In the early morning hours Monday, a small drone operated by a drunk American spy agency employee crashed on the White House grounds. While many observers found the incident rather entertaining, the drone’s manufacturer, DJI, did not: It announced that it was going to update the software controlling the drone to prevent similar incidents from happening in the future. It will accomplish this by expanding the no-fly zones already coded into the aircraft’s software. The ability of DJI to exert control from a distance over where its aircraft are flown is exemplary of what legal scholar Lawrence Lessig has called the threat code poses to liberty.
DJI is a privately held Chinese company. Company spokesman Michael Perry says that though DJI doesn’t release specific sales figures, the Phantom line of drones (the type that crashed at the White House) are the world’s most popular drones. DJI sells several variants of the Phantom, all of which are equipped with built-in GPS units. That GPS capability makes the Phantom easier to fly—it can, for instance, hover without pilot intervention at specific GPS coordinates even in a moderately strong wind. But the GPS also introduces the possibility of outside control.
When the Phantom first shipped in January 2013, DJI hadn’t placed any restrictions on where a user could fly it. Regulations—by the FAA in the United States and other bodies elsewhere—placed restrictions on where drones could be flown, but these restrictions were not coded into the Phantom’s software. About a year ago, says Perry, DJI updated the software to prevent the drone from flying close to 3,500 airports around the world. Perry says that DJI’s intention was to look first at the largest airports in the world. However, Dubai International Airport, one of the world’s busiest, is notably missing from DJI’s list.
Perry says that, in the next couple months, DJI will update the list to a more comprehensive map of more than 10,000 airports. The absence of the world’s busiest airport from a list meant to safeguard air safety is notable only insofar as it points to the capricious nature of relying on de facto enforcement of regulations by software.
In addition to newly added airports, Perry says that DJI’s software will forbid flights within a 15.5 mile radius of downtown Washington, D.C, in order to comply with FAA Notam 0/8326. That circle has an area of about 750 square miles, or roughly 1.5 times the area inside Washington’s Beltway. Perry says that DJI had been planning this for a while but is speeding up implementation in response to the White House drone crash, and plans to release the update within a week. Because the Phantom drones are not connected to the Internet, there is no way for DJI to force users to update their software; however, by making the no-fly zones part of firmware updates, DJI can in effect hold new features hostage, making them inaccessible to users who aren’t willing to accept the no-fly restrictions.
But the FAA regulation prohibits unmanned aircraft flights in a zone around the nation’s capital—it doesn’t require that manufacturers attempt to make such flights impossible. Additionally, Perry says DJI will implement software restrictions that prevent flights across national borders and “other sensitive sites.” The restriction on flights across borders is, in part, a response to a drone that crashed carrying six pounds of methamphetamine earlier this month in Tijuana, Mexico, near the U.S. border.
The question is, how are national borders to be defined? I asked Perry how DJI intends to define them. He answered: “with great difficulty.”
As Lessig pointed out in his 2000 essay “Code Is Law”: “The code regulates. It implements values, or not. It enables freedoms, or disables them.” Perry says that “we can’t build in safeguards for stupid, or irresponsible I should say.” However he goes on to ask: “If we can provide people tools to fly safely and responsibly, why wouldn’t we?”
This conjoining of safety and responsibility is at the root of the problem with DJI’s approach. There is a role for both software fixes and government regulation in protecting air safety distinct from that in promoting “responsibility,” which is a much more difficult concept to enunciate.
Perry acknowledges that workarounds to DJI’s software barriers are always possible—“ultimately we could put in 100 different stopgaps, someone will find 101 ways to get around them.” His company’s goal, he says, is simply to make it “difficult for somebody to do something irresponsible or illegal” with one of its drones, while still allowing users to exploit the potential of the technology.
This sounds unobjectionable enough. The problem is that DJI becomes the arbiter of what is or is not responsible. In China today, DJI has implemented 31 no-fly zones. Thirty of them are at airports, and the last in Tiananmen Square.