Cameras fitted to the Royal Navy’s new K3 Scout sea drones contained Chinese-made components that were sending automated “heartbeat” signals to an IP address in China, The Telegraph revealed Sunday. The Ministry of Defence stripped the cameras of all internet connectivity after a routine cyber vulnerability assessment caught the transmissions, and the Royal Marines have operated the £12.3 million (about $16.5 million) fleet since March.

The detail that matters most for the American drone fight sits in the supplier’s own response. Kraken Technology Group, the British contractor that builds the boats, says the cameras in question were NDAA-compliant. I have covered every turn of the FCC Covered List story since the agency added all foreign-made drones on December 22, 2025, and the entire premise of that policy is that a compliance label tells you which hardware to trust. A camera wearing that label just got caught phoning Beijing from a Western military vessel.

A Sovereign British Drone Program Carried An Unvetted Line To China

The K3 Scout is an 8.4-meter (27.5-foot) uncrewed surface vessel built by Kraken in Fareham, England, and ordered by the Royal Navy in March under Project Beehive, a £12.3 million contract for 20 boats assigned to the Coastal Forces Squadron and 47 Commando Royal Marines. Each boat carries a 600-kilogram (1,323-pound) payload and can stay at sea for 30 days at a stretch. Kraken lists a top speed of 55 knots. US Special Operations Command runs the same platform, and the type has sailed in NATO trials in the Baltic.

The Telegraph’s report says the affected cameras contained components made in China that transmitted heartbeat communications, automated status pings confirming a device is online and working, to an IP address in the country. An MoD spokesman said a thorough investigation found “no evidence of MoD data or systems being accessed, compromised or transmitted externally.”

The paper’s defence sources paint a rougher picture. The K3s form part of a package the UK has offered to help secure freedom of navigation in the Strait of Hormuz, and preparations for those plans ran on the compromised boats. One source told The Telegraph, “we have lost confidence in the platform.” The discovery raised fears that security-cleared staff at the Special Boat Service headquarters in Poole, Dorset, could have been exposed, and the paper reported concerns that some cameras stayed active while the vessels themselves were switched off.

Kraken Says The Cameras Were NDAA-Compliant, And That Label Is The Story

NDAA compliance, in drone and camera procurement, means hardware contains no gear from the Chinese manufacturers named in United States law, chiefly Section 889 of the 2019 National Defense Authorization Act, and the label has become the default trust signal for government buyers on both sides of the Atlantic. A Kraken spokesman told The Telegraph the company was aware some third-party, NDAA-compliant cameras had “a small number of components originating from outside the UK.” After a full audit with the Royal Navy, the company says it is confident no sensitive information left intended channels and that the vulnerabilities are closed.

Which camera remains officially unnamed. The naval affairs site Navy Lookout noted on X that the K3’s mast-mounted electro-optical and infrared unit is a Night Navigator 3000 series camera from Current Scientific Corporation, a Canadian manufacturer. Neither The Telegraph nor the MoD has identified the affected supplier, and the boats may carry more than one camera, so treat that identification as context rather than confirmation. If it holds, the picture gets worse for the compliance-label crowd: a Canadian-built camera, sold as NDAA-compliant, still shipped with Chinese subcomponents that opened a line home.

DroneXL reported last week that NDAA-compliant and domestically made are two different standards, and that nearly every Western drone builder still buys parts from a handful of Chinese suppliers. Even Skydio CEO Adam Bry conceded in June that Chinese content past the first supplier tier is effectively untraceable in his own aircraft. The K3 Scout incident is that admission playing out on a military network.

Washington Spent Years Warning DJI Would Do Exactly This

For nearly a decade, American officials and DJI’s domestic competitors have argued that Chinese-brand drones are a data pipeline to Beijing, a suspicion that started with a 2017 Immigration and Customs Enforcement memo and ran through years of federal alerts and congressional testimony. The record DroneXL has documented at length includes a 2019 Department of Homeland Security industry alert and 2024 guidance from the FBI and CISA warning that Chinese-made drones pose a data risk. What the record does not include is a confirmed case of a DJI aircraft covertly transmitting to China. Independent audits over the years, including reviews conducted for US government customers, found no evidence of the hidden transmissions critics predicted.

Skydio, the largest American drone maker, spent years pressing that suspicion in Washington. Its federal lobbying spend grew from roughly $10,000 in 2019 to about $560,000 in 2023, with its registered lobbyist count going from six to 24 over the same span, as DroneXL documented. CEO Adam Bry told the House Select Committee on the Chinese Communist Party in June 2024 that Beijing had poured resources into drone national champions while taking aim at American competitors.

The suspicion became policy. The FCC put every foreign-made drone and critical component on its Covered List on December 22, 2025, blocking new equipment authorizations for the whole category, with DJI and Autel the biggest names caught. DJI is fighting the designation at the Ninth Circuit in Case 26-1029. And on July 21 the agency proposed going further, ending the import and marketing of drones it already approved, a move DJI asked its American customers to fight on Friday. Comments in that docket, PS Docket 26-189, are due September 2.

DroneXL’s Take

The hawks will read this weekend as vindication. Chinese components phoned home from a military drone, exactly the behavior they spent years attributing to DJI. Read the labels on the hardware instead. This camera was sold as NDAA-compliant. The boat was British-built, for a sovereign fleet program, by a contractor backed by the NATO Innovation Fund. Every trust signal the ban regime runs on was present and accounted for, and the beacon fired anyway.

I have spent eight months on the Covered List beat watching Washington treat country-of-brand as a security test. The K3 Scout case shows where that test fails. Espionage risk lives at the component level, and a brand ban never opens the enclosure. Our own reporting keeps landing on the same fact: American builders told us pretty much everybody buys from one or two Chinese component suppliers, and Skydio’s CEO admits content past the first tier can’t be traced. If a Canadian camera on a British naval platform can carry a line to Beijing, then pulling DJI Mini drones off American shelves is not the fix. It is a trade action wearing a security costume.

DroneXL opposes unfair competition from China and from Washington alike, and the honest security policy here is the boring one: mandatory teardowns, firmware audits, and outbound traffic monitoring for every camera and radio that touches a defense network, whatever flag is on the box. The UK found this beacon because somebody ran a vulnerability assessment after the boats entered service. That check belongs before acceptance, on every program in every allied navy.

Watch the September 2 comment deadline on PS Docket 26-189. Expect this incident in the filings from both camps: ban supporters citing it as proof that Chinese components call home, operators citing it as proof that the compliance labels the FCC leans on can’t catch the risk the agency claims to be solving. The second reading is the correct one, and for once the evidence sailed in flying a Union Jack.

Sources: The Telegraph, Royal Navy, Kraken Technology Group, Navy Lookout.

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.