IF YOU'RE A nefarious sort, you might use a commercial drone to smuggle drugs, carry explosives, or to just spy on your neighbors. Drones are appealing to criminals in part because they seem fairly anonymous, flitting through the sky with an invisible digital tether to its owner. But anonymity is no longer a safe bet. In the hands of crime investigators, a drone can reveal a range of personal and financial information about its owner.

Most of these details are stored in memory chips inside the drone's circuit board. Or sometimes a law enforcement official gets hold of a drone's controller instead, which can open up access to its owners' setup account. The exposed data includes credit card numbers, which might be stored in an owner's account for after-market purchases, or GPS information about the drone’s flights. It can even include an email or physical address.

With drones more regularly getting caught up in criminal activity, the National Institute of Standards and Technology has assembled an archive of digital readouts from 14 commercial drones, with the goal of helping law enforcement officials learn how to best extract this little-used trove of data. The NIST reference manual gives step-by-step instructions on how to physically remove the individual SD memory chips from each drone, and what to look for once an agent plugs the card into a computer.

NIST technicians are partnering with a Colorado-based tech firm, VTO Labs, a digital security consulting firm. The NIST archive is a digital training ground for law enforcement analysts to figure out what they might find on a specific drone model that gets picked up as evidence in a crime investigation, says Barbara Guttman, who leads NIST’s software quality group. “When you get the [SD] card back, there may be some handshake information with a PC, or there may be some ways to get latitude and longitude of where it was first flown,” she says.

NIST’s drone database includes an in-depth blueprint of the physical capabilities of each drone, such as its speed, rotor rotation rate, and altitude, as well as the information it might contain on its owner. The guide even has photographs depicting what kind of tools you need to take the drone apart without damaging the built-in flash memory chips that can't be as easily removed as a smart card. “If you have an important case, you don’t want to practice on (the drone itself),” Guttman says.

In Colorado, VTO Labs has collected digital forensic data from a range of devices, including mobile phones and internet-connected appliances, for law enforcement investigations. But in the past three years, CEO Steve Watson says he has been getting more and more requests involving drones. “As they started to receive the devices, they wanted to answer the five basic questions of who, what, where, when, and why,” Watson says. A particularly useful indicator is the record of a drone's first flight, which often takes place at or near its owner's home. “One of the first things a person does is take it out of the box and fly it. As soon as you turn it on it acquires a GPS signal and will mark where it’s flying. In many situations, law enforcement finds it’s the person’s backyard or a nearby park.”

To build its database for NIST, technicians at VTO bought three different drones for each of 14 models and flew them to collect baseline data. The information was collected from circuit boards and onboard cameras, as well as from the pilot's handheld controller and the smartphone apps that run some drones. Watson says the exchange of digital information between a drone and the smartphone app or handheld controller is not as secure as some owners think. One drone had the owner's credit card information stored in a database that law enforcement officials were then able to access.

Watson and NIST aren’t the only digital experts tapping into this cache of personal information that's flying around on drones. A team from the University College Dublin used a DJI Phantom 3 drone as a case study on how to obtain data from its onboard chips. And a Kentucky-based engineering firm announced last month that it would start offering forensic expertise to private individuals who might pursue legal action when a malfunctioning drone crashes into someone or their property, or invades their privacy in some way.

Drone-maker DJI has faced troubles in the past year after the Department of Defense banned federal agencies from purchasing Chinese-made DJI drones because of security concerns. Separately, a private security firm found a bug that could allow hackers to access the DJI drone’s camera and video recorder in-flight.

Watson says his firm trains law enforcement analysts on how to collect drone data that may help lead to a terror cell or prison gang, for example. “We are doing research to identify what data exists and how it can be retrieved,” he says. He says he’s been working with Interpol this month, as well as police forces from Australia and the Netherlands. Many of these nations require drone owners to register their devices in a federal database. That's not the case in the United States, but rogue drone operators better hope that their spy toy or drug mule either lands safely back at home, or crashes out of sight in a really tall tree.

RedHotPoker

'n the hands of crime investigators, a drone can reveal a range of personal and financial information about its owner.
Most of these details are stored in memory chips inside the drone's circuit board.'

Sorry, but that is just plain BS. The aircraft has none of your personal details stored in it, this is the frothy rantings of a technical nitwit. And that is only the sentence I highlighted, the rest of the text is just as full of crap.

Geebax Posted at 11-18 19:58
'n the hands of crime investigators, a drone can reveal a range of personal and financial information about its owner.
Most of these details are stored in memory chips inside the drone's circuit board.'

