The United Kingdom Ministry of Defence (MOD) has confirmed that K3 Scout surveillance drones used by the Royal Navy contained components transmitting data to an IP address in China, prompting an immediate security review and the removal of internet connectivity from the devices.
The Kraken Technology Group, a British defense contractor, supplied the drones as part of a £12 million contract for the Royal Navy’s uncrewed surface vessel program. The MOD stated in a routine cyber vulnerability assessment that the issue affected a sub-system used by the Royal Navy, though it found no evidence of compromised data or systems being accessed externally. The cameras in question were sourced from a third-party supplier, which Kraken said had assured them the components passed security checks.
Following the discovery, the Royal Navy disabled all internet connectivity on the affected drones. The MOD emphasized that the breach did not result in any sensitive information being transmitted outside intended channels. Kraken Technology Group also issued a statement asserting that a small number of components originated outside the UK but that a full audit by both Kraken and the Royal Navy confirmed no sensitive data was shared externally.
Immediate Response and Official Statements
The Royal Navy and MOD moved swiftly to address the issue after an investigation by The Telegraph revealed that the drones’ cameras contained components sending "heartbeat communications"—data confirming device functionality—to an IP address in China. A spokesperson for the MOD stated:
"A routine cyber vulnerability assessment identified an issue affecting a Kraken Unmanned Surface Vessel sub-system used by the Royal Navy. A thorough investigation found no evidence of MOD data or systems being accessed, compromised or transmitted externally."
The K3 Scout drones, which are approximately 27 feet in length and capable of speeds up to 55 knots, were deployed as part of a broader effort to enhance maritime surveillance in the Strait of Hormuz. The MOD did not specify whether the drones had been used operationally prior to the discovery of the data transmission.
Kraken Technology Group, which has also secured a $49 million contract with the U.S. Special Operations Command, acknowledged that some components originated outside the UK but maintained that no sensitive information was compromised. The company stated:
"After a full audit by both Kraken and the Royal Navy we are confident no sensitive information has ever been shared outside of intended channels and any potential vulnerabilities have been identified and closed."
Broader Security Concerns and Policy Implications
The incident has intensified concerns over Chinese surveillance risks in Western military and critical infrastructure supply chains. The UK has previously taken steps to mitigate such threats, including banning Huawei from its 5G networks and warning about Chinese intelligence efforts targeting British officials via platforms like LinkedIn.
Conservative lawmakers have called for an urgent audit of military equipment to ensure no further unknown Chinese components are present. The revelation also raises questions about the vetting processes for defense contractors and third-party suppliers, particularly as the UK expands its use of uncrewed maritime systems.
Former Royal Navy Admiral Chris Parry, known for his role in the Falklands War, commented on the broader implications, stating that the incident reflects a failure to verify component origins and eroded confidence in the platform. The K3 Scout drones are equipped with a Night Navigator 3000 series camera system, though it remains unclear whether this specific model was the source of the data transmission.
Technical Details and Supply Chain Scrutiny
The K3 Scout drones are designed for surveillance, force protection, and precision strikes, with a payload capacity exceeding 1,300 pounds. The cameras in question were reportedly sourced from a third-party supplier, which Kraken stated had assured them the components were secure. However, the MOD’s investigation found that the components were transmitting data to China without the knowledge of either the military or Kraken.
The Royal Navy has since removed all internet connectivity from the affected cameras, though it did not specify whether this would impact the drones’ operational capabilities. The MOD has not indicated whether additional drones or other military equipment will undergo similar reviews.
International Context and Five Eyes Partnerships
The discovery comes amid heightened tensions between Western nations and China over technology security and espionage risks. The Five Eyes intelligence alliance, which includes the UK, US, Canada, Australia, and New Zealand, has repeatedly warned about Chinese efforts to collect intelligence through technology supply chains.
The UK’s actions align with broader efforts to reduce reliance on Chinese components in critical infrastructure, including telecommunications and defense systems. The incident may prompt further scrutiny of defense procurement processes and the integration of foreign-made components in military equipment.