admin
The Royal Navy has a problem that sounds like a spy thriller but is very real: cameras fitted to Kraken K3 Scout unmanned surface vessels were recently found sending “heartbeat” signals to an IP address in China. The Ministry of Defence says it found the activity during a routine cyber check, cut internet access to the cameras, and insists no sensitive data was shown to have been stolen. That explanation is not enough to calm nerves — and it should not be the end of the story.
What happened: Royal Navy drones and spy cameras
The short version is this. The K3 Scout is a British unmanned surface vessel used by the Royal Navy and Royal Marines. During a vulnerability assessment the MoD found that camera units on those vessels were communicating telemetry — so‑called “heartbeat” packets — to an IP in China. Kraken, the supplier, admits some third‑party camera parts came from outside the UK and says audits have closed potential vulnerabilities. The MoD says no evidence shows operational data was exfiltrated.
Why a “heartbeat” is not harmless
People hear “heartbeat” and think, great — a tiny ping, nothing to worry about. Not so fast. Heartbeat and telemetry traffic can reveal when and where a device is used, and it can be the first foothold attackers use to move on to bigger targets. Even if images were never copied, the metadata and network behavior alone can give adversaries a map of our operations. In short: a camera that checks in with a foreign server is not a camera, it is a listening post.
Supply‑chain negligence and procurement questions
This is not just a technical glitch. It is a procurement and policy failure. If third‑party modules in military gear can contain foreign components that “phone home,” then the whole idea of equipment sovereignty is hollow. Shadow Security Minister Alicia Kearns was right to say that if we cannot say what is inside our own military equipment, we cannot claim true sovereignty. The vendor says the cameras were “NDAA‑compliant” and audited, yet the problem appeared anyway. That calls for tougher rules, not reassurances served with a shrug.
What should happen next
The MoD must publish a clear, unclassified summary of the forensic findings and let independent cyber experts review the evidence. Kraken and other contractors must be forced to disclose supplier chains and submit to real audits, not checkbox compliance. We need procurement rules that demand provenance of components, mandatory firmware audits, and penalties for vendors who hide supply‑chain risks. Credit where it’s due: the administration has pushed to reduce foreign tech reliance — that work needs to be accelerated into law and practice.
Call it caution, call it common sense, call it national defense: whatever you call it, this episode proves the obvious — when it comes to military technology, trust but verify is not optional. Britain and its allies must stop treating supply‑chain risk like an IT problem and treat it like the security threat it is. Because whoever put that code in those cameras sure didn’t do it to improve picture quality.
