Second in a two-part series. Read part one here.
The Chula Vista Police Department is deploying Chinese-made surveillance drones the Pentagon has said are a potential risk to national security.
This assertion came last July regarding drones produced by Chinese manufacturer DJI. Eight of the 10 Chula Vista Police drones are made by DJI, according to the city’s website.
Chula Vista in recent years has made use of drones and other surveillance technology central to its police work. City leaders insist these tools do not jeopardize the privacy of their law-abiding residents.
Privacy and civil liberties experts argue that the facts say otherwise.
“When a product is so bad for privacy that even the Pentagon is refusing to use it, I think that should be raising alarm bells,” said Albert Fox Cahn, executive director of the New York-based Surveillance Technology Oversight Project.
Fox Cahn and other advocates are also concerned about a contract the city has with the Chicago-based tech conglomerate Motorola Solutions to provide software for it’s real-time operations center. Among other things, the center is a clearinghouse for data gathered by drones and other surveillance technologies.
In the contract, Motorola disclaims any liability for DJI’s use of the data it collects through the drones.
KPBS reached out to the Chula Vista City Council and Mayor Mary Salas, who approved the contract, but they refused to comment. Also refusing to comment were City Manager Maria Kachadoorian and City Attorney Glen Googins, both of whom signed the contract with Motorola.
San Francisco lawyer Will Cooper, who specializes in contractual disputes, says there’s good reason why Motorola would want that limitation on liability.
“The more risky it is, the more sensitive it is, the more likely the parties to that agreement are going to want to get the most protection they can,” Cooper said.
Industry leader
DJI is among the world’s leading drone manufacturers, accounting for more than half of the global market. But the Defense Department has been one of several federal agencies in recent years to flag the company for security concerns.
The United States Department of Homeland Security stated in 2017 that “DJI Science and Technology is providing U.S. critical infrastructure and law enforcement data to the Chinese government.”
Chula Vista Police started its drones as first responders program in 2018. In 2019, the Interior Department grounded hundreds of Chinese-made drones, including those made by DJI because of security concerns.
“People don't realize the depths of Chinese espionage and the fact that they use any opportunity,” said Jim Lewis, a researcher at the DC-based, bipartisan Center for Strategic and International Studies. “We face the biggest espionage battle we've ever had with China. The way people engage in espionage has changed. It's moved largely to technology and digital devices.”
RELATED: Chula Vista's contract with Motorola sells out residents' privacy, advocates say
How could the Chinese government get data from a drone in Chula Vista?
Technology experts say it starts with the fact that DJI can still access a drone’s software even after it’s been sold. Lewis says just like a cell phone carrier has access to customer data, DJI – and by extension the Chinese government – could view drone footage remotely by tapping into the software when it’s being updated.
Motorola’s contract with Chula Vista references that the police agency has requested the software.
Collecting data on Americans
DJI refused an interview request from KPBS. It instead sent a statement it had originally released last year after the U.S. Department of Commerce put the company on its “Entity List,” due to national security concerns.
“DJI has done nothing to justify being placed on the Entity List,” the statement said. “We have always focused on building products that save lives and benefit society.”
Update: After this story was published, Adam Lisberg, DJI's director of corporate communications, sent an email to KPBS saying that the company's drones cannot spy remotely as Lewis and others assert.
"DJI drones, controllers and apps are built to be used entirely offline, with no internet connection required, eliminating any possibility of data leakage," Lisberg wrote in his email. "DJI does not have the ability to access customer data such as photos, videos and flight logs unless customers explicitly agree to share it with us."
Lewis said he has spoken to DJI representatives who maintain the company does not turn over data to the Chinese government. However, he added that companies in China have only one option if the government makes a request.
“It doesn't matter because they don't have the right to say no in China under Chinese law,“ Lewis said.
And privacy experts say it’s not out of the realm of possibility that China would have interest in a place like Chula Vista.
“The Chinese government has not been terribly secretive about the fact that they're very interested in building out huge databases, particularly when it comes to American data,” said Leah Walker, a defense technology associate for the San Francisco-based Institute for Security and Technology.
RELATED: Chula Vista Police Drones Can Now Cover 100% Of City For Emergency Calls
She said this effort to collect as much data as possible on Americans, combined with Chula Vista’s proximity to the border, could make the city interesting to the Chinese.
“We're living in the area of open source intel, and you can tell an amazing amount of things from just basic data,” Walker said. “I mean, there have been secret military bases found in the Middle East just because the soldiers were in Fitbits.”
More than 1,500 law enforcement agencies across the U.S. use drones, many made by DJI, according to a 2020 report by Bard College in New York state.
”There's really a limited amount that the federal government can do there because police departments are going to buy what they want,” Walker said.
