The breach, uncovered during routine cybersecurity sweeps by the Ministry of Defence (MoD), targeted the K3 Scout—a high-speed uncrewed surface vessel manufactured by British defence contractor Kraken Technology Group and used for tasks including surveillance and force protection.
The K3 Scout fleet, procured under the Royal Navy’s flagship Project Beehive initiative, was being prepped for high-stakes overseas deployments, including safeguarding commercial shipping lanes against hostile threats in the Strait of Hormuz.
Investigators discovered that third-party camera modules mounted on the vessels contained Chinese-manufactured hardware actively sending automated background telemetry—known in cybersecurity as "heartbeat communications"—to an IP address located inside China.
Officials feared the components could have covertly captured facial recognition data of special forces personnel, mapped sensitive military infrastructure, or recorded confidential briefings prior to mission launches.
In response to the vulnerability, the MoD ordered an immediate blackout of all external network connections to the affected camera modules across the entire fleet.
“A thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally,” a spokesperson for the Ministry of Defence told The Telegraph.
The incident fuels mounting fears that China is spying on Western militaries, following years of warnings from security experts. Western intelligence agencies—such as the FBI, MI5, and NATO cybersecurity arms—have warned for over a decade about these "asymmetric supply chain risks."
While a late-2025 Federal Communications Commission (FCC) blacklisting blocked new DJI models from entering the market, this proposal targets legacy models currently available on store shelves. Existing drone owners would retain flight privileges, but retailers would be prohibited from selling the targeted models—threatening the supply chain for spare parts.
Under China's 2017 National Intelligence Law, Chinese tech firms—regardless of private or state ownership—are mandated to cooperate with government intelligence agencies. Bipartisan lawmakers argue that Beijing could force DJI to hand over sensitive mapping and flight telemetry data, raising significant concerns given that DJI holds an estimated 70 percent share of the U.S. civilian drone market.
DJI has forcefully denied sharing user data with Beijing, asserting that all information is stored locally on user devices or on U.S. servers.
The FCC is accepting public comments on the proposal through Sept. 2, 2026.