Evidence the Record Actually Contains

I. INTRODUCTION AND STATEMENT OF INTEREST

Gatewell Group LLC submits these comments in response to the Public Notice released June 16, 2026, by which the Office of Engineering and Technology "offers an opportunity for comment on a recent ex parte filing by SZ DJI Technology Co., LTD. (DJI), by August 28, 2026." Public Notice, DA 26-592, ET Docket No. 26-22, at 1 (OET rel. June 16, 2026) ("Public Notice").

Gatewell is a Los Angeles consultancy. It advises buyers of equipment subject to the Covered List — importers, distributors, engineering and construction firms, project developers, and network operators — on vendor diligence and origin evidence: what documentation establishes country of origin, ownership, and component-level provenance. Gatewell sells those advisory services, and a Covered List regime in which documentary sufficiency is contested is the market for them. Gatewell does not manufacture equipment, does not sell equipment subject to the Covered List, and has no interest in whether any particular equipment is or is not designated. Gatewell has previously filed comments in PS Docket No. 26-184 (ECFS Nos. 26110071980 and 26110071982) and in PS Docket No. 26-189 (ECFS No. 26110071981), each received and disseminated August 18, 2026.

Gatewell takes no position on whether DJI's equipment belongs on the Covered List, and no position on the pending Petition for Reconsideration. These comments address the document itself. They make four observations about what the record does and does not contain, and then identify seven considerations bearing on the weight that record can support.

II. THE PUBLIC NOTICE INVITES COMMENT WITHOUT STATING WHAT THE DOCUMENT IS OFFERED TO PROVE

The operative request is a single sentence: "To provide parties with sufficient time to comment on the DJI Security Assessment, we offer an opportunity for public comment on DJI's filing by August 28, 2026." Public Notice at 2. The Public Notice poses no questions and identifies no criteria.

The filing arrived at staff request. "At the request of OGC staff, on June 9, 2026, DJI filed a notice of an ex parte presentation and a copy of the DJI Security Assessment." Public Notice at 1. DJI says the same: it "believed this ex parte filing was not necessary for compliance with Commission rules, but agreed to file the report at the request of Commission staff." Letter from Adam Welsh, Head of Global Policy, SZ DJI Technology Co., Ltd., to Marlene H. Dortch, Secretary, FCC, at 1 (filed June 9, 2026) ("DJI Letter"), ECFS No. 1060906407077 (attaching OnDefend, DJI Security Assessment (May 14, 2026) ("Assessment")).

A document now sits in the docket, offered in support of relief, and commenters are asked to address it without being told what it is offered to establish.

III. WHAT WAS FILED IS A SUMMARY; THE ASSESSMENT'S SUPPORTING DETAIL IS NOT IN THE RECORD

The Public Notice describes DJI as having filed "a copy of the DJI Security Assessment." Public Notice at 1. The document actually filed states, on its last substantive page: "For the full report, including Assessment Technical Details, please contact DJI Technology, Inc." Assessment at 16.

The withheld section is where the per-finding substance sits, and the filed document says so: "Specific findings and recommendations for each area of testing are detailed within the Assessment Technical Details section of this report." Assessment at 11. Report pages 3 through 16 are footed "Initial Assessment | Confidential & Proprietary." Assessment at 3-16.

The same pattern runs through the methodology sections. The filed document describes evidentiary artifacts that it does not contain:

• A hardware bill of materials. "The resulting Hardware Bill of Materials (HBOM) provides a structured inventory of the device's physical composition that supports downstream analysis of supply chain risk and undocumented capability." Assessment at 15.
• A procurement record. "The procurement record, including vendor, purchase date, and serial numbers, is preserved with the engagement evidence." Assessment at 15.
• A firmware and software inventory. "Where firmware is upgradeable, each version observed during the engagement is recorded along with the procedure used to obtain or apply it." Assessment at 15. That inventory is said to establish "a known, reproducible baseline against which subsequent versions, configurations, and behaviors can be compared." Id.

None of those artifacts is in the record. The Commission has invited public comment on conclusions while the findings, test data, per-finding detail, component inventory, procurement record, and version baseline supporting those conclusions remain outside the docket, obtainable only by contacting the entity named on the document's last substantive page. No commenter can test the summary against the underlying work, because the underlying work is not here.

One further fact appears on the face of the document. The petitioner is SZ DJI Technology Co., Ltd. The assessment identifies its client differently: the cover reads "DJI TECHNOLOGY, INC. | MAY 14, 2026"; the engagement was conducted "under rules of engagement explicitly authorized by DJI Technology, Inc." Assessment at 3; and the withheld detail is to be requested from DJI Technology, Inc. Assessment at 16. The filed document does not state the relationship between the two names. The material that would allow the summary to be tested is therefore held by an entity whose relationship to the petitioner this record does not establish.

