DJI Drone Security Audit Finds No Backdoors or Data Leaving the US – Its Case Against the FCC Ban

Drone News

by Nino LeitnerMay 29^th, 2026

Subscribe to News - Industry

DJI has released the findings of an independent security assessment of two of its drone systems, the DJI Air 3S and the Matrice 4E, conducted by US cybersecurity firm OnDefend. The audit reports zero critical, high, or medium-risk findings, no evidence of data being sent outside the United States, and no hidden backdoors, alongside ten low-risk findings and thirteen lower-level observations. DJI commissioned the assessment to support its ongoing appeal against its December 2025 placement on the FCC Covered List, the designation that blocks new DJI gear from entering the US market. The obvious caveat: this is a DJI-authorized audit of just two models, and it speaks to platform security rather than to the policy reasoning behind the restriction.

For filmmakers, this is less abstract than it sounds. DJI remains the default for aerial cinematography, and we have tracked the slow tightening of US restrictions for well over a year, from the proposed Countering CCP Drones Act through the missing federal security audit to the moment DJI was added to the FCC Covered List. This new report is DJI’s attempt to put technical evidence on the table where, by its own account, none was ever publicly produced against it.

What OnDefend actually tested

OnDefend, a Jacksonville-based cybersecurity firm whose team includes former US military and government personnel, examined two systems: the consumer DJI Air 3S with its RC 2 controller and DJI Fly app, and the enterprise DJI Matrice 4E with the RC Plus 2 Enterprise controller and Pilot 2 app. The engagement ran from October 2025 to March 2026, roughly five months, and was structured around three concerns: data sovereignty, hardware vulnerabilities, and the risk of drones being hijacked or manipulated.

Two units of each model were tested across indoor and outdoor environments. This matters for the independence question: OnDefend says it procured the consumer units directly from retail without notifying DJI, and pulled the enterprise units from existing dealer stock, so the hardware under test reflected standard US-market distribution rather than cherry-picked review samples.

The testing itself was thorough on paper. On the software side it included static and dynamic analysis of the DJI Fly and Pilot 2 apps, full network traffic capture in both standard and Local Data Mode, certificate-pinning bypass, privilege escalation, and jailbreak attempts. On the hardware side it covered full-spectrum RF scanning from 1 MHz to 6 GHz, PCB-level teardown, component cross-referencing against an expected bill of materials, and active RF exploitation through replay, jamming, and injection attacks.

The headline findings

The results DJI is leading with are the reassuring ones. OnDefend reported no evidence of data being transmitted outside the United States, with all observed connections resolving to US-based infrastructure. It found no backdoors or unauthorized remote-access mechanisms, and the controllers resisted every jailbreak and firmware-modification attempt. It identified no unexplained radio emissions; some signals not previously documented in FCC filings turned out to be artifacts of the documented signal-synthesis methods (PLL and divider leakage tied to the O4 control link), not covert channels. And it found no supply-chain tampering or unauthorized hardware modifications.

There is nuance worth reading past the summary, though. OnDefend notes that the US-resolving traffic included content-delivery infrastructure associated with Alibaba and Tencent, alongside expected services from Google, Amazon, and Mozilla, and recommends DJI migrate to infrastructure more consistently identified as US-based. The firm also recommends that DJI remove 4G-dongle-associated antenna structures from drones sold in the US market, a hardware change rather than a clean bill of health.

Where the report found weaknesses

The “zero critical, high, or medium” framing is accurate, but it sits alongside ten low-risk findings and thirteen observations that DJI’s own materials are quieter about. These are not trivial in every case. The assessment flagged authentication tokens exposed in URLs across DJI Fly and Pilot 2, weak TLS protocols and ciphers, persistent cross-site scripting in DJI Fly, a denial-of-service condition on an open port, and a local file inclusion with path traversal in the FlyShare feature. One finding stands out: OnDefend identified a default shared WiFi password, which DJI has since patched through a firmware update.

OnDefend characterizes all of this as consistent with industry norms for complex mobile and embedded systems, and says none of it presents a realistic risk to safe flight or to widespread exposure of confidential data. DJI says it collaborated on remediation during the engagement and is addressing remaining items in later software releases. That is a reasonable position, but it is a different message from “nothing to see here.”

The Local Data Mode caveat

One result deserves particular attention because it touches the exact concern operators have about a Chinese-made drone. OnDefend confirmed that Local Data Mode does prevent user data from being sent from the flight-control app to the internet, and that no past-flight data leaked even after returning to normal mode. However, the report is explicit that Local Data Mode does not fully isolate the controller itself, because the controller’s operating system and other apps can still connect. For genuine isolation, OnDefend recommends operators disconnect the controller from WiFi entirely, and asks DJI to align its Trust Center guidance with this real-world behavior.

Why DJI is doing this now

The backdrop is the FCC’s December 22, 2025 decision to add DJI, fellow manufacturer Autel, and effectively all foreign-made drones to its Covered List. That action does not ground existing fleets; it blocks new equipment authorizations, which means no new DJI model can be legally imported, marketed, or sold in the US without one. The determination came from a White House-convened interagency body under Section 1709 of the FY2025 NDAA, and as we reported at the time, no agency had completed the security review the same statute envisioned before the deadline forced the listing.

DJI’s argument, voiced by Head of Global Policy Adam Welsh, is that facts should inform policy and that the concerns behind its Covered List status are not supported by technical evidence. The company points to more than 3,000 public comments filed on its FCC petition, and to figures showing how embedded its drones are in US public safety and creative work, where it remains the industry standard for aerial cinematography, news gathering, and documentary production. It is asking the FCC to weigh the OnDefend findings as part of its appeal.

How independent is a DJI-commissioned audit?

This is the question to hold onto. The assessment was, in OnDefend’s own words, authorized by DJI but conducted independently, and DJI paid for it. The independent procurement of test units is a genuine methodological strength, and OnDefend is an established firm rather than a rubber stamp. But a vendor-funded audit of two models is not the same as a government national security review, and OnDefend itself stresses that a point-in-time assessment cannot measure security into the future, recommending continuous testing across every firmware and hardware revision.

There is also a gap between what the audit measures and what the Covered List decision rests on. The FCC’s determination leans on country-of-origin policy, market-distortion concerns, and a broad national security framework, not on a single documented bug. A clean penetration test, however rigorous, does not directly rebut a policy that treats foreign manufacture itself as the risk. The report is useful evidence and a smart move for DJI’s appeal; whether it shifts a decision rooted in geopolitics rather than packet captures is another matter.

The full OnDefend assessment, including the executive summary, is available through DJI’s Trust Center for those who want the technical detail.

Does an independent audit like this change how you view the DJI security debate, or is the FCC fight about something a penetration test can’t settle? Don’t hesitate to let us know in the comments below!