A pressing issue has emerged in Denmark, where authorities are racing to address a critical security vulnerability in Chinese-made electric buses. This loophole, which allows for remote deactivation of the buses, has sparked urgent investigations and raised concerns about potential risks.
The story begins in Norway, where transport authorities discovered that Chinese supplier Yutong had remote access to the control systems of their electric buses. This access, intended for software updates and diagnostics, could potentially be exploited to affect buses while in operation.
In response, the Norwegian public transport authority, Ruter, conducted tests in an isolated environment. The results revealed risks that prompted Ruter to take immediate action. Bernt Reitan Jenssen, Ruter's CEO, emphasized the need for national and local authorities to collaborate on additional measures at a national level.
One potential solution involves removing the buses' SIM cards, but this would also disconnect them from other essential systems. Ruter plans to implement stricter security requirements for future procurements to address these concerns.
Denmark's largest public transport company, Movia, operates 469 Chinese electric buses, including 262 manufactured by Yutong. Jeppe Gaard, Movia's COO, was recently made aware of the remote deactivation issue, which he emphasized is not unique to Chinese buses but a problem for all vehicles with web-accessible software systems.
Gaard highlighted the potential vulnerabilities in the buses' subsystems, which include internet connectivity and sensors. These could be exploited to disrupt bus operations, according to the Danish agency for civil protection and emergency management.
Yutong, the Chinese manufacturer, maintains that it strictly adheres to applicable laws and industry standards. They store vehicle terminal data in the EU at an Amazon Web Services (AWS) datacentre in Frankfurt, protected by encryption and access control measures.
Thomas Rohden, chair of the Danish China-Critical Society and a regional Social Liberal party councillor, criticized Denmark's slow response to the issue of dependence on Chinese companies. He emphasized the need for Denmark to reduce its reliance on a country with vastly different values and ideals.
As Denmark navigates this complex situation, the Norwegian ministry of transport has declined to comment. The potential impact of this security loophole on public transport and the steps taken to address it highlight the ongoing challenges of managing technological dependencies in a globalized world.