IV. THE ASSESSMENT AND THE STATUTORY MECHANISM ANSWER DIFFERENT QUESTIONS

The assessment states its own object: OnDefend "conducted an independent, DJI-authorized security assessment of two drone platforms to evaluate national security concerns around data sovereignty, hardware vulnerabilities, and drone manipulation risks." Assessment at 2. That is an inquiry into the exploitability of particular builds over a defined window; the report gives the engagement period as "October 21, 2025 – March 13, 2026." Id.

The Covered List operates on a different input. The Commission publishes the list under 47 U.S.C. § 1601(a), and places equipment on it "based solely on" one or more of the determinations described in § 1601(c)(1)-(4): a determination by an executive branch interagency body with appropriate national security expertise; a determination by the Department of Commerce under Executive Order 13873; the equipment's being covered telecommunications equipment or services as defined in section 889(f)(3) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019; or a determination by an appropriate national security agency. Removal likewise keys to those determinations: the Commission must "monitor the making or reversing" of them, and must remove equipment if the determination that provided the basis for listing "is reversed," absent another qualifying basis. 47 U.S.C. § 1601(d)(2).

A third-party security test is not among the determinations enumerated in § 1601(c). The Public Notice does not state how the assessment bears on any of them, and the assessment does not address them. Whatever the document is offered to prove, the record does not say, and commenters are left to supply the theory themselves.

The gap is visible in the assessment's method. Its data-sovereignty finding rests on observed network endpoints: "The engagement found no evidence of data being sent outside the United States from the controller devices or drone flight-control applications. Observed connections were to U.S.-based IP addresses, including content-delivery infrastructure associated with Alibaba and Tencent, along with expected services from Google, Facebook, Mozilla, Amazon, and others." Assessment at 8. The accompanying recommendation is that "DJI should continue working with geographic IP database providers to reduce ambiguity around service location and, where needed, migrate services to infrastructure that is more consistently identified as U.S.-based." Id. Gatewell draws no inference about any named provider. The methodological limit is the report's own: endpoint geolocation resolves where traffic terminated, not who owns or controls the receiving infrastructure or which sovereign can compel it.

V. THE LIMITS ARE STATED IN THE FILED TEXT

The following are drawn from the filed document. They are not criticisms of the assessor's work; the report states each of these limits itself.

Scope and sample. "Two units of each drone model were tested across controlled indoor and outdoor environments over a five-month engagement period from October 2025 through March 2026." Assessment at 3. The devices were the "DJI Air 3S with RC 2 Controller & DJI Fly App" and the "DJI Matrice 4E with RC Plus 2 Enterprise & Pilot 2 App." Assessment at 2. Procurement is described as arm's-length: "Consumer units were purchased independently without notification to DJI. Enterprise units were taken from existing dealer stock, ensuring tested units represented standard U.S. market distribution." Id. The Petition, as quoted in the Public Notice, describes the Bureau's modification as reaching "all of DJI's communications and video surveillance equipment and services." Public Notice at 1. That phrase is the petitioner's characterization of the designation, quoted by OET as background rather than adopted, and Gatewell relies on it only for what the petitioner says the designation covers. The filed document offers no statement of why two models, two units each, are representative of that population.

Time. The report states the limit itself: "This individual assessment is bound by its scope and time and therefore cannot accurately measure security and data privacy into the future." Assessment at 11. It then describes what continuous coverage would require — "repeatedly testing live services with statistically significant sample sizes across the full range of hardware devices, firmware, applications, and supporting services to ensure substantial, ongoing coverage rather than relying on one-time validation" — and recommends that "[f]ull tests should be performed for every hardware and firmware version, and for any software release that introduces or substantially refactors capabilities." Id. The running footer labels the document an "Initial Assessment." Assessment at 3-16.

Access. Activity was conducted "under rules of engagement explicitly authorized by DJI Technology, Inc." Assessment at 3. The supply-chain baseline is public documentation: "Observed hardware components and radio behavior are cross referenced against the manufacturer's FCC filings, datasheets, user and operator manuals, and other publicly available documentation." Assessment at 15. Software analysis proceeded by analyzing shipped artifacts: "Static analysis is performed against extracted application packages and native shared libraries using disassemblers and decompilers such as Ghidra." Assessment at 12. That is testing of devices and binaries as delivered. It is not access to source, design records, or supplier documentation, and conclusions about origin and provenance drawn from it cannot be independent of the manufacturer's own published material, because that material is the reference set.

