Independent cyber audit finds zero malware or backdoors in DJI drones — U.S. firm's hardware analysis challenges FCC ban amid ongoing $1.56 billion legal battle

News
By
Published

The same firm that inspects TikTok's U.S. platform found zero critical, high, or medium-risk issues across five months of testing.

DJI drone flying
(Image credit: Shutterstock)
14

DJI has published the results of an independent security assessment by U.S. cybersecurity firm OnDefend, which tested the DJI Air 3S consumer drone and Matrice 4E enterprise drone over five months and reported zero critical, high, or medium-risk findings. OnDefend also found no evidence of data being transmitted outside the U.S., no hidden backdoors, and no successful attempts to hack or tamper with either aircraft. The audit comes as DJI pursues a Ninth Circuit lawsuit against the FCC over the agency's decision last December to ban all new foreign-made drones from receiving U.S. equipment authorization, a move DJI claims will cost it $1.56 billion this year.

The ban took effect after a government-mandated national security review of DJI's products failed to begin before the December 2025 deadline; DJI initiated the OnDefend engagement in October on its own, whose team includes former U.S. military and government cybersecurity professionals.

Latest Videos FromTom's Hardware
Luke James
Luke James
Contributor

Luke James is a freelance writer and journalist.  Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory. 

14 Comments Comment from the forums
  • PEnns
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    Reply
  • helper800
    PEnns said:
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    Obviously none at all. Top down vibes based governance from the current administration in all things as per usual.
    Reply
  • chaos215bar2
    PEnns said:
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    DJI was called a threat by default, because the government never actually did the audit required by law within the necessary timeframe. Presumably they were worried it wouldn't turn up whatever they were looking for.
    Reply
  • Notton
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.
    Reply
  • JakobePaulobe
    Notton said:
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.
    In this case it was largely thanks to lobbying efforts by Skydio and their ceo Adam Bry, who went out of his way to get as much of Skydio's competiton in the US eliminated by regulatory action as possible, while simultaneously pulling out of the consumer market. For someone who's supposedly a "drone enthusiast", Adam Bry really doesn't seem to want anyone else to be able to fly drones. Classic ladder pulling.
    Reply
  • endocine
    Well there is this though : "While DJI maintains that the OnDefend audit was conducted independently, DJI did authorize and pay for it, and the overall arrangement differs from a government-directed review, which would have been conducted under federal oversight with no financial relationship to the subject."

    That's about the same as a major pharma company funding a study on a new drug. Doesn't mean it isn't valid, but uh....
    Reply
  • USAFRet
    JakobePaulobe said:
    In this case it was largely thanks to lobbying efforts by Skydio and their ceo Adam Bry, who went out of his way to get as much of Skydio's competiton in the US eliminated by regulatory action as possible, while simultaneously pulling out of the consumer market. For someone who's supposedly a "drone enthusiast", Adam Bry really doesn't seem to want anyone else to be able to fly drones. Classic ladder pulling.
    And I was right on the edge of buying a Skydio when they pulled out of the consumer market.
    Like...days edge.
    Reply
  • PEnns
    Notton said:
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.

    Actually, it has become a pattern!!

    Plenty of rich guys / Tech Bros with deep pockets deciding what is "good AND SAFE for the country"...for quite a while now.
    Reply
  • Mindstab Thrull
    endocine said:
    Well there is this though : "While DJI maintains that the OnDefend audit was conducted independently, DJI did authorize and pay for it, and the overall arrangement differs from a government-directed review, which would have been conducted under federal oversight with no financial relationship to the subject."

    That's about the same as a major pharma company funding a study on a new drug. Doesn't mean it isn't valid, but uh....
    Except that's the same kind of process so many other companies go through for their products: "we need <X> tested for <Y> so we'll call up known company <Z> who tests these things and go through their process to make sure we're good."
    We can be cynical about it, but sometimes it's as simple as "run the tests you'd run anyways" - and also, the versions of the products bought were off the shelf, not supplied by DJI. All OnDefend has to do is say "we ran our regular tests and published the results, all DJI did was pay for them." Otherwise we couldn't trust any testing organization who gets the products supplied and/or methodology financed by the company being tested.

    Mindstab Thrull
    Reply
  • endocine
    Mindstab Thrull said:
    Except that's the same kind of process so many other companies go through for their products: "we need <X> tested for <Y> so we'll call up known company <Z> who tests these things and go through their process to make sure we're good."
    We can be cynical about it, but sometimes it's as simple as "run the tests you'd run anyways" - and also, the versions of the products bought were off the shelf, not supplied by DJI. All OnDefend has to do is say "we ran our regular tests and published the results, all DJI did was pay for them." Otherwise we couldn't trust any testing organization who gets the products supplied and/or methodology financed by the company being tested.

    Mindstab Thrull
    Its a potential conflict of interest
    Reply