Denmark Rushes to Fix Security Flaw in Chinese Buses

By Staff, Agencies

Authorities in Denmark are urgently studying how to close an apparent security loophole in hundreds of Chinese-made electric buses that enables them to be remotely deactivated.

The investigation comes after transport authorities in Norway, where the Yutong buses are also in service, found that the Chinese supplier had remote access for software updates and diagnostics to the vehicles’ control systems – which could be exploited to affect buses while in transit.

Amid concerns over potential security risks, the Norwegian public transport authority Ruter decided to test two electric buses in an isolated environment.

Bernt Reitan Jenssen, Ruter’s chief executive, said: “The testing revealed risks that we are now taking measures against. National and local authorities have been informed and must assist with additional measures at a national level.”

Their investigations found that remote deactivation could be prevented by removing the buses’ sim cards, but they have not done this because it would also disconnect the bus from other systems.

Ruter said it planned to bring in stricter security requirements for future procurements. Jenssen said it must act before the arrival of the next generation of buses, which could be even “more integrated and harder to secure”.

Movia, Denmark’s largest public transport company, has 469 Chinese electric buses in operation – 262 of which were manufactured by Yutong.

Jeppe Gaard, Movia’s COO, revealed last week that electric buses, like electric cars, can be remotely deactivated if their software has web access. He emphasized that this issue isn’t specific to Chinese buses, but affects all vehicles with Chinese electronics

Gaard noted that the Danish civil protection agency was unaware of any cases of electric buses being deactivated but warned that their internet-connected subsystems, including cameras and GPS, could be vulnerable to exploitation, potentially disrupting operations.

Yutong stated it "strictly complies with local laws, regulations, and industry standards" where its vehicles operate, and that its EU vehicle terminal data is stored at an Amazon Web Services [AWS] data center in Frankfurt.

A spokesperson confirmed that the data is used exclusively for vehicle maintenance and improvement, protected by encryption and access controls. Yutong fully complies with EU data protection laws.

Thomas Rohden, the chair of the Danish China-Critical Society and a regional Social Liberal party councillor, said Denmark has been “way too slow” when it came to dependence on Chinese companies.

Rohden warned that Denmark’s reliance on China is a major issue, especially as the country seeks resilience amid Russia’s alleged hybrid attacks.

The Norwegian ministry of transport declined to comment.