A configuration that changed during testing. "DJI collaborated with OnDefend on potential remediation during the engagement and is working to address remaining items in subsequent software releases." Assessment at 6. One instance is identified in the summary: "Default shared WiFi password identified and patched by DJI via firmware update." Assessment at 2. The filed document does not identify the firmware or application versions to which its conclusions attach, or state which findings were re-tested after remediation.

Summary tiles and the findings behind them. The Overall Summary reports "Unexplained RF Emissions" as "NONE FOUND." Assessment at 5. The findings list includes two entries titled "Undocumented Radio Frequency Transmissions - DJI Air3S and RC2" and "Undocumented Radio Frequency Transmissions - DJI Matrice 4E and RC2 Plus Enterprise." Assessment at 6. The report explains the difference: "Some emissions were not included in FCC documentation at the start of the engagement, but they were confirmed to be artifacts of the documented signal-synthesis methods and changed in direct correlation with known protocols and operating states." Assessment at 9. The distinction between unexplained and undocumented is a real one and the report draws it expressly. The point here is only that a reader of the summary tile alone does not learn that emissions absent from FCC documentation were observed at all.

The same relationship appears as to Local Data Mode. The Overall Summary reports "Local Data Mode Effectiveness" as "EFFECTIVE." Assessment at 5. The findings list includes "Egress Traffic Detected with Local Data Mode - DJI RC 2." Assessment at 6. The finding text states that "Local Data Mode prevented user data from being sent from the drone flight-control application to internet-based locations," and, in the same paragraph, that "Local Data Mode did not fully isolate the controller itself because the controller operating system and other applications could still connect." Assessment at 7. The qualification is not visible in the tile.

One divergence is internal to the report and unexplained by it. The Executive Summary states that the assessment "identified no evidence of hidden backdoors, no data transmissions outside the United States, and no viable pathways for hijacking or weaponization." Assessment at 2. The Assessment Findings section states that the assessment "identified no clear evidence of hidden backdoors, no data transmissions outside the United States, and no viable pathways for hijacking or weaponization." Assessment at 5. DJI's transmittal letter quotes the Executive Summary formulation, and quotes it accurately. DJI Letter at 1. Where a report states its headline finding in two formulations, the record should show which one the assessor stands behind.

VI. CONSIDERATIONS BEARING ON THE WEIGHT THIS RECORD CAN SUPPORT

DA 26-592 opens no rulemaking and seeks comment on one filing. Gatewell therefore proposes no rules. It identifies seven considerations that bear on how much weight the document now in ET Docket No. 26-22 can carry, each answerable from this record.

1. Whether the supporting detail is in the record. Conclusions whose findings, test data, and per-finding detail are obtainable only by contacting a party outside the docket cannot be tested by any commenter. A protective-order deposit of the withheld section would cure this; nothing else in the current posture does.

2. Whether the terms of engagement are in the record. Independence is asserted in the filed document; it is not evidenced there. Who commissioned and directed the work, who could limit or withhold publication, and whether the subject reviewed findings before release are facts, and none of them appears.

3. Whether the tested units are shown to represent the equipment at issue. The filed document contains no sample-to-population statement connecting two models and two units each to the equipment the petitioner says the designation reaches.

4. Whether the assessor's access supports the conclusions drawn from it. Testing of shipped devices and extracted binaries supports exploitability findings. Conclusions about ownership, control, and provenance ordinarily require design records, bills of materials, and supplier documentation. The record shows the former and not the latter.

5. Whether conclusions are tied to identified builds. The report recommends full testing "for every hardware and firmware version." Assessment at 11. The filed document does not identify the versions its own conclusions describe, and remediation occurred during the engagement.

6. Whether the methodology is stated in enough detail to be repeated. The methodology sections are specific about technique. The parameters, targets, and results an independent party would need in order to repeat the work are not in the filed document, which locates its specific findings and recommendations in the Assessment Technical Details section it does not contain. Assessment at 11.

7. Which formulation of a divergent finding the assessor stands behind. Where an assessment states the same conclusion two ways, as this one does at pages 2 and 5, the record should resolve the difference rather than leave the choice to the filer.

VII. CONCLUSION

Gatewell asks the Commission to weigh the filed document as what it is on its face: a summary whose supporting detail is not in the record, describing two models tested over a defined window, under rules of engagement authorized by the subject, and cross-referenced for supply-chain purposes against the manufacturer's own published material. Gatewell takes no position on DJI's Covered List status or on the pending Petition for Reconsideration. It asks only that whatever the Commission decides rest on evidence the record actually contains.