Cameras on Royal Navy surveillance vessels were sending signals to a device in China

Surveillance drones used by British special forces were quietly phoning home, and home was in China.

What was found

Cameras fitted to the Royal Navy’s K3 Scout uncrewed surface vessels contained components that sent heartbeat communications to a device located in China. A heartbeat is a routine signal confirming the camera is online and working, not a data feed. The problem surfaced during a routine cyber vulnerability assessment of the K3 fleet, and the Ministry of Defence responded by stripping all internet connectivity from the cameras.

The MoD’s statement is categorical as far as it goes: a thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally.

Where the hardware came from

The vessels were produced by Kraken Technology Group in Fareham, Hampshire, and acquired under Operation Beehive. The cameras themselves came from a third-party supplier that had given security assurances. The story was broken by The Daily Telegraph.

That chain is the substance of the incident. The prime contractor is British, the procurement program is official, and the assurances were on file. The outbound channel to China still made it onto a military platform, and it was found by accident during an unrelated assessment rather than by any layer of the supply chain that had signed off on the equipment.

What a heartbeat means and does not mean

A heartbeat is not footage, and the MoD’s investigation found no compromise. Taking the statement at face value, no damage was done.

The residual problem is structural. A device on a special-forces platform was maintaining an outbound communications channel that nobody specified, to a destination nobody chose, and every party involved believed the hardware was clean. Whether the channel was benign telemetry or something worse matters less than the fact that its existence was unknown. Modern military platforms are assembled from commercial components with their own embedded connectivity, and this case shows how far down the supply chain a security review has to reach before “no internet connectivity” is actually true.