A stock DJI aircraft begins broadcasting a service packet the moment it powers on, containing the coordinates of the aircraft, the takeoff point, and the controller. There is no setting that turns this off — it is built into the link protocol. Anonymisation is the set of methods that substitute, restrict, or block that data so an adversary cannot tie a flight back to the crew's actual position.

A note on terminology. Several methods discussed here are known by Ukrainian and Russian nicknames with no English equivalent. They are transliterated on first use and glossed; the nicknames are what operators and workshops actually say, so they are worth learning rather than translating.

Where Remote ID came from

The requirement for remote identification of unmanned aircraft originated in civil aviation regulation. In April 2019 EASA introduced Direct Remote Identification requirements across the EU. In December 2019 the FAA published its Notice of Proposed Rulemaking, and on 15 January 2021 Remote ID became a formal FAA rule.

The practical consequence for manufacturers: every commercial drone must broadcast an identification message on power-up that the user cannot disable. Pilots register airframes above 250 g, and some EU states add an annual fee and mandatory training for a licence.

The intent was civil — airspace identification, monitoring flights in restricted zones, situational awareness for air traffic and law enforcement, incident reconstruction. At the front, the same function became a leak channel.

DJI moved ahead of the regulators. It fielded its own identification system in 2017, well before the standards became mandatory. AeroScope is not an ASTM or EN standard; it is a closed ecosystem built around DJI's proprietary protocols. The manufacturer built the aircraft and then built the system that sees those aircraft.

What is actually transmitted

DJI identification messages (and Autel's) carry:

• the aircraft's unique identifier;
• current GPS coordinates of the aircraft;
• altitude, speed, heading;
• flight status;
• coordinates of the takeoff point (Home Point);
• coordinates of the operator's controller;
• UAV type and model;
• timestamps and system status flags.

Depending on model and mode some fields may be omitted, but in most cases everything goes out.

For years the prevailing belief was that this data was encrypted and readable only by authorised bodies. Researchers from Ruhr-Universität Bochum and CISPA, in work presented at NDSS 2023, reverse-engineered both the firmware and the physical layer of the OcuSync protocol and built a full receive, demodulate, and decode chain for DroneID packets. The finding was unambiguous: the data is not encrypted, and the positions of both pilot and aircraft can be read with modest equipment. Their receiver ran not only on an expensive Ettus SDR but on the far cheaper HackRF. Earlier, in 2022, DJI confirmed to The Verge that the transmission was in fact unencrypted, following a demonstration by security researcher Kevin Finisterre.

This is the pivot point for the whole subject. The threat is not limited to an adversary owning a factory AeroScope receiver. The protocol is open to anyone with an SDR and the software.

AeroScope as a tool

AeroScope is a passive radio-monitoring system that receives, demodulates, and decodes the service transmissions DJI aircraft emit. It establishes no connection with the aircraft, sends no commands, and does not interfere with the control link. It is receive-only.

Under ideal conditions the stationary unit monitors a radius of up to 50 km and pulls key information from an aircraft within about two seconds. The portable G8 covers roughly a 30 km radius.

How this played out for Ukrainian crews: in March 2022 Vice Prime Minister Mykhailo Fedorov publicly wrote to DJI stating that AeroScope units were being used to target Ukrainian operators. A representative of Aerorozvidka confirmed to RFE/RL that cases of pilots being struck and killed exist. A spokesman for the air reconnaissance unit Karlson described the kill chain to C4ISRNET: five to six minutes from detection to artillery or MLRS fire. DJI suspended sales in Ukraine in April 2022, and in March 2023 discontinued production and sale of AeroScope itself; the portable version had already been pulled in August 2022.

Discontinuing the product changed little. Fielded units still work, and decoding DroneID no longer requires the manufacturer's hardware.

Why you cannot simply switch off GPS

A design constraint in DJI aircraft blocks the obvious answer. If the aircraft has not acquired coordinates and set a Home Point after power-up, it falls back to a restricted mode capping range and altitude at 30–50 metres depending on model. Jamming your own GPS therefore grounds you.

