Congratulations, You’ve Unlocked China Global Tracking

Somewhere in Britain’s Ministry of Defence procurement chain, a form was filled out, initialed, filed, and forwarded, and at no point did a single human being ask the one question a curious eight-year-old would have asked within about four seconds: what’s actually inside the box?

The answer, it turns out, was £12 million worth of surveillance drones for the Royal Marines whose cameras came pre-loaded with a feature nobody ordered, nobody wanted, and nobody apparently noticed until it was already parked outside the Special Boat Service headquarters in Poole, on the coast in Dorset, quietly phoning Beijing to say hello.

Congratulations, Ministry of Defence.

You’ve unlocked China Global Tracking.

It wasn’t on the spec sheet. It came free with the components, like a toy in a cereal box, except the toy reports your military’s movements to a foreign intelligence service.

The technical term the investigators used was “heartbeat communications” — periodic pings confirming the cameras were alive and functioning, which is a genuinely poetic way of describing a spy device checking in with its handlers.

And here’s the detail that elevates this from merely embarrassing to genuinely, gloriously absurd: the cameras kept transmitting even when the drones themselves were switched off.

You turned it off.

It didn’t care. It doesn’t answer to you.

It answers to an IP address in China, which is a small but important distinction that apparently eluded everyone in the acquisition process, the security clearance process, and whatever process exists between those two processes to catch exactly this sort of thing.

This is the part that should make you laugh and then immediately stop laughing: the supplier, Kraken Technology Group, bought the cameras from a third party who gave “assurances” about security. Assurances.

Not an audit.

Not a teardown.

Not so much as a Google search.

Somebody said “it’s fine” and somebody else wrote that down as due diligence, and now there’s a national security review underway because the machinery of large institutions has a truly world-class talent for making sure everyone did their job on paper while nobody did the actual job in reality.

Every large bureaucracy eventually discovers this same truth: there is a form for everything and a person accountable for nothing.

The paperwork was immaculate.

The outcome was a Chinese listening device wandering the halls of Britain’s most secretive military unit with a Ministry of Defence lanyard on.

And this isn’t even a new lesson — Britain spent years and considerable political capital banning Huawei from the 5G network over precisely this kind of risk, MI5 has been warning MPs for a year that Chinese intelligence is trawling LinkedIn for recruits, and the SBS itself had already banned Chinese-made electric cars from its own car park.

Somehow, despite all that institutional muscle memory, nobody thought to run the same check on a drone camera before strapping it to a platform meant to protect operations in the Strait of Hormuz.

It’s not that nobody knew the risk existed.

It’s that knowing the risk exists and actually checking for it turned out to be two entirely different departments, neither of which apparently talks to the other.

Somewhere there’s a procurement officer who is, tonight, the most surprised person in Dorset.

And somewhere in Beijing, someone is filing away six months of very well-documented heartbeat data, wondering why it took the British this long to notice their own equipment had a pulse.