Danish Authorities Rush to Close Security Gap in China-made Electric Buses

Authorities from Denmark are quickly examining how to close an apparent safety vulnerability in hundreds of Chinese-made electric buses that permits them to be disabled remotely.

Probe Triggered by Findings in Neighboring Country

This inquiry comes after transport authorities in Norway, where these electric buses are also operational, found that the Chinese supplier had online connectivity for software updates and system checks to the transport management units – which could be exploited to disrupt transit while operating.

“These trials uncovered vulnerabilities that we are now working to mitigate,” said the chief executive of the public transport authority. “Government and municipal authorities have been notified and must help with additional measures at a national level.”

Proposed Solution and Its Drawbacks

Their analysis revealed that distant shutdown could be blocked by extracting the buses’ connectivity cards, but they have not done this because it would also disconnect the bus from additional networks.

• Tighter safety requirements for upcoming purchases
• Moving ahead of the arrival of advanced versions of buses
• Anticipating vehicles that could be deeper linked and harder to secure

Scale of the Problem in Denmark

The biggest Danish public transport company operates over 450 electric buses from China, with 262 of these produced by Yutong.

“E-buses – like electric cars – can be remotely deactivated if their digital systems have internet connectivity,” noted a top management official. “This is not a Chinese bus problem. It is a problem for every kind of vehicles and devices with Chinese electronics installed.”

Government Evaluation and Warnings

National authorities for civil protection and emergency management reported that it was uninformed of any specific cases in which electric buses had been deactivated, but cautioned that the vehicles were equipped with “component networks with web connection and monitoring equipment (cameras, microphones, location tracking) that can create security gaps which could be leveraged to hinder bus operations”.

Producer Statement and Information Security

Yutong said it “fully adheres with relevant regulations and commercial guidelines” and that bus system information in the EU were maintained at a server facility in Frankfurt.

“This data is used solely for transport servicing, enhancement and betterment to meet customers’ after-sales service needs,” added a spokesperson. “The data is protected by information scrambling and permission systems. Not anyone is authorized to see this data without user permission.”

Government Response and Concerns

A regional councillor said that Denmark has been “way too slow” when it came to reliance upon Chinese companies.

“This represents a significant concern. We cannot afford to be so dependent on a country that has principles and beliefs so different to Denmark,” he remarked. During a period when Denmark was working to boost its strength amid allegations of hybrid attacks by Russia, “it’s not very resilient to be fully leaning on China”.

Government transport officials in Norway chose not to respond on the matter.