Why Drone Components Are a Security Issue, Not Just a Logistics One 

When defense analysts talk about supply chain vulnerabilities, the conversation often starts with cost and availability: where are parts sourced, at what price, and how reliably. But as unmanned systems have become central to modern defense operations, a more urgent question has moved to the foreground — who else has access to the data flowing through those components?

Chinese drone components cybersecurity risks are no longer a theoretical concern. They are an active challenge being confronted in real time by Ukraine’s drone industry, by NATO allies, and by defense ministries across Europe. What began as a discussion about procurement efficiency has evolved into a strategic question about operational security, data sovereignty, and the hidden costs of global supply chains.

Ukraine — which has built one of the world’s most dynamic and battle-tested drone ecosystems since the start of Russia’s full-scale invasion — sits at the center of this challenge. The country’s experience offers a rare combination: scale, urgency, and direct operational feedback that no peacetime procurement process can replicate.

Dignitas Ukraine President Dmytro Kavun recently contributed his perspective to a dedicated analysis by The Arsenal, one of the leading publications covering European and Ukrainian defense technology. Drawing on frontline-informed experience of what it takes to train and equip operators who depend on this technology every day, his insights underscore what the data already shows: the supply chain question has become inseparable from the security question.

Ukraine’s Drone Supply Chain: From 100% Chinese to a New Reality 

At the outset of Russia’s full-scale invasion in 2022, Ukrainian drone manufacturers relied almost entirely on Chinese-made components. Motors, frames, flight controllers, cameras, navigation systems — the overwhelming majority came from Chinese suppliers, because no domestic alternative existed at the required scale or price point.

What happened next is one of the most remarkable stories of wartime industrial adaptation in modern history.

By 2025, Ukraine had built an ecosystem of approximately 500 drone manufacturers, according to research cited by the Georgetown Security Studies Review. Annual FPV drone production capacity exceeded 4 million units by December 2024, supported by more than 1,500 defense tech companies working across BRAVE1, Ukraine’s government defense accelerator. The country produced 5 million drones in 2025, with plans targeting 7 million or more in 2026.

Alongside scale came localization. Motors, carbon frames, electronic warfare modules, flight controllers, and printed circuit boards — components that once came almost entirely from China — are now largely manufactured in Ukraine. As Iryna Zabolotna, COO of BRAVE1, noted in March 2026: electronic warfare solutions such as jammers and amplifiers, once sourced from China, are now 100% locally produced.

Some Ukrainian manufacturers have reached 80–90% localization across their product lines. Drone producer Vyriy, for instance, sourced 70% of its components domestically by mid-2025 and released the first batch of 1,000 drones built entirely from Ukrainian-made components — including frames, flight controllers, radio systems, and thermal cameras.

A report by the Ukrainian Council of Defense Industry and the Kyiv-based Snake Island Institute found that the share of Chinese components in the value of Ukraine’s drone imports had fallen to approximately 38% in the first half of 2025 — down sharply from near-total dependence three years earlier.

The milestone matters. It reflects not just industrial capacity but strategic intent: Ukraine has treated localization as a defense priority, not merely an economic preference.

The Parts That Remain: Cameras and Navigation Modules 

Progress, however, is uneven. Not all components localize at the same speed, and some remain stubbornly difficult to replace.

Cameras and navigation modules represent the clearest remaining challenge. These components require precision manufacturing at scale, significant capital investment in specialized production lines, and access to materials — including rare earth magnets — where China holds a dominant global position.

As analysts at the Rare Earth Exchanges noted in August 2026, localization percentages can be misleading: airframe assembly can move quickly, but rebuilding the industrial materials stack beneath it takes years. A drone supply chain runs through cameras, sensors, batteries, brushless motors, and the permanent magnets inside those motors — all tiers where Chinese suppliers remain deeply embedded globally, not just in Ukraine.

This is precisely where Chinese drone components cybersecurity risks become most acute. Cameras and navigation systems are not passive hardware. They are connected, networked, and increasingly autonomous — and as the evidence shows, they can communicate with external systems in ways that operators do not anticipate or authorize.

The vulnerability of these specific components to cyber risks is of increasing concern to Ukrainian manufacturers. And that concern is not hypothetical.

The Cybersecurity Threat Made Visible: The Royal Navy Incident 

Abstract concerns about supply chain cybersecurity became concrete in August 2026, when a significant incident involving the British Royal Navy drew international attention to exactly the risks Ukraine’s manufacturers had been warning about.

During a routine cybersecurity assessment of Kraken Technology Group’s K3 Scout unmanned surface vessels — a platform that had attracted serious allied interest, including a reported $49 million agreement with U.S. Special Operations Command — investigators identified unexpected outbound communications from the vessels’ camera subsystems.

The cameras, which contained Chinese-manufactured components, were transmitting what the UK Ministry of Defence described as “heartbeat communications” — signals sent to an IP address in China to confirm the device was online and operational. The MoD disconnected all internet connectivity from the cameras while the investigation proceeded.

