Danish Authorities Rush to Plug Security Loophole in Chinese E-powered Buses

Authorities from Denmark are actively investigating methods to seal an evident safety vulnerability in hundreds of China-produced electric buses that allows them to be remotely deactivated.

Probe Prompted by Findings in Neighboring Country

This inquiry follows public transit officials in Norway, where the Yutong buses are also running, discovered that the Chinese supplier had distant control for software updates and diagnostics to the transport management units – which might be misused to impact vehicles while operating.

“These trials revealed risks that we are now taking measures against,” said the top official of the public transport authority. “Government and municipal authorities have been alerted and must help with further actions at a federal level.”

Proposed Solution and Its Limitations

Their analysis found that online disabling could be blocked by taking out the buses’ mobile chips, but they have not done this because it would also isolate the bus from support services.

• Stricter security requirements for new acquisitions
• Moving ahead of the introduction of advanced versions of buses
• Getting ready for vehicles that could be tighter connected and tougher to protect

Scale of the Issue in Denmark

The major Denmark public transport company manages 469 Chinese electric buses, with over 260 of these manufactured by Yutong.

“Electric transports – similar to electric cars – can be shut down remotely if their digital systems have online access,” stated a senior operations executive. “It isn't a Chinese bus problem. It is a problem for various sorts of vehicles and systems with Chinese electronics built in.”

Government Assessment and Warnings

National authorities for civil protection and emergency management stated that it was had no knowledge of any particular incidents in which electric buses had been disabled, but advised that the vehicles were equipped with “component networks with online access and sensors (imaging devices, microphones, location tracking) that can represent weaknesses which could be leveraged to hinder bus operations”.

Manufacturer Response and Data Security

The manufacturer said it “fully adheres with applicable laws and sector requirements” and that vehicle terminal data in the EU were maintained at a server facility in Frankfurt.

“These records is used exclusively for bus upkeep, optimisation and advancement to meet post-purchase service demands,” added a spokesperson. “This information is protected by information scrambling and access control measures. Nobody is permitted to view this data without user permission.”

Government Response and Worries

A regional councillor stated that Denmark has been “much too sluggish” when it came to dependency regarding Chinese companies.

“This represents a major issue. We should not be so reliant upon a country that has principles and beliefs so distinct from Denmark,” he remarked. While Denmark was working to boost its strength amid accusations of combined threats by Russia, “it’s not very resilient to be fully leaning on China”.

Government transport officials in Norway chose not to respond on the matter.