Denmark's Authorities Rush to Plug Security Loophole in Chinese E-powered Buses

Officials in Denmark are urgently studying how to close an apparent safety vulnerability in hundreds of Chinese-made electric buses that allows them to be remotely deactivated.

Investigation Prompted by Findings in Nearby Country

This inquiry comes after public transit officials in Norway, where the Yutong buses are also running, discovered that the manufacturer from China had online connectivity for program patches and troubleshooting to the vehicles’ control systems – which might be misused to affect buses while on the move.

“These trials exposed threats that we are now working to mitigate,” commented the chief executive of the transit agency. “National and local authorities have been notified and must assist with additional measures at a countrywide scale.”

Suggested Solution and Its Drawbacks

The research found that remote deactivation could be avoided by removing the buses’ sim cards, but they have avoided this step because it would also isolate the bus from other systems.

• Enhanced protection requirements for upcoming purchases
• Acting before the arrival of newer models of buses
• Getting ready for vehicles that could be more integrated and harder to secure

Extent of the Problem in Denmark

Denmark's largest public transport company operates 469 Chinese electric buses, with over 260 of these manufactured by Yutong.

“Electric transports – just as electric cars – can be shut down remotely if their software systems have online access,” noted a senior operations executive. “It isn't a Chinese bus problem. It is a problem for all types of vehicles and equipment with China-produced components incorporated.”

Official Assessment and Alerts

National authorities for public safety and emergency management stated that it was uninformed of any specific cases in which electric buses had been deactivated, but cautioned that the vehicles were equipped with “secondary systems with online access and sensors (imaging devices, microphones, GPS) that can constitute vulnerabilities which could be exploited to interrupt bus operations”.

Manufacturer Statement and Data Protection

The company declared it “rigorously follows with governing rules and sector requirements” and that vehicle terminal data in the EU were stored at a server facility in Frankfurt.

“These records is used only for vehicle-related maintenance, improvement and advancement to meet client support requirements,” commented a company representative. “These details is safeguarded with information scrambling and permission systems. Nobody is authorized to see this data without client approval.”

Political Reaction and Worries

An elected official said that Denmark has been “much too sluggish” when it came to dependence on Chinese companies.

“This represents a major issue. We ought not be so dependent on a country that has ethics and standards so distinct from Denmark,” he added. During a period when Denmark was attempting to enhance its strength amid accusations of hybrid attacks by Russia, “it’s not very resilient to be fully leaning on China”.

Government transport officials in Norway refused to speak on the matter.