Royal Navy K3 Scout Surveillance Drones Contained Chinese-Made Components Transmitting “Heartbeat” Data to a Chinese IP Address
An investigation into the Royal Marines’ new uncrewed surface vessels has exposed a serious supply-chain vulnerability at the heart of Britain’s Hybrid Navy programme.
In March 2026 the Royal Navy took delivery of a £12.3 million fleet of twenty Kraken K3 Scout uncrewed surface vessels under Project Beehive. Within months those boats—already in use by elements of the Royal Marines and operating near Special Boat Service facilities—were found to be carrying cameras whose Chinese-origin components were quietly sending status “heartbeat” signals to an IP address in China. The discovery has forced the Ministry of Defence to strip internet connectivity from the sensors and has raised uncomfortable questions about how thoroughly Western defence contractors can actually audit the global electronics supply chain.
Project Beehive and the Hybrid Navy Vision
Project Beehive was conceived as a rapid way to inject autonomous capability into the surface fleet. Rather than wait years for traditional shipbuilding cycles, the Royal Navy ordered twenty relatively small, high-performance uncrewed boats that could be produced quickly, reconfigured for different missions, and operated alongside conventional warships. The K3 Scout, built by the British firm Kraken Technology Group in Hampshire, measures 8.4 metres in length, can carry a 600 kg modular payload, reaches speeds of up to 55 knots, and claims an endurance of thirty days. Officials described the acquisition as a “significant milestone” toward a Hybrid Navy that blends crewed frigates with swarms of cheaper, attritable autonomous systems.
The boats were assigned primarily to the Coastal Forces Squadron and 47 Commando Royal Marines for training, force protection, maritime awareness and, according to defence sources, possible future contribution to freedom-of-navigation operations in the Strait of Hormuz. In July 2026 the same platform achieved a world first when a K3 Scout was airdropped by parachute from an RAF A400M into Sea State 4 conditions in the North Sea—proof, its makers claimed, that the vessels could be inserted rapidly into contested waters without relying on ports or motherships.
- Length: 8.4 m • Beam: 1.93 m • Draft: 0.8 m
- Top speed: 55 knots • Range: ~650 nm at 25 knots
- Payload capacity: 600 kg (sensors, EW, logistics or strike packages)
- Endurance: up to 30 days
- Propulsion: inboard diesel with stern drive
- Operator: Coastal Forces Squadron & 47 Commando Royal Marines
The Discovery
During what the Ministry of Defence described as a “routine cyber vulnerability assessment,” investigators found that the electro-optical and infrared cameras fitted to the K3 Scouts were transmitting automated “heartbeat” or “squawk” communications to a Chinese IP address. Heartbeat signals are short, regular packets designed simply to confirm that a device is powered on and functioning normally. In theory they carry little or no operational content. In practice, security specialists note that even basic status messages can sometimes include location data or network identifiers, and their very existence creates an unauthorised outbound channel from a military platform.
The cameras had been sourced by Kraken from a third-party supplier that provided assurances the hardware was secure and, according to company statements, NDAA-compliant. Those assurances proved insufficient. A small number of Chinese-made components inside the camera modules were still initiating contact with infrastructure inside China. The MoD responded by removing all internet connectivity from the affected cameras. A subsequent investigation, the department insisted, “found no evidence of MoD data or systems being accessed, compromised or transmitted externally.”
Watch the K3 Scout in action
Video not loading? Click here to watch directly on YouTube
Alternative official clip: Kraken Technology K3 Scout video
Supply-Chain Realities
The episode illuminates a structural problem that defence ministries across NATO have been wrestling with for years. Modern electro-optical sensors, radio modules and system-on-chip components are produced in complex global supply chains. Even when a final assembly plant sits outside China and the finished product carries an “NDAA-compliant” label, sub-components or firmware can still originate from Chinese suppliers that are not on the formal banned list.
Kraken Technology Group stated that after a full audit conducted jointly with the Royal Navy it was “confident no sensitive information has ever been shared outside of intended channels and any potential vulnerabilities have been identified and closed.” The company emphasised that the affected cameras were third-party items supplied with security assurances. Nevertheless, the fact that the transmissions continued for months after the boats entered service has caused real concern.
In networking and embedded systems, a heartbeat (sometimes called a keep-alive or squawk) is a small, periodic message sent by a device to a monitoring server simply to announce “I am still online and healthy.” It typically contains little more than a device identifier, a timestamp and a status code. While the payload itself may be trivial, the existence of the channel means the device has an outbound route to an external IP address. If that address is controlled by an adversary, the channel can theoretically be upgraded later, or the mere pattern of when the device is powered on can reveal operational tempo.
Timeline of Key Events
Broader Implications
Even if the MoD’s assertion that no sensitive data left the system is correct, the incident has damaged confidence. Sources briefed on the investigation have spoken of a loss of trust in the platform’s current sensor suite. There are also residual worries that cameras remaining powered while the boats themselves were shut down could, in theory, have recorded activity around special-forces facilities.
The episode arrives at a politically sensitive moment. The United Kingdom has spent recent years trying to reduce strategic dependence on Chinese technology in critical national infrastructure and defence equipment. At the same time, the sheer density of Chinese components in the global electronics market makes complete decoupling extraordinarily difficult and expensive.
Quick knowledge check
What type of data did the cameras on the K3 Scout vessels transmit to a Chinese IP address?
Click to reveal key facts
Looking Ahead
The immediate technical fix—disconnecting the cameras from any network—is straightforward. The longer-term challenge is harder. Defence procurement organisations will now face intensified pressure to demand full component-level transparency, independent firmware analysis, and continuous monitoring of outbound traffic on every sensor and communications module entering the military inventory.
Whether the K3 Scout fleet ultimately returns to full operational status with replacement sensors, or whether confidence in the current configuration has been permanently eroded, will be decided in the coming months. What is already clear is that the “heartbeat” that the cameras sent to China has produced a much louder signal inside British defence circles—one that will shape how the next generation of autonomous systems is specified, audited and trusted.
Primary reporting: The Telegraph (9 Aug 2026), BBC News, Ministry of Defence statements, Kraken Technology Group responses, and subsequent coverage across defence specialist outlets.
Leave a Reply