Denmark's Authorities Rush to Plug Security Loophole in China-made Electric Buses

Authorities from Denmark are urgently studying how to close an seeming protection gap in hundreds of China-produced electric buses that permits them to be disabled remotely.

Probe Prompted by Discoveries in Nearby Country

The probe comes after transport authorities in Norway, where the Yutong buses are also running, determined that the manufacturer from China had remote access for program patches and diagnostics to the bus operating systems – which may be manipulated to impact vehicles while operating.

“The testing uncovered vulnerabilities that we are now working to mitigate,” stated the head of the transit agency. “Federal and regional authorities have been notified and must help with extra steps at a national level.”

Suggested Solution and Its Limitations

Their investigations found that distant shutdown could be avoided by taking out the buses’ connectivity cards, but they have refrained from this because it would also isolate the bus from additional networks.

• Stricter security requirements for new acquisitions
• Taking steps prior to the deployment of advanced versions of buses
• Preparing for vehicles that could be deeper linked and more challenging to safeguard

Scale of the Problem in Denmark

The biggest Danish public transport company manages 469 electric buses from China, with 262 of these manufactured by Yutong.

“Electric transports – similar to electric cars – can be disabled from afar if their software systems have web access,” noted a chief operating officer. “This isn't just a Chinese bus problem. It is a problem for all types of vehicles and systems with Chinese electronics built in.”

Government Assessment and Warnings

The Danish agency for civil protection and crisis response indicated that it was uninformed of any specific cases in which electric buses had been shut down, but warned that the vehicles were equipped with “component networks with web connection and sensors (imaging devices, microphones, GPS) that can represent weaknesses which could be used to interrupt bus operations”.

Manufacturer Response and Information Protection

The company said it “strictly complies with relevant regulations and industry standards” and that transport data in the EU were stored at a server facility in Frankfurt.

“These records is used exclusively for transport servicing, optimisation and improvement to meet customers’ after-sales service needs,” added a spokesperson. “This information is safeguarded with information scrambling and permission systems. No one is permitted to view this data without user permission.”

Government Reaction and Concerns

A political representative said that Denmark has been “far too delayed” when it came to reliance upon Chinese companies.

“This represents a major issue. We should not be so dependent on a country that has values and ideals so different to Denmark,” he continued. At a time when Denmark was working to boost its strength amid allegations of mixed warfare by Russia, “it’s not very resilient to be totally dependent on China”.

Transportation authorities in Norway declined to comment on the matter.