News

2021.11.18 08:00

Lithuanian institutions use Chinese drones suspected of leaking information – LRT Investigation

Mindaugas Aušra, LRT Investigation Team, LRT.lt2021.11.18 08:00

Lithuanian intelligence services, the military, the police, and the State Border Guard Service use hundreds of drones branded with the DJI logo. Meanwhile, the US and Western Europe say there is growing evidence that the Chinese manufacturer Da-Jiang Innovations is collecting data on critical infrastructure, LRT Investigation Team reports.

DJI drones account for around 70 percent of the global market. Lithuania is no exception. LRT Investigation Team has analysed public procurement contracts, dating back to 2018, and found that at least 50 contracts have been signed for the purchase of 150 Chinese-made unmanned aerial vehicles (UAVs).

Read more: Lithuanian MoD moves to ban Chinese, Russian tech

Last year, the Lithuanian Army’s Grand Duke Gediminas Battalion purchased DJI drones for almost 3,000 euros. Since 2018, at least six other national defence institutions in Lithuania have acquired Chinese-made UAVs.

The current leadership of the Lithuanian Defence Ministry says it is aware of the issue. According to the ministry, the Lithuanian army has around 100 Chinese drones that could pose a security threat.

“Yes, the Lithuanian Armed Forces have acquired such drones, mostly in 2017-2019,” Margiris Abukevičius, Lithuanian deputy defence minister, told LRT.lt. “We are certainly talking to our allies about threats posed by Chinese technology, and we have information about these drones.”

Reports about Chinese-made UAVs, capable of collecting important information, posing issues for Western militaries started appearing a few years ago.

Read more: Lithuanian customs sign contract with Chinese tech firm despite security concerns

In 2017, the US Department of Homeland Security announced that DJI drones were sending sensitive information on critical infrastructure to China. A year later, the Pentagon banned DJI drones from the American market due to cybersecurity concerns. In 2019, the US Congress passed a law prohibiting the country’s defence institutions from using any Chinese-made UAVs.

According to Abukevičius, the Lithuanian Defence Ministry is not planning to carry out a separate assessment of the DJI drones’ security risk to Lithuania. According to him, the country trusts the information provided by its allies.

“It is important to stress that Chinese drones are primarily used for PR, for filming events, and also for soldiers’ basic training on how to camouflage and spot a drone,” the deputy defence minister said. “Different drones are used for real operations.”

According to the ministry, next year, the national defence system will become subject to procurement screenings that will no longer allow the purchase of equipment from Chinese manufacturers.

Chinese drones everywhere

The Lithuanian military is not the only organisation using Chinese drones in the country. This year, Litgrid, which manages Lithuania’s electricity transmission networks, has purchased DJI equipment for almost 30,000 euros.

Klaipėda’s Chief Police Commissariat and the Criminal Police Bureau have also spent several thousand euros on Chinese drones.

Read more: Huawei, Xiaomi phones pose cyber security risks, finds Lithuanian probe

The Klaipėda Police said it has a total of three DJI drones. It claimed it knew about data security concerns when buying the equipment, but “for the time being, this manufacturer offers the best value for money on the market”.

In April, the Lithuanian Criminal Investigation Centre bought 20 drones for more than 50,000 euros. It says that it uses this equipment to monitor traffic and other incidents, to search for missing people, as well as to train officers.

Lithuania’s Special Investigation Service bought DJI drones in 2018. It did not reveal the exact number of Chinese equipment it has or its purpose, claiming it to be “sensitive information”.

The State Border Guard Service (VSAT) also said it could not provide detailed answers to questions about DJI drones. VSAT purchased Chinese-made UAVs for more than 70,000 euros in 2019-2020.

The Lithuanian Military, VSAT, and some police departments said they were aware of possible data leaks using DJI’s drones.

But other institutions that own the equipment, including the Fire and Rescue Department, Litgrid, the National Paying Agency, the Environmental Protection Department, and the Territorial Planning and Building Inspectorate, say they have not received any warnings about the possible threats posed by the Chinese-made drones.

Antanas Petrauskas, head of Promaksa, one of the largest DJI drone suppliers in Lithuania, said the country’s public sector institutions purchase hundreds of such UAVs every year.

Promaksa has been supplying DJI drones since 2014. According to Petrauskas, it has not yet received any real evidence of possible data breaches.

“As far as I have been able to find out, the Pentagon has done some research, but it has not found any built-in chips, any data leakage device, or any software code,” Petrauskas told LRT.lt.

But Domantas Bručas, a researcher in aeronautics, argues that neither the VSAT, nor the military should use DJI drones.

“There is no doubt that this equipment raises security concerns because the data can be leaked,” Bručas said. “The main problem is that drones collect their flight positions, routes, and camera records. Using these drones in the military and at the border could be quite dangerous.”

Mums svarbus tikslumas ir sklandi tekstų kalba. Jei pastebėjote klaidų, praneškite portalas@lrt.lt