The Buffalo Police Department (BPD) has recently built out a fleet of unmanned aerial systems—commonly known as drones—without the approval of the Buffalo Common Council or authorization from the Federal Aviation Administration (FAA). Some BPD drones are made by a federally blacklisted Chinese military company called DJI, which shares civilian drone flight and sensor data in real time with China’s government according to U.S. intelligence and anonymous sources within DJI. Other BPD drones are designed for military reconnaissance and strike teams, cost $10,000 dollars, and weigh about one pound each.
A DJI Mavic Air 2 in flight, © C.Stadler/Bwag; CC-BY-SA-4.0
According to purchasing records I obtained through a Freedom of Information Law request, the administration of Mayor Byron Brown purchased for BPD two DJI Mavic drones from B&H Photo in May 2020, two Loki MK2 drones from Aardvark Tactical along with a DJI Mavic from Enterprise UAS in May 2021, a Loki MK2 from Aardvark in December 2022 to replace a Loki that had crashed, and another DJI Mavic from B&H Photo in June 2023.
BPD’s use of DJI drones poses national security risks. In August 2017, sUAS News reported that the U.S. Army issued a prohibition on its use of DJI drones due to “cyber vulnerabilities,” citing a classified Army Research Laboratory report and a Navy memorandum from May 2017. A few days later, the U.S. Immigration and Customs Enforcement Special Agent in Charge Intelligence Program Los Angeles assessed with moderate confidence that American-operated DJI drones are “providing U.S. critical infrastructure and law enforcement data to the Chinese government” and assessed with high confidence that DJI “is selectively targeting government and privately owned entities within [infrastructure and law enforcement] sectors to expand its ability to collect and exploit sensitive U.S. data… that the Chinese government could use to conduct physical or cyber attacks against the United States and its population.”
Bloomberg reported in March 2020 that DJI created a program for China’s air force to track civilian DJI drones and identify drone operators from their phone numbers and that DJI partnered with China’s government to provide drones for the Xinjiang Public Security Bureau, which operates internment camps for the arbitrary detention of over one million Muslims (the largest internment of an ethnoreligious group since the Holocaust). In December 2020, the U.S. Department of Commerce banned American companies from selling components and other technologies to DJI, claiming that the company, along with three others, has “enabled wide-scale human rights abuses within China through abusive genetic collection and analysis or high-technology surveillance.”
Some of BPD’s DJI drones possess “intelligent flight modes” that allow them to autonomously follow targets including vehicles and pedestrians, although federal regulations prohibit flying drones outside of a remote pilot’s line of sight and prohibit sustained flight over people and moving vehicles by heavier drones with exposed rotors, such as BPD’s DJI Mavics, or by drones without Remote ID, such as the Loki MK2. FAA regulations also prohibit drone operation at night without anti-collision lights, but BPD’s $7,274 dollar Mavic 2 Enterprise Advanced includes a “discrete mode” that turns off its navigation LEDs so the drone can operate undetected while using thermal imaging to see in the dark.
A review of the approximately 13,000 active FAA authorizations for drones registered in New York State reveals only one attributable to BPD—a DJI Mavic registered to its SWAT team. The Buffalo News bears two drone registrations—also for DJI models—and the Erie County Sheriff’s Office is down to one Autel drone (made by a Chinese competitor of DJI) after registrations for its three DJI drones expired in January 2023.
BPD’s only FAA authorized drone was registered May 23, 2022, but Police Commissioner Joseph Gramaglia had earlier disclosed use of a BPD drone to search for a missing woman in January of 2022, while serving as a deputy commissioner. BPD later published a glimpse of its drones in a May 2023 social media video, which also shows off its Vantage robot and Lenco BearCat SWAT truck. Unlike in the case of six $8,626 sniper rifles—or even for an innocuous $2,500 dollars worth of second-hand groundskeeping equipment—none of BPD’s drones (nor its Vantage robot or Lenco BearCat) appear to have been the subject of requests to the Buffalo Common Council for permission to purchase.
BPD has not provided other drone-related records I requested, including records of the funding and bidding for its drone purchases. Only some of the provided purchase orders reflect that drones were purchased pursuant to a bid. They also show that most of the drones were ordered by BPD’s grants office, but the leading provider of law enforcement grants, the U.S. Department of Justice, forbids the purchase of DJI drones with its grant money and requires that drones which aren’t forbidden to be accompanied by a comprehensive risk mitigation plan as well as policies and procedures for cybersecurity, for privacy protection, and to ensure compliance with federal law, regulations, and the U.S. Constitution. BPD’s Manual of Procedures does not cover drone use, and BPD did not provide any policies, procedures, or any records other than purchase orders in the time that BPD allotted to respond to my request for all its drone-related records.
BPD’s steadily growing fleet of currently up to six drones is known to few and appears to be operating without the federal oversight which is required by law. The drone fleet’s capabilities and vulnerabilities pose significant safety hazards, security risks, and threats to civil liberties. Drone technology must be strictly stewarded with appropriate and well-enforced protocols for training, certification, deployment, operation, data encryption, and record-keeping, but BPD may not be exercising any such safeguards, and its records access division has not been able to provide reassurance to the contrary.