Danish Officials Rush to Close Security Loophole in China-made Electric Buses

Authorities from Denmark are actively investigating how to close an apparent safety vulnerability in many Chinese-made electric buses that enables them to be shut down from a distance.

Investigation Prompted by Findings in Neighboring Country

This inquiry follows transport authorities in Norway, where the Yutong buses are also operational, discovered that the manufacturer from China had distant control for program patches and system checks to the bus operating systems – which could be exploited to disrupt transit while in transit.

“The testing revealed risks that we are now taking measures against,” commented the top official of the public transport authority. “National and local authorities have been notified and must help with additional measures at a federal level.”

Proposed Fix and Its Limitations

Their investigations found that online disabling could be blocked by extracting the buses’ mobile chips, but they have not done this because it would also cut off the bus from support services.

• Stricter security requirements for future procurements
• Taking steps prior to the arrival of next generation of buses
• Anticipating vehicles that could be more integrated and tougher to protect

Scale of the Issue in Denmark

Denmark's largest public transport company manages 469 Chinese electric buses, with approximately 260 of these made by Yutong.

“Electric buses – similar to electric cars – can be disabled from afar if their operating programs have internet connectivity,” explained a senior operations executive. “This isn't just a Chinese bus problem. It is a problem for all types of vehicles and devices with China-produced components built in.”

Official Assessment and Alerts

The Danish agency for civil protection and crisis response indicated that it was uninformed of any particular incidents in which electric buses had been disabled, but advised that the vehicles were equipped with “subsystems with web connection and detection devices (imaging devices, audio recorders, location tracking) that can create security gaps which could be used to interrupt bus operations”.

Producer Statement and Information Security

Yutong declared it “fully adheres with governing rules and sector requirements” and that transport data in the EU were stored at a server facility in Frankfurt.

“These records is used only for transport servicing, enhancement and betterment to meet post-purchase service demands,” commented a spokesperson. “The data is secured through data encoding and permission systems. Not anyone is permitted to view this data without customer authorisation.”

Political Response and Worries

A regional councillor stated that Denmark has been “far too delayed” when it came to reliance upon Chinese companies.

“This is a huge problem. We ought not be so dependent on a country that has principles and beliefs so different to Denmark,” he continued. During a period when Denmark was trying to increase its resilience amid allegations of hybrid attacks by Russia, “it’s not very resilient to be totally dependent on China”.

The transport ministry in Norway declined to comment on the matter.