Commercial drones can give China critical intelligence on the U.S., witnesses tell Senate

Commercial drones are giving Chinese intelligence services another avenue to information gathering, experts told a senate subcommittee on Tuesday.

Commercial drones are giving Chinese intelligence services another avenue to information gathering on the United States, experts told a Senate Commerce subcommittee on Tuesday.

The commercial drone market is predominately made up of Chinese manufacturers, with companies like DJI, Zero Tech and Yuneec leading the market. Experts told the committee that as these drones hover in U.S. skies, detailed land images are being transmitted back to China where citizens are required to support “national intelligence activities.” Those images could be used to create a time-stamped map of critical infrastructure and even national security sites.

“That is a cyber and information risk that is at the national level,” Harry Wingo, chair of the cybersecurity department at the National Defense University, told CyberScoop after the hearing.

The U.S. government has taken steps to guard against the perceived threat. The U.S. Army banned the use of DJI products in 2017. However, there is still commercial drone use on the state and local level: The New York Police Department has deployed DJI drones for their use in law enforcement activities, using the devices to monitor traffic at music festivals and other large gatherings.

Sen. Rick Scott, R-Fla., also aligned the issues with Huawei and ZTE, giant Chinese telecommunications companies that the U.S. has accused of being too close to the Chinese government.

“I think in so many areas we are just crazy to do business with the Chinese,” Scott said.

The Department of Homeland Security put out an alert on the use of Chinese-made commercial drones in May.

“Be cautious when purchasing [drone] technology from Chinese manufacturers as they can contain components that can compromise your data and share your information on a server accessed beyond the company itself,” the advisory, previously obtained by CyberScoop, said.

DHS’s own drones at the southern border have been vulnerable to cyber intrusions, according to a Inspector General report published in September.

Catherine Cahill, director of the Alaska Center for UAS Integration at the University of Alaska Fairbanks, told the subcommittee that her employer has been approached by foreign nationals seeking information regarding drone programs that by law cannot be disclosed to non-citizens.

“We have a lot people asking questions…it is the type of information we are not allowed to transmit to a foreign national,” she told CyberScoop after the hearing.

Most of the questions come from people who appear to be aligned with Iran, Russia and Pakistan, she said.

Wingo and Brian Wynne, chief executive officer of the Association for Unmanned Vehicle Systems International (AUVSI), encouraged drone users to purchase from U.S. manufacturers to mitigate the risk data could fall in the hands of adversaries.

“We have a very robust industry,” Wynne said, adding that the American market tends to be more use-specific than high-volume Chinese market.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems