Blog · Supply Chain Security

NDAA-Compliant and Still Calling China: The Lesson of the K3 Scout Cameras

Chris A. Grable · August 13, 2026

The builder of the Royal Navy's new K3 Scout uncrewed surface vessels says the cameras on those boats were NDAA-compliant. They were also, according to a routine cyber vulnerability assessment, transmitting automated heartbeat signals to a Chinese IP address through Chinese-made components inside them. Both statements can be true at once, and that is the problem every American program office buying uncrewed systems should take from this case.

What happened

The Royal Marines had operated the £12.3 million fleet since March. Once the assessment detected the traffic, the Ministry of Defence cut the cameras off from internet connectivity. The platform matters beyond the United Kingdom: US Special Operations Command operates the same boat, and the type has taken part in NATO trials in the Baltic.

The boat and the program

The K3 Scout is an 8.4-meter uncrewed surface vessel built by Kraken Technology Group in Fareham, England. The Royal Navy ordered it in March under Project Beehive, a £12.3 million contract for 20 boats assigned to the Coastal Forces Squadron and 47 Commando Royal Marines. Kraken lists a 600-kilogram payload, 30 days of endurance at sea and a top speed of 55 knots. The Telegraph broke the story, and DroneXL's account adds the detail that matters for buyers: the boats were part of the package the United Kingdom offered toward securing navigation in the Strait of Hormuz.

The Ministry of Defence says a thorough investigation found no evidence that its data or systems were accessed or that anything was transmitted externally. Defence sources quoted by the paper were less settled. One said the service had lost confidence in the platform, and the paper reported concern that some cameras stayed active while the vessels were switched off.

What the supplier said

Kraken said it knew some third-party, NDAA-compliant cameras held a small number of components from outside the United Kingdom, and that after a full audit with the Royal Navy it is confident no sensitive information left intended channels and the vulnerabilities are closed. Neither the Ministry nor the paper has named the camera maker, so any identification circulating online remains unconfirmed.

Why the label did not catch it

"NDAA-compliant" is shorthand for several different rules, and none of them is a behavioral test. Section 848 of the FY2020 NDAA restricts DOW procurement and operation of unmanned aircraft systems made in or by entities domiciled in covered foreign countries, and of systems using specified components from those countries, such as flight controllers, radios, data transmission devices, cameras, gimbals, ground control systems, operating software, network connectivity and data storage. Section 889 of the FY2019 NDAA restricts telecommunications and video surveillance equipment from named Chinese companies. The FCC Covered List governs equipment authorization, a regime separate from procurement. The K3 Scout is a surface vessel, so Section 848's aircraft rules do not govern it directly; the label was the supplier's description of the cameras. Each of these rules asks where, or by whom, something was made. The danger in this case came from runtime behavior, which none of them tests.

What to test instead

UDC recommends that companies selling uncrewed systems to DOW treat a supplier attestation as the start of diligence rather than its conclusion. In practice that means three things:

• Observe the device at rest. Power it on, connect it, leave it alone, and record every address it contacts.
• Move network behavior into the test plan. A compliance annex records paperwork; a test plan records what the device actually does.
• Assume the check is cheap. A heartbeat to an unexpected address is easy to see for anyone who looks and invisible to anyone who does not.

The uncomfortable part

Nothing exotic found this. A routine assessment did, which means the same finding was available to any program that chose to run one. The question the K3 Scout raises for buyers and builders alike is not whether the check works. It is what testing was done before the boats entered service, and whether any of it looked at network behavior.

Why this reaches American programs

For cameras, the NDAA label usually rests on Section 889 of the FY2019 NDAA, which names specific Chinese telecommunications and video surveillance manufacturers. The FCC added foreign-made drones and their critical components to its Covered List on 22 December 2025 and in July proposed ending the import and marketing of drones it had already approved, in PS Docket 26-189. Both regimes, like Section 848, work from origin or the identity of the maker. The K3 Scout shows a certified Western product carrying sub-tier parts that behaved badly, which is exactly the case a list of names cannot see. UDC expects the incident to be cited by both sides of the Covered List debate, and recommends that companies selling into DOW be ready to show test evidence of network behavior, not just a certificate, when a program office asks.