Royal Navy drone cameras secretly transmitted data to Chinese IP address

The breach

Cameras installed on the Royal Navy's K3 Scout surveillance drones were secretly transmitting "heartbeat communications" to a device with a Chinese IP address, The Telegraph reported on 9 August. The transmissions, discovered during a routine cyber vulnerability assessment, contained only low-level data confirming that the cameras were online and functioning. The breach was identified at the Special Boat Service headquarters in Poole, Dorset, after the drone fleet entered service in March. The cameras may have remained active even when the drones themselves were powered off, raising concerns that they could have captured activity near meetings of senior special forces officers.

The drones and their mission

The Royal Navy purchased 20 K3 Scout drones from Kraken Technology Group, a British defence contractor based in Fareham, Hampshire, as part of a project called Operation Beehive. The fleet cost approximately £12 million. The uncrewed surface vessels can travel at speeds up to 55 knots (around 100 km/h), operate continuously for up to 30 days, and carry payloads of up to 600 kg. They are used by the Coastal Forces Squadron and 47 Commando of the Royal Marines for surveillance, force protection, and precision strike roles. The same K3 Scout model also serves in NATO's fleet and has been acquired by the US Special Operations Command. In May, the Ministry of Defence announced the drones would form part of a potential deployment to protect shipping in the Strait of Hormuz, alongside autonomous mine-hunting equipment, anti-drone systems, and Typhoon jets.

Supply chain concerns

Kraken Technology Group manufactured the drones but sourced the cameras from a third-party supplier that had assured the company of their security. A Kraken spokesperson said the cameras were compliant with the US National Defense Authorization Act but contained a limited number of components from countries outside the United Kingdom. After the breach was confirmed, the Ministry of Defence ordered the cameras disconnected from the internet. Kraken stated that a joint audit with the Royal Navy found no evidence of sensitive information being disclosed outside approved channels.

A Ministry of Defence source told The Telegraph that the incident represented a serious failure in checking the origins of components.

This is a big failure in checking the provenance of components and we have lost confidence in the platform.

The Ministry of Defence said in a statement that a thorough investigation found no evidence of its data or systems being accessed, compromised, or transmitted externally.

Broader scrutiny of Chinese technology

The incident has intensified scrutiny of Chinese-made technology in sensitive British military and public infrastructure. Chinese-manufactured cameras have reportedly been removed from British public buildings, and Chinese electric vehicles have been banned from military installations. The revelations come as the Labour government, under Prime Minister Keir Starmer, has sought to ease tensions with Beijing. Starmer visited China in late January, the first British prime minister to make a diplomatic trip there since Theresa May in 2018. Earlier this year, the government also approved construction of a new Chinese embassy complex at Royal Mint Court, a site near underground cables of strategic importance to City financial operators, a decision that raised concerns about potential espionage.