Officials in Denmark are actively investigating ways to shut an apparent security loophole in hundreds of Chinese-made electric buses that permits them to be disabled remotely.
Investigation Triggered by Discoveries in Neighboring Country
The probe comes after transport authorities in Norway, where similar Chinese buses are also operational, determined that the Chinese supplier had online connectivity for software updates and troubleshooting to the transport management units – which may be manipulated to impact vehicles while operating.
“These trials exposed threats that we are now addressing,” said the head of the public transport authority. “Government and municipal authorities have been informed and must assist with further actions at a federal level.”
Proposed Fix and Its Drawbacks
The research revealed that distant shutdown could be avoided by extracting the buses’ mobile chips, but they have refrained from this because it would also cut off the bus from support services.
- Stricter security requirements for future procurements
- Taking steps prior to the arrival of newer models of buses
- Getting ready for vehicles that could be more integrated and more challenging to safeguard
Scale of the Issue in Denmark
Denmark's largest public transport company manages over 450 China-made e-buses, with over 260 of these made by Yutong.
“Electric transports – similar to electric cars – can be shut down remotely if their software systems have online access,” noted a top management official. “This is not a Chinese bus problem. It is a problem for all types of vehicles and devices with electronics from China incorporated.”
Government Evaluation and Alerts
The Danish agency for civil protection and emergency management stated that it was had no knowledge of any actual occurrences in which electric buses had been shut down, but advised that the vehicles were equipped with “subsystems with online access and monitoring equipment (cameras, audio recorders, location tracking) that can create security gaps which could be leveraged to hinder bus operations”.
Manufacturer Response and Data Security
The company stated it “rigorously follows with relevant regulations and sector requirements” and that bus system information in the EU were kept at a datacentre in Frankfurt.
“This data is used only for vehicle-related maintenance, improvement and improvement to meet customers’ after-sales service needs,” noted a official speaker. “This information is protected by storage encryption and security protocols. No one is allowed to access this data without client approval.”
Political Response and Concerns
An elected official stated that Denmark has been “far too delayed” when it came to dependence on Chinese companies.
“This is a significant concern. We ought not be so dependent on a country that has values and ideals so different to Denmark,” he remarked. During a period when Denmark was attempting to enhance its resilience amid claims of hybrid attacks by Russia, “it's not particularly strong to be fully leaning on China”.
Transportation authorities in Norway chose not to respond on the matter.