What made the incident particularly significant was not just the unauthorized transmission. According to reporting by TechTimes, the cameras appeared to remain active even when the vessels themselves were switched off — suggesting the outbound connection was a persistent behavior embedded in the camera hardware at a level below operator control, not a side effect of normal vessel operations.

The MoD stated that no sensitive data was compromised. But the episode exposed a structural problem that extends far beyond a single procurement decision.

The cameras had reportedly been assessed as NDAA-compliant — meeting U.S. regulations designed to exclude components from designated Chinese manufacturers. As the Defence Security Asia analysis observed, compliance with those restrictions does not guarantee that every subcomponent originates outside China, or that no cybersecurity concern exists. Modern defense electronics incorporate globally sourced processors, circuit boards, firmware, and software libraries across multiple manufacturing tiers — creating dependency chains that prime contractors may not fully see.

The lesson is clear: NDAA certification is a starting point, not an endpoint. For Ukraine’s drone manufacturers, operating under active conditions with Chinese-sourced cameras and navigation modules in their systems, the stakes are considerably higher than they were for the Royal Navy’s surface vessels.

China’s Asymmetric Position: Supplying Both Sides

Ukraine’s supply chain challenge is further complicated by a geopolitical reality that gives it a distinct urgency: China has positioned itself as a supplier to both Ukraine and Russia — while applying restrictions asymmetrically.

In September 2024, China imposed export restrictions on a broad range of drone components, including flight controllers, carbon frames, motors, radio modules, and navigation cameras — restrictions that applied to both sides on paper. In practice, the impact has been starkly unequal.

Ukraine’s Security Service (SSU) found components from Suzhou Ecod Precision Manufacturing — a Chinese firm — in Shahed-type drones used to attack Kyiv on July 4, 2025. By May 2025, Ukraine’s Defense Intelligence reported that the share of Chinese-made electronics in Russia’s Geran-2 drone had grown to 60–65%, pushing U.S.-sourced components out of first place for the first time. As Foreign Minister Sybiha noted, this finding was particularly pointed — the Chinese Consulate General in Odesa was itself damaged in the attack.

In response, Ukraine sanctioned five Chinese companies for supplying components to sanctioned Russian enterprises, including Ningbo BLIN Machinery and Suzhou ECOD Precision Manufacturing. NATO called China a “decisive enabler” of Russia’s military production in July 2025.

Meanwhile, China’s export controls on rare earth magnets — critical for drone motors — caused a 75% drop in global rare earth magnet exports following April 2025 announcements, with European buyers facing pending licenses while Russia continued to receive components.

For Ukrainian drone manufacturers sourcing cameras or navigation modules from Chinese suppliers, this asymmetry is not an abstraction. It means operating with components that may originate from companies maintaining active commercial relationships with the forces those drones are designed to counter.

The EU Exemption: A Necessary Risk or a Strategic Warning? 

The geopolitical tension around Chinese drone components came into sharp institutional relief in July 2026, when the European Union approved an exemption allowing Ukraine to use part of a €5.9 billion drone funding tranche — drawn from a broader €90 billion Ukraine Support Loan — to procure Chinese-made components.

Under the loan’s standard conditions, defense purchases cannot source more than 35% of their value from outside the EU and European Economic Area. The exemption was granted because Ukraine demonstrated that no European-made equivalent could meet its immediate operational needs at the required volume, speed, and price.

Vita Holod, a junior research fellow at Ukraine’s National Academy of Sciences, summarized the situation plainly in comments to RFE/RL: “The EU exemption is quite revealing. It shows that neither Ukraine nor Europe can yet replace Chinese suppliers at the necessary scale, speed, and price.”

France has since pushed to place time limits on these exemptions, seeking to accelerate the transition toward European and Ukrainian suppliers. The tension reflects a genuine structural challenge: the Ukraine Support Loan is designed both to sustain operational capabilities in 2026–2027 and to stimulate European and Ukrainian production — objectives that do not always align in the short term.

The exemption is a pragmatic acknowledgment of where the industry stands today. It is simultaneously a deadline — a signal that the window for Chinese component dependence is finite, and that the transition to secure, domestically or ally-sourced alternatives is a strategic imperative, not a preference.

Ukraine’s Path Forward: Localization as a Defense Strategy 

Ukraine is not waiting passively for the supply chain to change around it. The country has treated localization as an operational priority, and the results — while incomplete — are real.

The government’s “Weapons of Victory” procurement program offers manufacturers guaranteed long-term contracts of three, five, or ten years for achieving over 50% component localization. BRAVE1 has awarded more than 470 grants totaling over 1.3 billion hryvnia as of early 2025, funding R&D across the drone and autonomous systems ecosystem.

