UK Naval Drone Cameras Sent Heartbeats to China
Cameras on K3 Scout unmanned boats contacted an internet address in China. Britain says no sensitive data was compromised, but the finding exposes a supply-chain security gap.
A camera installed on a military drone does not need to transmit classified video to create a security problem. Sometimes the problem is simply that it is talking to an outside server at all. Britain’s K3 Scout program has become a clear example after cameras on the unmanned boats were found sending heartbeat messages to an internet address in China.
The Telegraph first reported the issue, which was also described by The Wall Street Journal and The Times. Heartbeat traffic is normally a small status signal used to tell a remote system that a device is online and functioning. The public reporting does not establish that video or other classified imagery was sent to China.
Britain’s Ministry of Defence said the connection was discovered during a cyber-vulnerability assessment. It removed the cameras’ internet connectivity and said a subsequent investigation found no evidence that sensitive ministry data or systems had been accessed, compromised or transmitted externally. That distinction matters: the confirmed problem is an unauthorized or unnecessary network path, not a proven espionage transfer.
The platform makes the incident more consequential. Britain has acquired 20 K3 Scouts under Project Beehive. The Royal Navy describes the unmanned surface vessel as suitable for surveillance, force protection and precision-strike roles, and in July demonstrated an air-drop concept that could put the boats into an operating area quickly. QinetiQ has also said it was working to prepare the K3 for potential deployment around the Strait of Hormuz.
That operational profile gives even small pieces of telemetry more significance. A routine status message may reveal little by itself, but military networks are designed around minimizing unnecessary external connections. Repeated signals can potentially disclose when a device is active, how frequently it connects or other metadata about its use. Security teams therefore care about traffic patterns even when the content of the traffic is not classified.
The story also has an American angle. Kraken Technology Group announced in May that it had received an Other Transaction Agreement from U.S. Special Operations Command worth up to $49 million involving the K3 Scout. A platform that is being considered by multiple allied customers must satisfy different cybersecurity and supply-chain rules, turning a component-level problem into a commercial and procurement issue across borders.
Britain had already acknowledged the wider challenge. In a parliamentary answer this year, the Ministry of Defence said Chinese-manufactured goods exist in its supply chain and described security due diligence, particularly around surveillance equipment. In June, the government separately said it was removing certain surveillance systems linked to companies subject to China’s National Intelligence Law from sensitive government sites.
The Telegraph also cited an unnamed source who alleged that some cameras could remain active after the boats were powered down and that K3s had been near highly sensitive special-forces meetings. Those claims have not been independently substantiated in public reporting. The ministry’s stated position is that no sensitive data compromise was found.
The larger test now is whether the K3 program treats this as a one-off camera fix or a reason to examine the entire component tree. Kraken says series production has begun at Rheinmetall’s Blohm+Voss site in Hamburg. As the system moves from trials to larger production and allied contracts, its credibility will depend not only on speed, payload and autonomy but on whether every sensor behaves exactly as the customer expects when it touches a network.
