DEDICATED RISK REVIEW · JAPAN RAIL INSPECTION · ARTICLE 01
A lower purchase price—but what does a shutdown cost?
Using DJI Dock 3 and Matrice 4TD to examine purchase evidence, data control and continuity planning for rail inspection.
Updated 1 October 2026 · v1.0.0 · 日本語で読む
01 · Establish the purchase facts first
Japanese retailer SYSTEM5 lists Dock 3 and Matrice 4TD. The relevant products require a price enquiry. The reviewed pages do not establish the installed, operational cost of the complete system. [S2] [S3]
| Item | Evidence and remaining gaps |
|---|---|
| Market and seller | Japan / SYSTEM5. A source for purchase research, not a claimed partner of this publication. |
| Configuration | Dock 3 plus Matrice 4TD. The comparison listing is Matrice 4TD (DJI RC Plus 2 Enterprise) SP Plus +, reference N_1214841. Its equivalence to the demonstration's delivered configuration is unverified. |
| Price and currency | No valid amount obtained. Request a formal JPY quotation separating aircraft, dock, software and installation. |
| Tax, freight and import costs | No project quotation obtained. Distinguish domestic purchase from direct import and identify who bears each cost. |
| Stock and delivery | Category and product pages showed conflicting availability. Treat delivery and quantity as unconfirmed until the seller responds. |
| Recurring costs and warranty | Confirm connectivity, licences, storage, maintenance, replacement equipment, travel and exclusions. A package name is insufficient evidence of coverage. |
| Date and validity | Sources checked 1 October 2026. No formal quote or validity period obtained. |
Repeated large numeric values retrieved from the collection page conflict with its enquiry-based presentation and are excluded as transaction prices. [S4] The aircraft listing also carries a manufacturing-date/type-certification notice. We report that seller notice without deciding the unit's current certification or legal eligibility. Check the delivered serial number and applicable documents with the seller. [S2]
02 · What the example establishes
Distributor report: SYSTEM5 describes a July 2026 railcar-inspection demonstration at Hapi-Line Fukui's vehicle management centre using Dock 3 and Matrice 4TD, with a FlightHub 2 workflow for remote, scheduled inspection. This is evidence of a reported demonstration, not fleet-wide deployment or an independent cybersecurity test. [S1]
Our proposed acceptance criterion goes beyond successful flight: record the required inspection items at usable quality, support an accountable human decision and sustain inspection when the preferred workflow fails. That is an editorial evaluation criterion, not a measured result for the participants.
03 · Map the workflow, not just the aircraft
This is a checklist for a prospective deployment, not a reconstruction of the demonstration site's network.
| Stage | Inspect | Retain as evidence |
|---|---|---|
| Capture | Equipment images, coordinates, timestamps and incidental people | Collection inventory, capture boundaries, storage settings |
| Transfer and control | Aircraft, dock, network and account boundaries | Destination inventory, permission matrix, approved configuration |
| Storage and analysis | Cloud or local environment; contractor access | Contract, storage region, access logs, retention period |
| Reporting and sharing | Reports, links and downloaded copies | Recipients, expiry and export records |
| Updates, repair and disposal | Service access, diagnostic exports and storage media | Change records, return conditions and erasure verification |
DJI's FAQ distinguishes cloud and on-premises FlightHub 2. It describes US or German AWS locations for users outside mainland China. That statement alone does not establish the selected region of a particular Japanese deployment; verify its contract and configuration. [S5]
The January 2024 CISA/FBI guidance identifies transfer, update and connected-peripheral risks for Chinese-manufactured UAS. It is a general government warning, not evidence that this model or demonstration was compromised. [S7]
04 · Build the worst case from its prerequisites
Engineering scenarios; probabilities and loss amounts remain unquantified. Some apply equally to other countries' equipment. Assess permissions, connectivity, information sensitivity and recovery capacity, not nationality alone.
