Denmark investigates security issue in Chinese electric buses

Danish authorities are investigating a security issue in Chinese electric buses that allows them to be remotely disabled by their manufacturer.

The investigation follows the findings of a security audit in Norway. Oslo’s public transportation agency, Ruter, found that buses from the Chinese company Yutong had in-built remote control capabilities, which grant the Chinese supplier access to its software updates and diagnostics.

“In theory, the buses could therefore be stopped or rendered unusable by the manufacturer,” Ruter said at the time.

Bernt Reitan Jenssen, Ruter’s chief executive, added that “national and local authorities have been informed and must assist with additional measures at a national level.”

Now, Denmark is getting concerned: Movia, Denmark’s largest public transport company, has 469 Chinese electric buses in operation – 262 of which were manufactured by Yutong, according to The Guardian.

Jeppe Gaard, Movia’s chief operating officer, announced that he was aware of the news, adding, “This is not a Chinese bus problem. It is a problem for all types of vehicles and devices with Chinese electronics built in.”

According to Gaard, the Danish agency for civil protection and emergency management, Samsik, did not record any cases of remote deactivation of electric buses, but noted that the vehicles had “subsystems with internet connectivity and sensors (cameras, microphones, GPS) that can constitute vulnerabilities which could be exploited to disrupt bus operations”.

Samsik confirmed that it had been contacted by Movia.

A Samsik spokesperson told The Guardian that the authorities had previously advised the transport sector on the purchase of Chinese electric buses and that it will be working in collaboration with other authorities to address potential security risks.

Yutong stressed that it “strictly complies with the applicable laws, regulations, and industry standards of the locations where its vehicles operate”, adding that the stored vehicle terminal data in the EU is used “solely for vehicle-related maintenance, optimisation and improvement to meet customers’ after-sales service needs.” According to them, that data is encrypted and securely stored.

Remote control systems are commonly preferred by manufacturers because they allow them to repair the devices remotely rather than having to send in costly support teams to different regions.