17-04-2025
U.K. raises alarm on Chinese drones used to survey sensitive sites
U.K. government officials have raised private concerns that Chinese-manufactured drones are being used to take high resolution images of critical national infrastructure sites in the U.K., going against guidance from the country's security services.
National Grid PLC, which operates the nation's electricity and gas networks, uses drones made by Shenzhen-based SZ DJI Technology to take videos, photographs and thermal images of its electricity substations, according to information posted on its website as recently as September. DJI drones have also been used to survey the construction of Electricite de France SA's Hinkley Point C nuclear power plant, to inspect solar farms, and by Thames Water to monitor reservoirs and the water supply.
Deployment of the drones comes despite a warning in 2023 by the U.K.'s National Protective Security Authority (NPSA), part of the domestic security service MI5, that British organizations managing sensitive sites should be wary of using drones "manufactured in countries with coercive data sharing practices,' a reference to China. Moreover, in 2022, the U.S. Department of Defense included DJI on a blacklist of Chinese firms with military ties.
National Grid said it follows government guidance, while Thames Water said it takes security "seriously.' DJI and EDF didn't respond to requests for comment.
"It is reasonable to be concerned around the alleged widespread use of Chinese drones to map and track the performance of critical U.K. national infrastructure,' said Sam Goodman, senior director of policy at the China Strategic Risks Institute in London. "At the very least, without British companies undertaking modification of these drones, including software patches, this could pose a significant data security and national security risk to the U.K., as DJI is legally required to provide data and cooperation with China's Ministry of State Security under the PRC's National Intelligence Law.'
The role of Chinese companies and equipment in critical national infrastructure has been in focus in the U.K. after the government this weekend took control of British Steel from its Chinese owner, Jingye Group, to prevent it from closing blast furnaces at the country's last virgin steelmaking site.
One British official said the drones issue is challenging as the government tries to balance its public pursuit of closer economic ties with Beijing with its private frustrations that companies working in sensitive areas are not taking seriously the potential security threat posed by China.
Prime Minister Keir Starmer is pursuing closer economic ties with China, even amid those security concerns and President Donald Trump's trade war with the Asian nation. Last year, Bloomberg reported that British officials were concerned Chinese state actors had made widespread — and likely successful — efforts to access British critical infrastructure networks, underscoring fears of vulnerabilities to increasingly sophisticated efforts by foreign powers to compromise security.
The U.S. Federal Bureau of Investigation has warned that Chinese-made drones "pose a significant risk to critical infrastructure' as they "could have vulnerabilities that enable data theft or facilitate network compromises.' Meanwhile, the U.K.'S NPSA's advice to British companies states: "the first line of defense for organizations wishing to use unmanned aerial systems (UAS) may be to restrict UAS and associated component procurement from countries which pose a risk to security.'
Using Chinese-made drones at key sites in Britain poses a risk because Chinese national security laws can compel its companies to share data with the state, according to a U.K. government official who requested anonymity discussing a sensitive issue.
Despite those warnings, Chinese-made products appear to be the go-to drone technology for companies in charge of much of Britain's critical infrastructure. That's in part because DJI is the world's largest maker of commercial drones, leaving firms with limited choice when it comes to procuring low-cost unmanned aerial systems.
The revelation about DJI comes after Bloomberg reported last year that drones used by a second Chinese manufacturer, Autel Robotics had been used by the U.K. military and police, despite the firm being sanctioned by the British government for arming Russia in its war against Ukraine.
The National Grid's website says it uses DJI's Mavic2 drone in its substations, as well as to create models to help plan its "great grid upgrade,' a major program to improve U.K. grid connections. They also use DJI's M350, M300 RTK and Mini 3 Pro drones. A National Grid spokesperson said it has "security measures in place across all our operations which follow the guidance set out by government and the security agencies.'
DJI drones were able to capture "incredibly valuable, accurate data' at the Hinkley Point nuclear power plant, according to Skymatics, a surveying company which ran the project at the site. The site is part-owned by China General Nuclear Power Group. Representatives for EDF did and Skymatics did not respond to requests for comment.
The U.K. government also declined to comment on security matters, while stating that "our energy sector is subject to the highest levels of scrutiny and protection.'
A Thames Water spokesperson said that "as providers of critical national infrastructure, we take the security of our networks and systems very seriously and are focused on protecting them.'
While the dangers of data leaks from drone technology can be mitigated by using an "off-line mode' disconnected from internet networks, security risks remain, and the best course of action is to "prevent high risk vendors from progressing through the procurement process,' according to the NPSA guidance.
