A Camera Sold as NDAA-Compliant Was Phoning China from a Royal Navy Boat. The Label Was Never Built to Catch That.

Britain has no component-origin rule of its own, so a British contractor bought against an American one. That statute doesn't cover boats, doesn't reach inside a camera, and nobody certifies compliance with it.

On August 9, The Telegraph reported that cameras fitted to the Royal Navy's K3 Scout uncrewed surface vessels (USVs) contained Chinese-made components sending automated status signals — "heartbeat communications" confirming a device is online — to an IP address in China. The Ministry of Defence removed internet connectivity from the affected cameras. The USVs, twenty of them built by Kraken Technology Group of Fareham under Project Beehive, have been operated by the Royal Marines since March.

Two things should be noted immediately, because most of the coverage since has blurred them.

The MoD's position is that a thorough investigation found no evidence of MoD data or systems being accessed, compromised or transmitted externally. A heartbeat signal is a status ping, not a payload. And the specific camera has not been publicly identified by the MoD or by The Telegraph. An attribution circulating on social media, based on imagery of the vessel's mast-mounted sensor turret, remains unconfirmed and should be treated as such.

What is not in dispute is the sentence that makes this a procurement story rather than a spy story. Asked about the incident by Naval Technology, Kraken said it was aware that some third-party, NDAA-compliant cameras had "a small number of components originating from outside the UK."

A component carried a recognized Western compliance label. Inside it were Chinese parts with an outbound connection. Both statements are true at once, and the reason they can both be true is the subject of this article.

What "NDAA-compliant" actually covers, and what it doesn't

There is no such thing as an NDAA certificate. No agency issues one, no body audits it, and — as drone manufacturers themselves acknowledge — companies self-certify. The Blue UAS Cleared List, now administered by DCMA, exists precisely because the underlying statutes produce no credential of their own. "NDAA-compliant" on a datasheet is a supplier's assertion about itself.

Behind that assertion sit two different laws that work in two different ways.

Section 889 of the FY2019 NDAA is an entity test. It covers telecommunications equipment produced by Huawei or ZTE, and video surveillance and telecommunications equipment produced by Hytera, Hangzhou Hikvision, or Dahua, including subsidiaries and affiliates. For cameras, this is the operative rule, and it asks exactly one question: is one of five named Chinese companies the producer? A camera built in Canada, Taiwan, or Poland containing a Chinese image sensor, a Chinese system-on-chip, and a Chinese communications module passes, because none of the five appears anywhere in the chain.

Section 848 of the FY2020 NDAA is a country test, and it reaches deeper. Codified at 10 U.S.C. 4881 and expanded by Section 817 of the FY2023 NDAA, it bars the Department of Defense from procuring or operating an unmanned aircraft system that uses flight controllers, radios, data transmission devices, cameras, or gimbals manufactured in a covered foreign country, or by an entity domiciled in one. This is a far better rule than 889 for supply-chain purposes. It is country-of-manufacture, not brand, and it names components individually.

It still has two limits that matter here. It enumerates the camera as the unit, not the parts inside the camera, and whether a camera assembled outside China but built on Chinese sub-components violates it is genuinely arguable, not settled. And it governs unmanned aircraft. The K3 Scout is a boat — a surface vessel, outside the definition entirely. Congress has extended this architecture to unmanned ground vehicles and is being asked to extend it to robotics generally, but there is no unmanned surface vessel equivalent in force.

So the label on that camera was a self-declaration, measured against an entity test that cannot see sub-components, or a country test written for aircraft, applied to a vessel neither statute covers.

The UK has no NDAA equivalent, so its contractors buy against America's

The obvious question, and the one that gets the least attention: the NDAA is American law. It has no force in Portsmouth harbor. Why was a British prime contractor specifying against it?

Because the United Kingdom has no equivalent, and the American rule is the only globally legible shorthand on the market. The US federal government is the largest single buyer of electro-optical payloads, radios, and datalinks in the Western world. Once its procurement rules defined what that buyer would accept, component manufacturers reorganized their catalogs around the standard, and "NDAA-compliant" became a product attribute — a line on a spec sheet, a filter on a distributor's site. Everyone else then buys against it, because there is nothing else to buy against.

What Britain has instead is a set of adjacent controls, none of which asks what is inside the box. DEFCON 658 imposes cyber security obligations flowed down through the supply chain. Def Stan 05-135, aligned with NATO guidance, requires suppliers to guard against counterfeit parts — authenticity, not adversary origin. In November 2022 the Cabinet Office instructed departments to stop deploying equipment on sensitive sites made by companies subject to China's national intelligence law, a site-based instruction covering named categories of firm. And the Procurement Act 2023, in force since February 2025, created a central debarment register allowing ministers to exclude companies on national security grounds — a discretionary power over suppliers, not a rule about components.

How far the visibility gap runs was documented before this incident, in a parliamentary answer that is now relevant. Asked about procurement data in January 2025, a defense minister confirmed that the department does not record where a contract is manufactured or the location of the supplier doing the manufacturing. Of 2,266 contracts created in the preceding year, only 26% carried even a known prime location; by value, 19%.

A department that does not systematically record which country a contract is manufactured in is not in a position to know which country a sub-component inside a supplier's camera comes from. That is not a scandal. It is the ordinary condition of defense procurement across most of the Western alliance, and it is why a self-declared American label ended up doing the work.

