Over the course of the last several years of industrial UAS market development, the US government has seen “Obvious Malice Intent” from the Chinese UAS manufacturer DJI, with regard to data security. This led to widespread banning of their products in US government applications, both by government personnel and contractors. In an attempt to qualify US manufacturers to a military specification level of data security the Defense Innovation Unit (DIU) launched the Blue sUAS 2.0 Program.
The original mission of the DIU Blue program was to build an onboarding process to qualify for US manufacturers to sell to Department of Defense (DoD) customers by determining if their products met the cybersecurity and supply chain security requirements in the National Defense Authorization Act (NDAA).
While the NDAA only applies to the Department of Defense, some agencies chose to adopt the Blue program rather than create their own requirements. This created a market perception that the Blue program is required for non-DoD and industrial applications. Even those who understand it’s not a requirement often view the Blue program as a way to future-proof their programs against potential future requirements.
In late 2021 Vision Aerial was listed along with ten other US manufacturers representing an array of system and peripheral manufacturers signed to assist the DIU in the development of the process as a beta program. Vision Aerial was ready with 20x products manufactured for delivery to the DIU in February of 2022 for evaluation. However, just days before the submission was scheduled to be evaluated, the requirements changed. These new NDAA requirements removed virtually all modern Ground Control Station (GCS) options from consideration, requiring substantial amounts of engineering and development to meet the compliance.
Working with multiple vendors in parallel throughout most of 2022 to create the compliant technology, Vision Aerial was ready to submit in the fall of 2022 with compliant systems. Unfortunately, largely due to inadequate funding, the DIU failed in their mission to create an onboarding process. While a handful of manufacturers were signed into the program during the beta program, the reality is most of those manufacturers’ supply chain stability, product performance and price points were severely compromised. Additionally, due to the lack of a process to onboard, the ability to qualify updates to those systems was also compromised making many of them out of date immediately.
It took some time for the non-DoD agencies to fully appreciate the implications of using Mil-Spec standards created for war fighters on industrial applications. The results have been aircraft that are 2-3x the price of a comparable industrial off-the-shelf system, have limited feature sets, significantly reduced range, out-of-date software, inability to be updated, long lead times, and are often not available in sufficient quantities.
In response, the more than 50 year old Association for Unmanned Vehicle Systems (AUVSI) launched two new programs to help the industry move forward: 1) AUVSI Trusted Cyber and 2) Green UAS program. Vision Aerial is at the front of the line to go through these processes. The programs are very similar to the Blue program, with two notable exceptions. The green program will still require the same system penetration testing and supply chain security reviews. However, it will remove the military’s Authority To Operate (ATO) requirement which is not relevant to industrial applications and was the primary choke point for the Blue program. It will however, add a corporate hygiene requirement which provides far more practical security protection.
While this process has been arduous, the spirit and intent of the DIU’s program to qualify manufacturers for secure use in government related applications is laudable and we commend their effort. It is our sincerest hope that decision makers in the industry have the wisdom to understand that the Green program is the logical next step that will create the more pertinent and useful industrial version of the program. Improving the practical real-world security of the systems without compromising the lead times, price, system performance or supply chain stability.