Taiwan has emerged as an increasingly important alternative supplier for precision components. Ukrainian drone manufacturer Vyriy has described Taiwan as a “100 percent valuable partner” capable of breaking the Chinese monopoly on certain critical component categories. Taiwanese exports of drone-relevant components to Europe grew dramatically in 2025–2026, driven largely by Ukrainian demand routed through intermediaries in Poland and Czechia.

Cameras — the component at the center of both the Royal Navy incident and Ukraine’s remaining supply challenge — are a specific focus area. Some Ukrainian companies are already planning specialized production facilities for daytime and nighttime drone cameras, according to RBC-Ukraine reporting from June 2026. In January 2026, Defense Minister Fedorov announced that Ukrainian defenders would receive a domestically produced replacement for DJI Mavic reconnaissance drones, with comparable optics and extended flight range — a milestone that would have seemed implausible in 2022.

The direction is clear. The distance still to travel is equally clear.

What This Means for Drone Operators on the Ground 

The supply chain challenge is not confined to manufacturing facilities and procurement offices. It reaches directly to the operators who depend on this technology in the field — and to the organizations training them.

At Dignitas Ukraine, two programs work at precisely this intersection of technology, training, and operational reality.

Freedom Sky trains operators to detect, track, and neutralize Shahed-type drones — the same systems now documented to carry up to 60–65% Chinese-made electronics. Understanding how these systems are constructed, how their components may behave, and where their technical vulnerabilities lie is directly relevant to the operators countering them. Since launching, Freedom Sky has trained over 1,000 operators of Shahed interceptor systems, with 476 trained in 2025 alone.

Victory Robots trains operators of ground unmanned vehicles — systems facing the same supply chain pressures described throughout this article. UGVs deployed on the frontline need to become faster and more robust to better survive operational conditions, raising manufacturing costs and intensifying the pressure on every component sourcing decision. Over 2,023 individuals have been trained in ground robotic systems operations through this program.

The connection between supply chain integrity and operator training is direct. The more operators understand the technical architecture of the systems they work with — including where components come from and what data those components may generate — the more effective and secure their operations become.

To learn more about Dignitas Ukraine’s programs, visit dignitas.fund.

FAQ: Chinese Drone Components and Cybersecurity 

What are the main cybersecurity risks of Chinese drone components? Chinese-made cameras and navigation modules can contain firmware that transmits data to external servers — including IP addresses in China — without operator knowledge or authorization. The Royal Navy K3 Scout incident of August 2026 demonstrated that even hardware assessed as NDAA-compliant can include components with unauthorized persistent outbound communications.

Which Chinese drone components are hardest for Ukraine to replace? Cameras and navigation modules remain the most difficult to source domestically at scale. Motors, frames, flight controllers, and electronic warfare modules have been substantially localized — but precision optics and navigation systems require capital-intensive manufacturing infrastructure that takes years to build. Rare earth magnet supply chains, dominated by China globally, add another layer of complexity.

Is China supplying drone components to Russia? Yes. Ukraine’s Security Service has documented Chinese-manufactured components in Russian Shahed-type drones. By May 2025, Chinese electronics accounted for 60–65% of the components in Russia’s Geran-2 drone. Ukraine has sanctioned multiple Chinese companies for supplying sanctioned Russian defense enterprises.

What is the EU exemption for Chinese drone components? In July 2026, the EU approved an exemption allowing Ukraine to use part of a €5.9 billion drone funding tranche — from the broader €90 billion Ukraine Support Loan — to procure Chinese components that cannot be sourced from EU suppliers at the required scale and speed. The standard rule limits non-EU sourcing to 35% of a defense product’s value. The exemption is now subject to debate, with France pushing to place time limits on its duration.

What does NDAA compliance mean for drone cybersecurity? The U.S. National Defense Authorization Act restricts procurement of components from certain designated Chinese manufacturers. However, NDAA compliance does not guarantee that all subcomponents originate outside China or that no cybersecurity vulnerability exists. Modern defense electronics incorporate globally sourced components across multiple manufacturing tiers that standard compliance assessments may not fully capture.

How is Ukraine addressing Chinese drone component cybersecurity risks? Ukraine is pursuing localization through government procurement incentives, BRAVE1 defense tech grants, and supply partnerships with alternative suppliers including Taiwan. Specialized domestic production facilities for drone cameras are in development. Ukraine has also sanctioned Chinese companies found to be supplying Russian defense enterprises, and its operators are trained to understand the technical architecture of the systems — and threats — they work with.

Sources: The Arsenal, September 2026 (featuring Dignitas Ukraine President Dmytro Kavun); RFE/RL; Kyiv Post; The War Zone; TechTimes; eSecurity Planet; Defence Security Asia; Euronews; Euromaidan Press; Georgetown Security Studies Review; Defense Daily; The Cipher Brief; Security Service of Ukraine; Ukrainska Pravda; Rare Earth Exchanges; RBC-Ukraine