I was mostly impressed by: “We are doing research to identify what data exists and how it can be retrieved,”


Surely DJI drones are near the top of the drone food chain, and probably contain more info then we ourselves even realize.
I don’t doubt there are numerous bits of personal info, on-board our drones. Aside from our pics and videos.
How they may access it, Is DJI’s secret.


Why I only will fly in airplane mode as well.



RedHotPoker

RedHotPoker Posted at 11-18 20:10
I was mostly impressed by: “We are doing research to identify what data exists and how it can be retrieved,”

The only pics and video files will be those that exist on the SD card at the time they get access to the aircraft. There simply is no room to store them in any 'secret' place inside the aircraft. In any event, what would be the point? As for financial information, what a crock. The trouble with these reports is that they are written by numbskulls who have no idea what they are talking about, and believed by even worse numbskulls. All part of the idea that anything is possible technically these days, but don't let technical facts get in the way.

Geebax Posted at 11-18 22:30
The only pics and video files will be those that exist on the SD card at the time they get access to the aircraft. There simply is no room to store them in any 'secret' place inside the aircraft. In any event, what would be the point? As for financial information, what a crock. The trouble with these reports is that they are written by numbskulls who have no idea what they are talking about, and believed by even worse numbskulls. All part of the idea that anything is possible technically these days, but don't let technical facts get in the way.

I’m not a skull of numbness. Nor am I gullible. I posted the article for exactly this. Discussion.


Thanks for sharing your intelligent reply.
Yes, of course you are correct.


RedHotPoker

I think the cross over occurs with the access to DJI account.

We know that when we fly - we are an activated account - whether we are online or not makes no odds. We cannot fly if we haven't activated our account and the AC registered to our account.

I don't synch my flights - and is why my count has stopped way short of reality. Why not ? Because I do not like DJI having access to my private hobby. None of my other over 55 models  synch back to factory.

My opinion is that the researchers are trying to use the account access that MAY be available if they get a drine handed to them - to try and extract further info.

Financial info - even in China is date stamped and I have accounts in many countries incl. China ... any info of any account I have if used for transaction or other is deleted after transaction is completed ... only bare Account Statement is retained. It may be possible DJI retains credit card details if you make online purchase or via your DJi account ... then if agency can access your DJI account - who knows what they can hack out of it.

I tend to side with Geebax on this ... but with reservation based on the Registered Account each flyer has with DJI.

Very few other Drone companys will have similar to DJI ... as they do not have such in-depth account / interaction ... I can only think maybe Yuneec ? Xaoimi and others certainly do not.

Nigel

solentlife Posted at 11-19 09:30
I think the cross over occurs with the access to DJI account.

We know that when we fly - we are an activated account - whether we are online or not makes no odds. We cannot fly if we haven't activated our account and the AC registered to our account.

Given that the drone was delivered after I bought it, and I payed by PP, it would not have any financial information contained in it. And I have NEVER synched my flight records. Nor has the aircraft, RC Unit or tablet EVER been able to make contact with the outside world since trhe day I got it. It simply is not possible.

These thoughts, give me calm.

Thanks for pointing out the discrepancies of the above article.

I appreciate that. A lot.

RedHotPoker

Thanks for sharing

jacksonnai Posted at 11-19 18:12
Thanks for sharing

Do you fly in airplane mode? ;-)

Only...
Anyway this was news “last”week..
http://www.fortune.com/2018/11/08/drone-dji-security-vulnerability/
https://www.databreaches.net/a-dji-bug-exposed-drone-photos-and-user-data/
https://www.securitynewspaper.com/2018/11/10/vulnerabilities-in-dji-drone-manufacturer/

Read these things and it makes you more aware.
Hackers on this forum, stealing our privacy.
https://www.hackread.com/dji-drone-vulnerability-photos-data-exposed/

Can anyone from DJI ever respond to these posts?

Are they even allowed to comment!?

RedHotPoker

I think it is now safe to assume that any electronic data device has data that can reveal information that is likely personal to who is using it or owns it or both.  What I got from the article is that there is data that can be mined, whether it is always the things they listed or not is up for debate.  However, I don't see why it is not possible that someone is asked for a credit card number to secure their ability to fly in a restricted zone, I have seen the system ask for this, and if the user were to input that info than it is quite reasonable to believe that that info could remain in the buffer for some period of time, if not stored in some file for that flight.  Conversely, if someone zeros out their micro SD card each time and reformats it etc. then some of the data to be mined that they referred too would not be found.  In general it was about clues that LE can use based on what info they actually find, it might tell them what they want to know or it could end up being absolutely  useless.  Lastly, I think it matters greatly what you find or tap in to i.e. whether you find the drone or get the controller or both...this could lead to the users account which could be subpoenaed which might lead them to the owner or perpetrator.

