Understanding DJI’s Commitment to Cybersecurity and Privacy
In light of ongoing discussions surrounding DJI’s practices regarding cybersecurity and privacy, the company has stepped forward to clarify details surrounding its internal measures, incidents, and initiatives aimed at safeguarding user information. Highlighting its willingness to engage with concerns raised by customers and independent sources, DJI asserts its determination to enhance data integrity and security continuously. Here are the main takeaways from their recent statement:
Key Takeaways:
- Proactive SSL Management: DJI promptly acted on a report regarding a compromised SSL certificate, revoking and replacing it to maintain data security.
- Rapid Response to Security Risks: Following a breach report from an independent security researcher, DJI swiftly corrected server vulnerabilities and implemented stricter access controls.
- Inclusive Bug Bounty Program: Through the DJI Security Response Center, the company continues to reward researchers for identifying potential security flaws.
- Countering False Narratives: DJI vigorously addresses misleading claims regarding its technology and operations, ensuring clarity on its compliance and practices.
Robust Response to Cyber Incidents
Amid a series of articles questioning its cybersecurity approach, DJI has taken steps to assure users about its commitment to data protection. In September, the company learned of a breach related to its SSL certificate. In response, DJI took immediate action—revoking the compromised certificate and issuing a replacement. Their investigation indicated no compromise of customer data. Furthermore, to ensure transparency, DJI is collaborating with an independent cyber forensics firm to validate their findings.
Addressing Server Security
In another instance, DJI received a report from an independent researcher indicating that an AWS server repository was vulnerable to unauthorized access. Recognizing the significance of this issue, DJI acted within 24 hours to rectify the situation. Following an internal audit, the company identified those responsible and took decisive disciplinary actions, including termination of employment, underscoring their stringent adherence to company policies. To bolster security, DJI has also tightened the number of personnel authorized to adjust server settings and enhanced employee training protocols.
Engagement Through the Bug Bounty Program
DJI’s commitment to fostering collaborative cybersecurity efforts is further exemplified through its establishment of the DJI Security Response Center (DSRC). Since launching its Bug Bounty program in 2017, DJI has rewarded numerous security researchers who diligently report vulnerabilities, ensuring they can contribute to improving product safety.
Recent claims regarding threats towards program participants have been rejected by DJI as unfounded. Correspondences reveal that the company engaged positively with researchers and negotiated terms in good faith. Despite these efforts, one individual detached from discussions and shared potentially misleading information about the negotiation process, which DJI seeks to address transparently.
Countering Misinformation about DJI
A recent bulletin issued by a U.S. Immigration and Customs Enforcement (ICE) agent has made headlines for suggesting dubious claims about DJI’s products and operations. The company asserts that the claims stem from reliance on unverified sources and demonstrate a fundamental misunderstanding of their technology, operational protocols, and regulations.
DJI highlights that its drones have no facial recognition capabilities and refutes allegations regarding pricing strategies impacting competitors. Furthermore, it emphasizes compliance with local laws wherever it operates. In markets within China, DJI follows legislation by utilizing user location data to ensure compliance, while ensuring no data is shared with the Chinese authorities unless required by law.
For further details and official statements from DJI regarding the recent inquiries into its cybersecurity measures and the ICE bulletin, visit:
- DJI Statement On ICE Bulletin: https://www.dji.com/newsroom/news/dji-statement-on-ice-bulletin
- DJI Statement On Reported Data Security Issue: https://www.dji.com/newsroom/news/dji-statement-on-reported-data-security-issue
For more inquiries, DJI encourages stakeholders to reach out at: pr@dji.com
