Cameras fitted to Royal Navy surveillance drones used by British special forces secretly transmitted data to an IP address in China, The Telegraph reported, prompting the Ministry of Defense to remove internet connectivity from the systems.
The cameras were installed on K3 Scout surveillance drones used by the Royal Marines since March as part of a £12 million fleet.
According to The Telegraph, an investigation found that Chinese-made components inside the cameras were sending "heartbeat communications"—signals confirming that the devices were online and functioning normally—to a device in China.
The Ministry of Defense said there was no evidence that sensitive data or systems had been accessed, compromised, or transmitted abroad.
The drones were supplied by British defense contractor Kraken Technology Group, which sourced the cameras from a third party that had provided assurances about their security.
The discovery raised concerns that security-cleared personnel at the Special Boat Service headquarters in Poole, Dorset, could have been exposed.
There were also concerns that the surveillance drones had operated near highly sensitive meetings involving senior special forces personnel and that the cameras remained active even when the drones were switched off.
A defense source familiar with the matter told The Telegraph that the K3 drones formed part of a future U.K. defense package intended to help secure freedom of navigation in the Strait of Hormuz.
The source said preparations for Britain's planned Gulf missions had been carried out using the drones.
"This is a major failure to check the origins of components, and we have lost confidence in the platform," the source said.
The MoD said it took "security of our equipment, networks, and data extremely seriously" and maintained that no ministry data had been compromised.
The Conservatives called on the government to urgently audit military equipment for hidden Chinese components.
Alicia Kearns, the shadow security minister, said Britain could not claim full control over its military equipment without knowing what components were inside it.
"When cameras built on Chinese parts are found recording our special forces—their faces, training, and operations—we should not be surprised; we should be furious that we still haven't woken up to the realities of the threat we face," Kearns said.
The disclosure comes amid wider concerns over Chinese espionage and supply-chain vulnerabilities.
Last year, MI5 issued a security alert to members of Parliament, warning that Chinese intelligence services were "relentless" in efforts to "interfere" and "influence" Parliament through employment websites, including LinkedIn.
The warning came weeks after a case against two men, including a parliamentary researcher accused of spying for China, collapsed amid the Labour government's inability to label Beijing an enemy.
In 2020, the Conservative government banned Chinese phone maker Huawei from the U.K.'s 5G network over security concerns after reversing an earlier decision to allow the company a role in the system.
The change followed warnings from security officials in Washington that Huawei access carried espionage risks because of China's national security laws.
Since then, supply-chain concerns have led the MoD to remove Chinese hardware and cameras from sensitive locations.
Last month, The Telegraph reported that the Special Boat Service had banned Chinese-made electric cars from its headquarters over similar espionage concerns.
The report comes as the Labour government seeks to reset relations with Beijing through a series of high-profile visits aimed at supporting trade agreements.
Earlier this year, the government approved plans for a Chinese super-embassy at Royal Mint Court in central London despite concerns about its proximity to sensitive communications infrastructure.
Weeks later, Jimmy Lai, a British national and pro-democracy media tycoon in Hong Kong, was sentenced to 20 years in prison under the city's national security laws.
The drone issue also represents a setback for the Royal Navy's Project Beehive, a program intended to develop a combined fleet of uncrewed vessels and traditional warships.
The Navy bought the K3 Scout drones from Kraken for its surface flotilla. The vessels are operated by the Coastal Forces Squadron and the Royal Marines' 47 Commando unit and were intended to modernize British war-fighting capabilities and keep pace with adversaries.
The K3 Scout can carry a 600-kilogram payload and operate continuously for 30 days. The model has also been purchased by U.S. Special Operations Command and has taken part in NATO trials in the Baltic.
The government has pledged £5 billion for drone technology and said it wants military procurement to become "unashamedly pro-Britain."
An MoD spokesperson said a routine cyber vulnerability assessment had identified an issue affecting a subsystem on a Kraken Unmanned Surface Vessel used by the Royal Navy.
"A thorough investigation found no evidence of MoD data or systems being accessed, compromised, or transmitted externally," the spokesperson said.
"Our assurance and testing processes are designed to identify and address potential vulnerabilities early, and we continue to undertake routine security activity across our systems and equipment."
A Kraken Technology Group spokesperson said some third-party, NDAA-compliant cameras contained a small number of components originating outside the U.K.
"After a full audit by both Kraken and the Royal Navy, we are confident no sensitive information has ever been shared outside of intended channels, and any potential vulnerabilities have been identified and closed," the company said.
NDAA compliance refers to equipment that meets requirements under the U.S. National Defense Authorization Act by avoiding components from restricted manufacturers.