A British soldier was hacked and blackmailed over nude photos on his phone after disobeying an order to remove his SIM card while on a Nato exercise near the Russian border.

Daniel Barton-Kennedy, 28, was sentenced to 10 months in military prison after hackers accessed the photos, identified him on social media, and demanded £350.

While the hackers’ identities remain unknown, court documents noted that Barton-Kennedy was stationed in an area “subject to significant interest from Russian intelligence services”.

The case, tried by court martial, comes amid ever-growing fears of Russian cyber espionage and sabotage, as it escalates its “grey war” against Britain.

“This is exactly what the Russians and others are looking for. He’s a classic person to manipulate, and again, it’s up to his chain of command,” said Hamish de Bretton-Gordon, a former British Army colonel. “They should have been more forensic in dealing with this.”

£100 sent to hackers who ‘bombarded with messages’

Barton-Kennedy, a corporal with the 1st Battalion of the Duke of Lancaster Regiment, ignored an order to remove his SIM card when his unit left Hull on 7 January to take part in Exercise Eastern Warrior in Tapa, Estonia – about 80 miles (128km) from the Russian border.

Court documents show the unit were told as they left the UK to also switch off location settings and use a trusted virtual private network on all personal electronic devices. 

This policy was designed to reduce the risk of deployed personnel inadvertently revealing details including the location of military personnel or equipment, training patterns or readiness activities, the batallion’s intelligence officer, named as Captain Farthing, said in court documents.

On 19 January, Barton-Kennedy told his platoon commander he had received messages from an unknown party who had acquired nude photographs of him from his mobile phone and identified him on social media.  

By then, he had already made one payment of £100 – “to buy himself some time in the hope the messages would stop” – but received a further demand for £250, court documents said. He was “bombarded with messages” and in a “state of shock”, the documents said.

In evidence to the court, Farthing said: “Military activity in the region is subject to significant interest from Russian intelligence services and other actors seeking to collect information on Nato capabilities, force disposition, activity patterns, and personnel movements.”

At a Military Court Centre at Catterick Garrison, Barton-Kennedy – whose partner was pregnant when he disobeyed the order to remove his SIM card – pleaded guilty to disobedience to a lawful command.

He was sentenced to 10 months service detention and reduced in rank from Corporal to Lance Corporal. An appeal to the length of the sentence was later dismissed in the Court of Appeal.

How UK soldiers could be recruited as spies

It was not known whether the phone was compromised by criminals or by a foreign intelligence agency, according to the court martial.

But Court of Appeal judges wrote: “The fact that a connected mobile phone could be used to locate a military unit in Estonia (close to the Russian border) is a factor which makes this a very serious offence.”

De Bretton-Gordon said that Barton-Kennedy’s location made him a vulnerable target.

“Those of us who spent a long time in Iraq and Afghanistan absolutely knew the vulnerabilities, and the vulnerabilities are even greater now.

“Because in Estonia, you’ve got the Russians who are trying to hoover up every little bit of intelligence.”

Russia is always looking for personal vulnerabilities to exploit, he said, adding he was “surprised” at the breach and expected Army chiefs to beef up checks on military personnel as a result.

“Going to Estonia or going on operations anywhere, it’s standard operating procedure – no phones,” he said. “It’s really serious. This could affect lives, and of course people like the [Russian intelligence services] FSB and the GRU can use your phone to listen to what’s going on around you as well. It’s very capable and very dangerous.”

Katja Bego, a research fellow at Chatham House’s  international security programme, highlighted how Russians’ gathering kompromat on people with specialist knowledge, such as members of the military or diplomats, could be used to recruit them as spies. There is no suggestion that Barton-Kennedy was targeted in this way.

“They’ll have knowledge about the nature of the kind of operations of what’s happening on the ground,” she said.

“I think that that would be very valuable information that most military staff really would have, particularly ones on the ground in Estonia, [who] are really on the front line of some of that planning.  They’re always going to be a very valuable target.

“It happens quite a lot. There’s honeypots, etc.

“That has been a tactic they [Russia] have used. It’s a tactic also, to be fair, that UK and Nato allies use against its adversaries. It is sort of the age-old way of of doing some of this.”

De Bretton-Gordon added: “This is exactly how GRU and FSB operate – that’s why soldiers are to be very careful  with their electronic devices and most especially on operations and at work.”

Soldiers face ‘disciplinary action’ for exposing phones to hackers

Military policy warns that any access by a hostile state to intelligence gained from mobile phones via SIM cards “could expose service personnel to harassment, targeting, coercion, surveillance, or other security risks”, the court document said.

Earlier this year, The i Paper revealed how more than 500 members of the British Armed Forces stationed at sensitive military sites have revealed their locations and personal details publicly, on the popular fitness app Strava.

An Army spokesperson said: “The Army implements specific security measures on deployments to ensure the safety of our personnel and protect mission success.

“Any breaches of Army security measures that might compromise personal safeguarding or operational security will be dealt with swiftly, and offending personnel can expect uncompromising disciplinary action.”