Home Point also determines the regulatory region for the radio link. FCC (US) and CE (Europe) set different transmit power ceilings in dBm, with FCC permitting higher power and operation on 5.8 GHz, while most EU states allow only 2.4 GHz for UAVs. Anchoring the coordinates to the right location unlocks the higher-power mode and better link range.

Hence the base principle behind every anonymisation method: if the coordinate broadcast cannot be switched off, substitute the reference point everything else is derived from. The aircraft sets a Home Point at shifted coordinates and continues broadcasting exactly the same fields, offset.

The "kanadka"

The first method fielded at scale, developed in Ukraine for front-line use. A small interposer board is fitted between the aircraft's GPS module and the mainboard; during power-up it feeds the flight controller chosen coordinates instead of real satellite fixes. The nickname comes from the location of the shift — Canada. Variants circulate under other geographic nicknames ("monholka", "avstraliika", "bolotka"), and implementations differ: dedicated chips, ribbon-cable assemblies, Arduino-based builds. There is no common standard. Each workshop keeps its own design, and this bears directly on quality.

A classic kanadka offers two modes: full hardware GPS shutdown, and coordinate offset.

According to the Boryviter Centre of Excellence, a correctly built kanadka provides an anonymous mode that disables GNSS navigation entirely, eliminating GPS spoofing as an attack path, permitting takeoff without satellites, and raising the ceiling to 1500 m. The offset places the aircraft in a region with no no-fly zones for thousands of kilometres, so NFZ restrictions never trigger.

The drawbacks are logistical: the aircraft must be physically opened, the work is workshop-only, there are queues, and airframes get shipped back and forth. Prices among providers range from free to USD 50–150 per airframe. For a unit this means the aircraft is out of service for the duration.

Ukrainian engineers have worked on comparable hardware in parallel. Dmytro Hnap, head of the NGO All-Ukrainian Federation for UAV Support and Development, has described a chip called "Teleport" that works on a principle close to the kanadka, substituting shifted coordinates for real ones, but with an emphasis on anti-spoofing and on keeping GPS functional. The claimed advantage is flying with navigation active, which gives steadier station-keeping.

The "prishchepka" and why it was abandoned

This method appeared in spring 2023. The offset is applied through the GNSS module's configuration file, with no board to solder in, and that installation simplicity drove its rapid spread.

The Boryviter Centre of Excellence, in report LL-319, calls it technologically obsolete and acutely dangerous to operators. The comparison in that report:

• Kanadka: GPS fully disabled, takeoff without satellites, 1500 m ceiling.
• Prishchepka: vulnerable to spoofing, requires GPS, 500 m ceiling.

The recommendation is blunt: abandon the prishchepka, use the kanadka, and physically remove GPS modules.

The 1001 firmware

The name dates from the period when stock firmware version 1000 shipped for the Mavic 3 series.

Functionally, 1001 lets the operator send a command from the controller that disables the GPS module, with the aircraft reporting zero satellites in white rather than flagging an error. The module can be re-enabled just as quickly. The firmware also sets a Home Point automatically at power-up, removes altitude and range limits (which mattered on the 3 series), and on loss of link climbs the aircraft to a preset 500 or 1000 m to get clear of EW coverage and improve the chance of regaining control.

The firmware reached Ukrainian specialists with a captured aircraft. Serhii Flesh described the sequence: he initially advised against rushing it onto Ukrainian airframes until its safety could be confirmed; a large group of volunteer programmers subsequently re-audited the code and rewrote most of it, and he raised the threat question directly with the lead developer. Ukrainian builds are versions 34, 36, and 37, checked with the version command; the about command returns "Slava Ukraini".

The practical advantage of the Ukrainian build is that it is free and can be installed locally. Flesh advised operators to find someone within their own operational-tactical grouping (OTU) to handle installation.

