The Ministry of Defence (MoD) has concluded there is no evidence that British systems or data were accessed or compromised after a routine cyber check found a Chinese-made component in the cameras of newly acquired Royal Navy sea drones.
The discovery occurred during what the MoD described as a "routine cyber vulnerability assessment" of the remotely operated K3 Scout sea drones. Officials said the cameras had emitted a so‑called "squark" — a heartbeat-like signal that can indicate a device is powered on and functioning and can, in some cases, carry location information. The signal was observed being sent to a Chinese IP address.
"A thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally," an MoD spokesperson said.
What the MoD and supplier say
The MoD emphasised that its assurance and testing mechanisms are designed to find and address vulnerabilities early and said routine security activity across its systems and equipment continues. The department described the matter as investigated and the issue addressed.
The K3 Scout boats, supplied to the Royal Navy by defence firm Kraken, are marketed as capable of a range of roles including maritime surveillance, force protection, logistics and precision strike. Kraken said it had received security assurances, but that a third‑party supplier of the drone camera contained Chinese-made components. The company added it was confident no sensitive information had been shared.
Supply-chain and policy implications
The incident is politically sensitive because most Nato countries, including the UK, maintain de facto restrictions on Chinese components in military equipment due to concerns about espionage and supply autonomy. Defence procurement teams across allied countries have for several years sought components that are free from influence by potentially hostile states — but the MoD acknowledged the defence sector still faces challenges sourcing China-free parts, particularly at the price and scale demanded.
Officials said the security lapse has been addressed. Nonetheless, the episode underlines the difficulty of fully policing complex supply chains, where multiple subcontractors and global suppliers can introduce risk even when prime contractors give assurances.
- Equipment involved: K3 Scout sea drones
- Number supplied: 20 drones, according to the supplier
- Issue detected: camera sent a heartbeat signal to a Chinese IP address
| Item | Detail |
|---|---|
| System | K3 Scout sea drone |
| Supplier | Kraken |
| Detection | Heartbeat ("squark") to a Chinese IP address |
| MoD finding | No evidence of data or systems compromise |
Security commentators and procurement experts have long warned that modern military platforms are the product of international supply chains. Even with rigorous testing and contractual safeguards, components from tertiary suppliers can escape detection until post‑delivery checks or routine vulnerability scans reveal anomalies.
The episode was first reported by The Telegraph and has prompted fresh scrutiny of how defence contractors and the MoD vet components and third‑party suppliers. Officials will be under pressure to demonstrate tighter oversight of subcontractor relationships and to show that remedial steps are not only reactive but designed to prevent recurrence.
While the MoD's public statement sought to reassure that no compromise had occurred, the case reinforces the operational and reputational risk posed by hidden elements in complex procurement chains — and the ongoing trade‑offs between cost, availability and security in defence acquisition.
The incident also serves as a reminder that as militaries adopt more autonomous and networked systems, the cyber and supply‑chain dimensions of equipment security will remain central to capability and policy debates.