| Conditional scenario | Prerequisites | Potential consequence | Control and verification |
|---|---|---|---|
| High-impact condition: compromised administrator | An attacker gains sufficient access and is not promptly detected or blocked | Exposure of imagery and schedules; unauthorised task changes if control permissions also exist | Least privilege, supported strong authentication, individual accounts and revocation exercises. Test the actual scope of control |
| High-impact condition: unauthorised image sharing | Sensitive material reaches an unapproved repository or recipient | Exposure of facility condition or location; investigation, containment and contractual response costs | Approved repositories, expiring shares and export controls. Verify revocation using synthetic images |
| High-impact condition: altered inspection records | Write access is abused without independent checks | Missed defects, repeat inspections and lost decision evidence. Physical harm requires additional failures | Preserved originals, change history, independent backups and human review of important findings |
| Connectivity or service interruption | A required remote function becomes unavailable without a fallback | Inspection backlog, site visits and extra staffing. A service outage does not automatically mean lost flight control | Test communication-loss behaviour safely and measure transition to an alternative inspection method |
| Compromised maintenance pathway | A service endpoint or update path is compromised and changes evade detection | Unauthorised changes to processing or operation. No specific vulnerability is established here | Verify update provenance and versions, approve changes, update promptly, record service access and rehearse recovery |
Compromise of a drone management endpoint does not establish access to railway signalling or train control. Additional connectivity, permissions and vulnerabilities would be needed. We do not invent those links or claim that the aircraft can shut down a railway.
05 · Include available controls in the comparison
Manufacturer statement: DJI describes local deployment of FlightHub 2 On-Premises and support for Dock 3. [S6] This deserves evaluation. Local storage alone does not prove that updates, remote support, backups and exported reports all remain internal.
For a supported configuration, verify startup, authentication, routine missions, updates and recovery while recording external dependencies at each stage. Local deployment still needs administration, monitoring, backups and staff. Include the responsibilities transferred to the buyer in the quote.
06 · Separate market stress from cyber compromise
Planning horizon: October 2026 to September 2027. These are 12-month stress conditions, not predictions that supply will stop or rules will change. Probability: UNKNOWN.
| Condition | Evidence to monitor | Buyer response |
|---|---|---|
| Baseline: supply and support continue | Valid quotes, support contracts and replacement performance | Budget routine operation and improvements |
| Adverse: higher prices, longer delivery or reduced coverage | Written seller terms, revision notices and actual delivery; rumours are insufficient | Recalculate spares, standby equipment and renewal costs |
| Severe: required support ends or applicable procurement conditions change | Model-specific dated notices or authoritative documents whose applicability has been checked | Evaluate alternatives, retrain, migrate records and revalidate the workflow |
Total ownership cost includes purchase, installation, communications, software, training, inspections, maintenance, security operations and migration. Keep conditional incident losses separate from ordinary expenditure. Do not fabricate an expected loss by assigning an unsupported probability. Decide whether the system is cheaper only after quotations cover the same scope.
07 · Retain, improve, retrofit or replace
| Option | Decision evidence |
|---|---|
| Keep the existing system | Mission and organisational requirements are met; someone owns the residual risk |
| Improve accounts, sharing and storage | The gap is operational rather than inherent to the aircraft; verify the new restrictions |
| Change the deployment architecture | Supported versions, required functions, external dependencies, maintenance responsibility and full cost |
| Replace components | Compatibility, warranty, safety and retesting scope. A new motor or housing does not resolve a data-flow issue |
| Replace the whole system | Evidence that requirements cannot otherwise be met, followed by equivalent tests of alternatives. Country of origin is not a security guarantee |
08 · Start with model, mission and problem
Begin with your current model (unknown is acceptable), intended use and problem to solve. Then identify versions, quantity, cloud use and the desired deliverable. Do not send sensitive facility maps, flight paths or credentials with an initial enquiry.
An unclear data flow calls for assessment; a necessary component change calls for compatibility review; a new deployment starts with procurement requirements. This article does not promise certification, acceptance of specialist testing work or a partnership with any named supplier.
Open the existing enquiry page This links to the current form. Article context is not automatically populated; include article ID UAV-RISK-JP-RAIL-001.
For corrections, report “v1.0.0 / EN-section number / passage / proposed correction / evidence URL”. We distinguish factual corrections from organisation-specific operating conditions.