Limitations the same author flags:

1. It does not install on every DJI model, so the kanadka remains relevant for part of the fleet.
2. Some modes can re-enable the spoofing vulnerability — the instructions need reading carefully.
3. Because 1001 disables GPS completely, the gimbal may not hold against strong gusts, and the image starts to judder.

The rollout timeline tracks the front. The first kanadkas for the 3 series were built in summer 2023 around Bakhmut; Enterprise variants (3T/3E) followed towards autumn; 1001 appeared in November 2023 and spread widely in early 2024. A distribution scheme built around flashing "boxes" formed at that point, coordinated by one of the well-known charitable foundations, which in practice decided who was granted flashing capability. Once 1001 covered the 3T/3E, demand for kanadkas fell sharply — the firmware needed no disassembly, went on quickly, and cost nothing — and workshops lost that line of work for a time.

The core vulnerability: spoofing

This is the point most often underestimated.

The architecture of kanadka-class solutions does not disable the GPS module completely and does not allow the GPS antenna to be removed. The module keeps running. Given a strong enough signal, the aircraft can still acquire real or substituted coordinates.

The numbers explain why this works. Real GPS satellite signal levels sit around −130 to −120 dBm, effectively at the noise floor. A powerful spoofer can exceed 0 dBm depending on range to the source, and given the propagation characteristics of the navigation bands that means tens of kilometres.

Ukrainian workshops report that losses of kanadka-equipped airframes rose through 2026, notably in rear areas where crews do not expect it. The symptoms are atypical: the crew does not recognise spoofing and attributes the loss to motor failure, ESC failure, icing, or a software fault.

The practical conclusion matches Boryviter's recommendation: anonymisation by coordinate offset and anonymisation by physical GPS removal are different levels of protection.

The 4 and 5 series

DJI keeps changing the hardware, and 3-series solutions do not carry over.

On the 3 series a GPS module could be swapped between airframes without trouble and everything worked. On the 4 series that no longer holds; reflashing is required. A 1001-class firmware for the 4 series is a difficult proposition — near impossible without the manufacturer's involvement.

Current state:

• Matrice 4 — kanadka-type solutions with defects that vary by workshop. Porting began after the aircraft's presentation on 8 January 2025; the first units were flying operationally by May.
• Mavic 4 Pro — likewise a kanadka-type approach, done by a limited number of workshops, with the same caveats.
• 5 series — not in military use.

The 3 series survives on the market essentially as the 3TA; other 3-series airframes are hard to source new in quantity. Units are therefore migrating onto platforms for which the best-proven solution, 1001, is unavailable.

Worth noting separately: the situation is simpler on Autel, where the broadcast can be disabled through military firmware such as Overlord.

What anonymisation does not solve

Substituting coordinates removes the map fix but not the emission itself. If a radio-monitoring system detects the aircraft, the adversary knows it is within the antennas' coverage — between 1 and 25 km depending on configuration. That becomes a direction-finding problem, solved by other means.

Second, anonymisation is not a substitute for emission discipline, position changes, or separating the takeoff point from where the crew actually sits.

Third, record-keeping. There is a standing demand in the field to track firmware on every airframe, assign accountable individuals, and end the practice of buying drones for units through open classified-ad platforms. An airframe running unknown firmware of unknown origin leaves open the question of where its data actually goes. The history of 1001 itself shows this is not a formality: the code was audited and rewritten before it was cleared for widespread use.

Summary

Practical guidance

DJI 3 series. Default to 1001 where the model is supported; kanadka for the rest. Kanadka combined with physical removal of the GPS module gives the highest protection against spoofing.

4 series. There is effectively no choice: a kanadka from a specific workshop, accepting that build quality varies and the GPS module stays live. That means elevated loss risk against current spoofing capabilities.

Prishchepka. Do not use. The Centre of Excellence recommendation is unambiguous.

Regardless of method. An anonymised airframe is still visible as an emission within the receiver's coverage. Offsetting coordinates buys time and complicates targeting; it does not make the crew invisible.