Bottom-line, when dealing with anything on-line, electronic, computer, etc. you should practice secure procedures that will limit your exposure to being hacked or loss of personal data and realize that nothing is foolproof or fully secure.  Based on past DJI findings I would not be surprised to find that there are backdoors to these systems put there by the company itself.
Just my 2 cents...

Genghis9 Posted at 11-19 20:06
I think it is now safe to assume that any electronic data device has data that can reveal information that is likely personal to who is using it or owns it or both.  What I got from the article is that there is data that can be mined, whether it is always the things they listed or not is up for debate.  However, I don't see why it is not possible that someone is asked for a credit card number to secure their ability to fly in a restricted zone, I have seen the system ask for this, and if the user were to input that info than it is quite reasonable to believe that that info could remain in the buffer for some period of time, if not stored in some file for that flight.  Conversely, if someone zeros out their micro SD card each time and reformats it etc. then some of the data to be mined that they referred too would not be found.  In general it was about clues that LE can use based on what info they actually find, it might tell them what they want to know or it could end up being absolutely  useless.  Lastly, I think it matters greatly what you find or tap in to i.e. whether you find the drone or get the controller or both...this could lead to the users account which could be subpoenaed which might lead them to the owner or perpetrator.

Bottom-line, when dealing with anything on-line, electronic, computer, etc. you should practice secure procedures that will limit your exposure to being hacked or loss of personal data and realize that nothing is foolproof or fully secure.  Based on past DJI findings I would not be surprised to find that there are backdoors to these systems put there by the company itself.

Thank you ... that is my point.

Geebax - you registered with DJI to fly it ? to get GO to work etc.

Many buy from DJI ... many use Credit Cards.

Not only buying the AC but also accessories ... syncing flight records ... etc.

Our AC carries the data on board and formatting the SD card makes no difference. The data they want is on the internal card.

I do not accept the original post - but a limited possibility is viable in my view. Especially if you are a customer to any DJI  outlet ......  

Nigel

I often wonder how much benefit, flying only in Airplane mode really does?


RedHotPoker

RedHotPoker Posted at 11-20 10:55
I often wonder how much benefit, flying only in Airplane mode really does?

Airplane mode has nothing to do with this matter. Airplane mode is purely to lower the call on the processing power / ROM and RAM of the tablet / phone ... to maximise resources to GO / Litchi or whatever command APP you are using for your flight.

Nigel

Airplane mode prevents those 15 other obtrusive websites that try to connect to your setup, when you sign in to the flight app.

This has been discussed plenty, in the past.

Have you already forgotten?


RedHotPoker

solentlife Posted at 11-20 04:38
Thank you ... that is my point.

Geebax - you registered with DJI to fly it ? to get GO to work etc.

'Geebax - you registered with DJI to fly it ? to get GO to work etc.'

DJI never had my credit card information in the first place. And how would such info get into the aircraft? More importantly, why would it be in the aircraft? All this sort of speculation simply fuels the paranoia of those who don't have a clue technically, but believe in magic.

solentlife Posted at 11-20 11:36
Airplane mode has nothing to do with this matter. Airplane mode is purely to lower the call on the processing power / ROM and RAM of the tablet / phone ... to maximise resources to GO / Litchi or whatever command APP you are using for your flight.

Nigel

Not true, Airplane Mode is primarily designed to shut down radio transmission services so they have (theoretically) less chance of interferring with an aircraft's electronic systems.

I continue to fly, free...


RedHotPoker

Geebax Posted at 11-20 12:57
Not true, Airplane Mode is primarily designed to shut down radio transmission services so they have (theoretically) less chance of interferring with an aircraft's electronic systems.

That is bringing in the original intention of Airplane Mode to a conversation that is irrelevant.

Yes AM was introduced so you did not have to switch off your mobile when travelling on a commercial airliner.

But this thread - with typical RHP input - mentioned AM ... so I answered based on the known advantage of selecting AM to reduce load on the phone / tablet  - to allow maximum processing of GO / Litchi ...  

Whether that is inbound or outbound makes no odds - its still reduced load on the tablet / phone.

Nigel

Geebax Posted at 11-20 12:55
'Geebax - you registered with DJI to fly it ? to get GO to work etc.'

DJI never had my credit card information in the first place. And how would such info get into the aircraft? More importantly, why would it be in the aircraft? All this sort of speculation simply fuels the paranoia of those who don't have a clue technically, but believe in magic.

Oh Dear ..... who-ever said you gave CC details ?

