DJI Cleared by Independent Audit: No Security Basis for the U.S. Ban

DJI was banned in the United States in December 2025 without documented security vulnerabilities. An independent cybersecurity audit has now found that the threat the ban was predicated on does not appear to exist.

What the Audit Found

OnDefend, a U.S. cybersecurity firm, conducted an independent assessment of the DJI Air 3S and DJI Matrice 4E drone systems. Both units were sourced independently from retail and dealer stock without DJI’s knowledge of the timing or location of testing — a methodology designed to eliminate the possibility of test-specific hardware modifications.

The findings are unambiguous. The audit identified 10 low-risk findings and 13 observations, all characterized as consistent with industry norms for complex mobile and embedded systems. More specifically: no backdoors or unauthorized remote access mechanisms were found, no data transmission outside the United States was observed, all connections resolved to U.S.-based infrastructure, no unexplained radio frequency emissions were detected, and no supply chain tampering or unauthorized hardware modifications were identified. Controllers resisted all jailbreak and firmware modification attempts.

The audit’s summary: “Identified no clear evidence of hidden backdoors, no data transmissions outside the United States, and no viable pathways for hijacking or weaponization.”

The Regulatory Sequencing Problem

The DJI ban was implemented automatically through FCC proceedings in December 2025, without the completion of the security audit that Congress mandated in 2024. Over 3,000 public comments were filed in FCC appeal proceedings. The government never completed its own review before implementing restrictions.

This is an unusual regulatory sequence. In most cases, security restrictions follow documented threat findings. The DJI situation reverses that order: restriction preceded evidence collection, and independent evidence collection now contradicts the regulatory action. The photography and drone industry has documented the downstream effects of the ban on commercial photographers, surveying operations, search and rescue teams, and other legitimate professional use cases that depend on DJI hardware.

The NDAA restriction that created the ban covers DJI as a company on the grounds of national security concern — not specific documented vulnerabilities. The distinction matters: the OnDefend audit addresses the product-level technical claims, not the broader geopolitical categorization. Both arguments are running simultaneously in regulatory proceedings.

Source: PetaPixel

Content created with AI assistance and reviewed for accuracy.