocking new DJI sales in the US market.

DJI's response has been to vigorously contest these characterizations and to invest in "local data mode" software that, it claims, prevents any data transmission during flight. Independent verification of these claims remains contested.

The Alternative Ecosystem Problem

US procurement restrictions would be straightforward to implement if viable alternatives existed at comparable capability and price. They largely do not, and that gap reveals how thoroughly DJI's market dominance has suppressed the development of competitive alternatives.

Skydio is the most capable US-manufactured alternative for smaller drones. Its R1 and X2 series offer autonomous flight and obstacle avoidance that in some respects exceeds DJI capability. Unit cost is significantly higher—$10,000–$70,000 versus DJI's $2,000–$15,000 for comparable capabilities—reflecting the difference between Shenzhen manufacturing economics and US labor and overhead costs. Skydio has received DoD contracts under the Blue sUAS program but cannot currently meet demand at scale.

Parrot (France) is the primary non-Chinese alternative for European militaries. The Anafi USA model is specifically designed to comply with US security requirements and has received DoD certification. Performance is competitive with DJI's mid-range offerings, but the product line depth is narrower and the supply chain development is still maturing.

Autel Robotics, while headquartered in the US, manufactures in China—a distinction that matters for supply chain security analysis but complicates categorization under current legislation.

The Blue sUAS (Small Unmanned Aerial System) program, managed by the DoD Defense Innovation Unit, has certified a list of approved vendors: Skydio, Parrot, Altavian, Teal Drones, and a small number of others. Fielding these systems to replace DJI drones across the US military has been slow, constrained by production capacity, cost, and the reality that many DJI drones in government use are not DoD procurements but state and local law enforcement and emergency management assets.

The Irony of Commercial Innovation

The DJI story illustrates a tension that runs through US defense technology policy. Commercial technology often advances faster and achieves better price-performance than military procurement programs. The commercial drone industry—including DJI—developed capabilities over a decade that would have cost billions to develop through traditional defense acquisition. The US military's instinct to leverage commercial technology is economically and operationally sensible.

The problem is that commercial technology doesn't come with the security assumptions of military procurement. A defense contractor building a reconnaissance drone has security clearances, facility security agreements, and contractual data handling requirements. A commercial company selling to the consumer market has none of these things, and the US government has been slow to develop frameworks that can evaluate and certify commercial products for sensitive applications without simply prohibiting them.

The interim result is a patchwork: DoD cannot buy new DJI drones, but thousands are still in use in law enforcement and emergency services. Military units in Ukraine are using DJI drones because there's no comparable alternative, and they are modifying firmware to work around DJI restrictions. The restrictions have slowed DJI proliferation in US military channels without replacing the underlying capability requirement.

What Comes Next

The medium-term trajectory is toward greater separation between the commercial and military drone supply chains, driven by US policy and by the demonstrated operational risks of commercial dependency. The Blue sUAS program and NDAA restrictions are building a domestic alternative ecosystem, though at significant cost and time premium.

DJI will continue to dominate the global commercial market—the legislative restrictions affect US government procurement, not global commercial sales or civilian adoption. European, Asian, and developing-world militaries that have not implemented equivalent restrictions will continue to use DJI hardware. The proliferation of DJI-based tactical capability to non-state actors will accelerate as prices continue to fall.

The counter-drone industry, paradoxically, benefits from DJI dominance: because DJI's RF protocols are well-characterized, systems like the DroneShield RfPatrol and DroneDefender can reliably detect and defeat DJI platforms. A world with more diverse drone manufacturers would be harder for counter-drone systems to handle. That silver lining does not outweigh the security concerns, but it is worth noting as a real operational advantage of adversary standardization.

For defense planners, the DJI problem is a template for a wider challenge: in a world where commercial technology advances faster than defense acquisition, maintaining meaningful distinctions between civilian and military capability requires active policy frameworks, not passive procurement rules. The drone case arrived first. It will not be the last.