Authorities from Denmark are quickly examining how to close an evident protection gap in hundreds of Chinese-made electric buses that allows them to be shut down from a distance.
Investigation Prompted by Discoveries in Neighboring Country
The investigation comes after public transit officials in Norway, where the Yutong buses are also running, found that the manufacturer from China had remote access for system upgrades and diagnostics to the vehicles’ control systems – which could be exploited to disrupt transit while operating.
“The testing uncovered vulnerabilities that we are now addressing,” stated the top official of the public transport authority. “National and local authorities have been alerted and must assist with additional measures at a national level.”
Suggested Solution and Its Drawbacks
Their analysis revealed that online disabling could be avoided by taking out the buses’ mobile chips, but they have refrained from this because it would also cut off the bus from additional networks.
- Tighter safety requirements for upcoming purchases
- Moving ahead of the deployment of newer models of buses
- Getting ready for vehicles that could be deeper linked and harder to secure
Extent of the Issue in Denmark
The biggest Danish public transport company manages over 450 electric buses from China, with 262 of these manufactured by Yutong.
“E-buses – just as electric cars – can be remotely deactivated if their operating programs have internet connectivity,” explained a top management official. “This isn't just a China-made vehicle problem. It is a problem for all types of vehicles and equipment with electronics from China built in.”
Official Assessment and Warnings
The Danish agency for public safety and emergency management indicated that it was not aware of any particular incidents in which electric buses had been shut down, but warned that the vehicles were equipped with “component networks with web connection and detection devices (cameras, microphones, location tracking) that can create security gaps which could be exploited to disrupt bus operations”.
Producer Response and Data Protection
The company said it “rigorously follows with relevant regulations and industry standards” and that bus system information in the EU were stored at a datacentre in Frankfurt.
“The information is used only for transport servicing, optimisation and betterment to meet customers’ after-sales service needs,” added a spokesperson. “These details is protected by information scrambling and access control measures. Not anyone is authorized to see this data without customer authorisation.”
Government Reaction and Worries
A regional councillor commented that Denmark has been “much too sluggish” when it came to dependency regarding Chinese companies.
“This is a huge problem. We cannot afford to be so reliant upon a country that has values and ideals so unlike Denmark,” he remarked. At a time when Denmark was trying to increase its strength amid claims of combined threats by Russia, “it’s not very resilient to be totally dependent on China”.
The transport ministry in Norway refused to speak on the matter.
