Denmark races to fix security flaw after discovering China can remotely override electric buses
Investigation launched after discovery of remote access to control systems.
Danish authorities are urgently investigating a potential security vulnerability in hundreds of Chinese-made electric buses that could allow them to be remotely deactivated, following similar concerns raised in Norway.
The issue came to light after Norway's public transport authority, Ruter, discovered that the Chinese manufacturer Yutong had remote access to the buses' control systems for diagnostics and software updates, access that could, in theory, be exploited to interfere with buses in motion.
Tests in Norway expose security risks
Ruter tested two electric buses in isolation to evaluate the risks. "The testing revealed vulnerabilities that we are now addressing," said Bernt Reitan Jenssen, Ruter's CEO, adding that authorities had been informed and national-level action was needed.
Investigators found that remote deactivation could be prevented by removing SIM cards, but that doing so would disconnect the vehicles from key operational systems. Ruter said it would impose stricter cybersecurity requirements for future procurements, warning that upcoming bus generations could be "more integrated and harder to secure."
Danish operators assess their own fleets
In Denmark, Movia, the country's largest public transport company, operates 469 Chinese electric buses, 262 of which were built by Yutong. Movia's chief operating officer Jeppe Gaard said he had been informed that electric vehicles with web-connected systems could be remotely controlled. "This is not just a Chinese bus problem," he said. "It's a risk for all connected vehicles and devices with Chinese electronics."
The Danish Civil Protection Agency said it had no evidence of any buses being deactivated but warned that internet-connected subsystems, including cameras, microphones and GPS, could pose vulnerabilities.
Yutong said it complies with all relevant laws and EU data protection standards, adding that vehicle data in the EU are stored securely in an AWS data centre in Frankfurt.
However, Thomas Rohden, chair of the Danish China-Critical Society, criticised Denmark's dependence on Chinese companies. "We've been too slow. It's a huge problem to rely so heavily on a country with such different values," he said.