The premis is that information is obtainable to whatever degree ... from just your registered with DJI ... which is most likely all it is with you ... to others who make purchases from DJI with CC etc.

The fact is that when we inter-act with others ... a trail creates.

So if YOUR AC was in authorities hands - they can most likely determine your account registration with DJI. Whatever else they can get depends on YOUR level of interaction with DJI.

No-one is claiming the AC has all the info ... what is suggested is that the AC will crack open the door to further info that could be held by DJI or the Drone company based on the owners dealings with them.

Blimey - this is hard work breaking through the crap barriers ... and I reject your implied insult.

Nigel

solentlife Posted at 11-21 03:07
Oh Dear ..... who-ever said you gave CC details ?

The premis is that information is obtainable to whatever degree ... from just your registered with DJI ... which is most likely all it is with you ... to others who make purchases from DJI with CC etc.

Two things, the shutting down of the radio transmission from the  phone/tablet is just as important as reducing the processor load. That's why I replied.

Secondly, you said: 'Geebax - you registered with DJI to fly it ? to get GO to work etc.'
Followed by: 'Many buy from DJI ... many use Credit Cards.'


One would assume you meant the two to be taken in concert with each other. In my case, I did not buy from DJI, and seeing as the registration was some weeks after the purchase, and there was no information given to DJI at the time of registration and no personal details on my tablet, there is nothing that could be stored anywhere that could be revealed.


There was also no implied insult, my comments were directed at those who, without sufficient technical knowledge, make the magical assumptions that all their private data is extracted and stored on the drone for nosy cops or whoever to find. My first response to this is 'how did the information get there' and what proof does anyone have that it is there.


If the cops get your drone, you can be quite safe in assuming that they will not find anything, because, apart from anything else, they are too dumb to know how to find anything anyway.


RHP has copied the text from some report written by a person of limited technical knowledge and simply apes the usual technical ignorance and sensationalism that is practiced by that type of writer, usually from the press.


My only reason for commenting on RHP's original post is because it plays into the hands of the idiot (and his ilk) who wrote the crap in the first place.

Eh, thanks for the friendly banter boys.

I certainly appreciate the civility in your prose.


Please have a great day. One & all. ;-)



RedHotPoker

Hi Geebax ...

No the two were not to be in concert with each other.

I agree that the text quoted by RHP is typical paranoid crap from those who want to create a sensation. But it does have a tiny bit that is relevant. Albeit small.

The moment anyone registers an item whatever it is - that then becomes a record. It may only be registration data and simple ... it could if the registration process entails purchase - mean greater detail in the records. I fail to understand why anyone says this is not the case. Its not the drone with the info on board. The drone / controller will with a knowledgeable person allow them to find out the registration ...

I know this as fact having purchased a second hand P3P ... I actually could identify the 2 previous owners through the registration and flight records ... I could identify exactly where and when they flew ...

Nigel

Geebax Posted at 11-21 13:50
Two things, the shutting down of the radio transmission from the  phone/tablet is just as important as reducing the processor load. That's why I replied.

Secondly, you said: 'Geebax - you registered with DJI to fly it ? to get GO to work etc.'

I only shared something that was sent to me.from wired.com.
They deluge my mailbox with two or three emails a day, containing five or six articles each, of varying topics.

Besides I have nothing to hide, Zero! & so I could actually care less.
A conversation was started and that’s the point.

RedHotPoker

We worry about information shared from drones ????????  Here we are using the internet !!!!!!!

I'm outa here !

Hahaha

My comment comes a bit late to this, but I did go through a lengthy forensic data analysis note that I found on the web a few months ago. It clearly outlined how to recover the DJI serial number from the data train while in flight. This is the RC S/N you see on your controller display. This number is actually the S/N you will find on your IMU chip (having repaired my P3P after an early crash). If you crash somewhere, say into a cathedral stained-glass window, a prison yard, or a reactor, this is physically on the motherboard. From there on, as pointed out above, DJI has whatever information you have shared with them.
Have fun & good flying!

RedHotPoker Posted at 11-22 01:29
I only shared something that was sent to me.from wired.com.
They deluge my mailbox with two or three emails a day, containing five or six articles each, of varying topics.

Hi RHP ... putting aside others derogatory remarks - we may differ frequently on various here .. but this thread you started is not without merit.

As Manxmann says - we are playing on the Internet - well some of us do have barriers up to hide under - but majority are at mercy of that WWW !

The matter of info gleaned from your Multi-rotor ... I do hate the warmongers term Drone ! ... is actually a matter of concern, whether its just your registration name or ID ... or more.