The political response has gone straight to that point. Shadow security minister Alicia Kearns argued that "if we cannot say with confidence what is inside our own military equipment", Britain cannot claim the equipment is sovereign, and the opposition has called for an urgent audit of military hardware for hidden Chinese content. The instrument such an audit would require is a component-level bill of materials. The MoD does not collect one.

EO 14415 and the EU Trusted Drone Label are rewriting the standard

This is the part that makes the K3 case forward-looking rather than merely embarrassing.

Three weeks before The Telegraph published, on July 20, 2026, Executive Order 14415 directed the Department of War to require that contractors submit a complete indentured bill of materials tracing all components, parts, equipment, software and materials back to the origin of raw materials, alongside written procedures to vet every supplier and subcontractor in a critical supply chain for foreign ownership, control, or influence. Most of it is not self-executing; it runs through policy, regulation, and contract clauses, with implementing rules due inside 270 days. We covered the order's waiver provisions and the capacity gap behind them at the time. The traceability half is the part that will reach Taiwanese suppliers.

The European direction is the same, arriving through a different implementation. The Commission's Action Plan on drone and counter-drone security, COM(2026) 81 final, commits to developing an EU Trusted Drone Label by the end of 2026, relying on independent third-party verification and defining trust and resilience criteria at the product level. A Drone Security Package is due in the same year, including coordinated risk assessment to protect drone and counter-drone technology supply chains from high-risk suppliers.

Read together the trajectory is unmistakable. The entity list is being retired as the primary instrument. What replaces it is documentary: trace the part, name the origin, and have someone other than the seller check.

The K3 camera is the case study for why. A label that asks who made the box was asked to answer a question about what was inside it, and could not.

What indentured bills of materials will mean for Taiwan's suppliers

The temptation for a Taiwanese manufacturer reading this is to conclude that the failure belongs to somebody else. It does not.

The instrument that failed on the K3 was a supplier's own attestation about its own product. That is structurally the same instrument a Taiwanese component maker offers when it tells a European integrator its parts are non-Chinese. The label was not fraudulent; it was almost certainly accurate on its own terms. It simply did not measure the thing the buyer thought it measured. Any Taiwanese supplier issuing a self-declaration today is issuing the same class of document, and it will be tested by the same kind of question.

The exposure is real at the sub-tier, too. Taiwan's position in the Ukraine corridor rests heavily on battery cells, and as DSET's research has shown, the dependency there has moved upstream rather than disappeared — from cells to the Chinese-dominated materials inside them. The same pattern recurs across the component map: rare-earth magnets in motors, packaging and test in silicon, thermal cores in optics. We laid this out layer by layer in our component ecosystem map. Being non-Chinese at the assembly line is not the same as being non-Chinese at the fourth tier, and buyers are about to acquire the vocabulary to tell the difference.

The opportunity in that is straightforward and does not require anyone to spend money speculatively. Within roughly a year, US primes will be pushing indentured BOM demands down through every tier of their supply chains, because the executive order requires them to. European integrators working toward the Trusted Drone Label will be asking for third-party-verifiable product-level evidence rather than a supplier's word. A manufacturer that already knows its own bill of materials to the sub-tier — where each part is made, by whom, under whose control — will be able to answer those questions in days. One that does not will be answering them for the first time under contract pressure, in front of a buyer who now has a reason to be skeptical of assertions.

The conclusion here is not that Taiwan is clean and China is not. It is that the whole industry, Taiwan included, is moving from a world where origin was asserted to one where it must be documented, and the suppliers who get there first will be the ones buyers can actually use. The same logic applies to how European money is scoped: as we noted in our analysis of the Ukraine support loan rules, the paperwork is increasingly the product.

What we still don't know, and why that's the point

Several claims circulating about this story are not established, and it is worth highlighting them.

Whether the affected sub-system appears on any other platform is unknown. Reporting that US Special Operations Command "runs the same platform" needs care: SOCOM's November 2025 award to Kraken was an Other Transaction Authority agreement worth up to $49 million, focused on prototype uncrewed surface and subsurface vessels and associated principally with the K4 Manta. An OTA is a development vehicle, not a fleet purchase. The K3 has been shown to US special operations forces at evaluation events, so involvement is not excluded, but it has not been demonstrated.

Even establishing a shared platform would not establish a shared camera. Kraken markets the K3 as modular, rapidly re-rolled across mission profiles with an interchangeable payload. Sensors are specified per customer. Meanwhile K3 series production has begun at Rheinmetall's Blohm+Voss site in Hamburg, and Anduril will manufacture the K5 and K7 at its US facilities for the US Navy — which multiplies the number of production lines where the question could arise, and the number of jurisdictions that would have to ask it.

So the question — does this component sit on other allied platforms — is currently unanswerable from open sources. Neither the MoD nor Kraken has said.

Under EO 14415, once implemented, this is a database query: name the part, trace the origin, list every program it touches. Today, on both sides of the Atlantic, it is a question that has to be asked of a company one platform at a time, and answered voluntarily. The gap between those two conditions is the entire argument for component-level traceability, and the K3 Scout is what that gap looks like when it fails in public.

The conclusion

Britain outsourced a component-assurance judgment to a foreign statute because it did not have one of its own. The statute was never designed for the platform, could not see past the enclosure, and carried no certifying authority behind it. The failure surfaced only because someone ran a vulnerability assessment after the boats were already in service.

Europe is now designing its own label, with the criteria still open. The United States has already chosen documentary traceability over entity lists. For Taiwan's suppliers, the practical implication is the same: the question buyers ask is shifting from "who made it" to "what is in it, and who checked". And the answer will have to be a document, not an assurance.