Data Security in Drone Mapping: Protecting Sensitive Site Information

A drone survey captures detailed information about your site — its layout, infrastructure, operations, and security features. For many clients, this information is sensitive: a manufacturing facility does not want its layout publicly available; a utility does not want its infrastructure mapped in detail accessible to bad actors; a government facility has strict requirements for how spatial data is handled.

Understanding how drone mapping providers handle data — and what questions to ask — is essential for any project involving sensitive information.

A drone survey produces:

• High-resolution imagery — detailed photographs of the site and everything on it
• Orthomosaic — a georeferenced map showing the precise layout of the site
• DEM — terrain elevation data
• Point cloud — a 3D model of the site

For a sensitive facility, this data could reveal:

• Building layouts and access points
• Security infrastructure
• Equipment and process layouts
• Operational patterns (if the survey is conducted during operations)

Where is your data stored? Cloud storage is convenient but introduces questions about who has access and under what circumstances. On-premises storage provides more control but requires the client to manage storage infrastructure.

For sensitive projects, ask specifically:

• Where is the data stored?
• Who has access to the data?
• Is the data encrypted at rest and in transit?
• How long is the data retained?
• What happens to the data when the project is complete?

How is the data transmitted from the processing system to the client? Unencrypted email attachments are not appropriate for sensitive data. Secure file transfer — encrypted cloud storage with access controls, or direct transfer via encrypted connection — is the appropriate method.

Where is the data processed? Cloud processing services — AWS, Google Cloud, Azure — are commonly used for photogrammetry processing. For sensitive projects, understand whether your data will be processed on cloud infrastructure and what security controls are in place.

Does the drone mapping provider use subcontractors for any part of the work — flight operations, processing, or delivery? If so, what data security requirements apply to subcontractors?

Drone mapping data of certain facilities — defense installations, critical infrastructure, nuclear facilities — may be subject to export control regulations (ITAR, EAR). Providers working on these projects must understand and comply with applicable regulations.

Government contracts often include specific data security requirements — NIST SP 800-171, CMMC, or agency-specific requirements. Providers working on government projects must be able to demonstrate compliance with these requirements.

Drone surveys may capture imagery of neighboring properties and individuals. In some jurisdictions, this raises privacy considerations. Professional providers understand these issues and plan surveys to minimize unnecessary capture of off-site information.

The use of DJI drones — manufactured by a Chinese company — has raised security concerns in some government and defense contexts. The US Department of Defense has placed DJI on its list of "Chinese military companies," and some government agencies prohibit the use of DJI equipment for sensitive projects.

For government and defense projects, confirm that the drone equipment used does not raise security concerns under applicable regulations.

Before engaging a drone mapping provider for a sensitive project, ask:

1. Where is data stored, and who has access?
2. Is data encrypted at rest and in transit?
3. What is your data retention policy?
4. Do you use cloud processing services? If so, which ones and what security controls are in place?
5. Do you use subcontractors? What data security requirements apply to them?
6. What drone equipment do you use? Are there any security concerns with that equipment for our application?
7. Can you sign a data security agreement or NDA?

Data security is a legitimate concern for drone mapping projects involving sensitive facilities or information. Professional providers understand these concerns and can implement appropriate data handling practices. The key is asking the right questions before the project begins.

At Blackridge Geospatial, we take data security seriously. Contact us to discuss data handling requirements for your project.