We live in a world of evermore Big Brother ... boy do I now it !! The world I work in - you could never imagine the levels and crap that authorities stoop to.

It is no surprise with the idiots who are ruining generally the RC model hobby (we can leave out the so-called Professional users - not all but most !)  that authorities look to ways of curbing / investigating to limit our actions.
It is always first action to get at the registration / information part ..

Whether they are successful or not - does not mean they do not try. As we are well aware - bureaucrats don't all come in intelligent form !! They have an agenda and often they form it to suit purpose.

Personally it is a matter that should be watched - because as DJI evolve their FW and limitations on us - we can never be sure of what will be required or recorded. We already have reports of having to carry out a short questionnaire after updating - so the AC will fly ... luckily that is only relevant to a small number of owners. We have Parts 101 .. 107 in USA ... the Candian regs ... and our UAV EU regs ... with all sorts of registration / information clauses ... it can only get worse.

Geebax .. I appreciate and understand your stand on this - but your personal circumstances are not same as others and your singular refusal to look wider at the matter surprises me. You may find in the future that you can no longer refuse to give some info ... it may be required to continue operating your UAV. Whether its DJI or Govt agency instigated. Who knows what lurks around the corner ? You and I certainly don't know.

Nigel  

Hmmm....

So if I steal and use somebody else's quad (let's say RedHotPoker's) then THEY would get snagged for whatever shenanigans I might think up -- for example, attaching a 'F*CK TRUMP!' banner and flying it onto the White House grounds?

No, mine is already getting the banner approach. Haha
















RedHotPoker

Wow,
A LOT of info in this thread.
It just confirms my continued desire to never fly my AC into anything or anyone.
Happy Flights and Photos to all !!

Sam Drucker Posted at 11-24 14:39
Wow,
A LOT of info in this thread.
It just confirms my continued desire to never fly my AC into anything or anyone.

Why or how could this happen? To a responsible rc pilot...

You only fly in open areas away from people or structures that could cause disaster.

No trees or distracting personalities to foul you up...


Fly free, safe and happy forever... in airplane mode. Haha


RedHotPoker

RedHotPoker Posted at 11-24 15:25
Why or how could this happen? To a responsible rc pilot...

You only fly in open areas away from people or structures that could cause disaster.

I still don't understand "airplane mode".
Is that for my AC/RC or just on my smarter than me phone ?

Sam Drucker Posted at 11-25 11:14
I still don't understand "airplane mode".
Is that for my AC/RC or just on my smarter than me phone ?

Airplane mode :

A mode you select that stops all transmissions out of a Smart Phone or Tablet. It disables all communications - but you can individually select which to enable if required while still disabling all others.

It was designed to allow you to carry on a Commercial Aircraft and not interfere with electronic apparatus on the aircraft without having to switch off completely the phone.

The advantage to us as Drone flyers - is that we can use it to reduce the load on the processor and in so doing allow maximum to the Go / Litchi APP for our flight.

Nigel

Sam Drucker Posted at 11-25 11:14
I still don't understand "airplane mode".
Is that for my AC/RC or just on my smarter than me phone ?

Which device are you mostly using to fly?

Or do you have a dedicated device, like an iPad  Air2 or perhaps an Android, Google device . . .


If you go into Settings, Airplane is the very top selection for me., above wifi and Bluetooth.

Most any phone or tablet “should” have this feature. AFAIK


RedHotPoker

RedHotPoker Posted at 11-25 14:44
Which device are you mostly using to fly?

Or do you have a dedicated device, like an iPad  Air2 or perhaps an Android, Google device . . .

Hi,
Thanks for explaining airplane mode. I have seen it on my cellphone.
I'm flying the Pro 4 plus with built in display, no need to change my phone settings unless I super size my AC.  Even then, I might want to leave the phone on so I could call and say " Hey, come move your car so I can land.

James

Are you going to close the Go app, to call? ;-)


RedHotPoker

Sam Drucker Posted at 11-26 13:51
Hi,
Thanks for explaining airplane mode. I have seen it on my cellphone.
I'm flying the Pro 4 plus with built in display, no need to change my phone settings unless I super size my AC.  Even then, I might want to leave the phone on so I could call and say " Hey, come move your car so I can land.

There are other reasons for flying in Airplane mode...

The 15 invasive websites associated with DJI app...



RedHotPoker

If I did or didn't believe the article, How is it going to change what we do? Governments can do more than what we know. If we knew it all, they would have us working for them or maybe we would come up missing. Oh no! they have a beam on me right now reading my brain waves! I'm safe, they got nothing.

Tin foil hats are all the rage, even in Switzerland. Hahaha










RedHotPoker