Denmark's Authorities Scramble to Plug Security Loophole in China-made E-powered Buses

Officials in Denmark are actively investigating how to close an seeming safety vulnerability in numerous Chinese-made electric buses that enables them to be shut down from a distance.

Probe Triggered by Findings in Neighboring Country

This inquiry was initiated after transport authorities in Norway, where the Yutong buses are also running, determined that the Chinese supplier had remote access for software updates and diagnostics to the vehicles’ control systems – which could be exploited to impact vehicles while operating.

“The testing uncovered vulnerabilities that we are now working to mitigate,” said the top official of the public transport authority. “Government and municipal authorities have been notified and must support further actions at a national level.”

Proposed Solution and Its Limitations

The research determined that online disabling could be prevented by extracting the buses’ connectivity cards, but they have not done this because it would also cut off the bus from support services.

• Tighter safety requirements for future procurements
• Acting before the deployment of next generation of buses
• Anticipating vehicles that could be tighter connected and harder to secure

Scale of the Problem in Denmark

Denmark's largest public transport company operates nearly 470 China-made e-buses, with approximately 260 of these manufactured by Yutong.

“E-buses – like electric cars – can be remotely deactivated if their operating programs have web access,” noted a senior operations executive. “This isn't just a Chinese bus problem. It is a problem for various sorts of vehicles and devices with Chinese electronics incorporated.”

Government Evaluation and Warnings

Government bodies for public safety and crisis response stated that it was had no knowledge of any actual occurrences in which electric buses had been disabled, but warned that the vehicles were equipped with “subsystems with internet connectivity and sensors (cameras, microphones, GPS) that can constitute vulnerabilities which could be used to disrupt bus operations”.

Manufacturer Statement and Data Security

Yutong stated it “fully adheres with governing rules and industry standards” and that vehicle terminal data in the EU were maintained at a server facility in Frankfurt.

“The information is used exclusively for vehicle-related maintenance, optimisation and improvement to meet customers’ after-sales service needs,” commented a official speaker. “This information is safeguarded with data encoding and permission systems. Nobody is allowed to access this data without client approval.”

Government Reaction and Concerns

An elected official said that Denmark has been “much too sluggish” when it came to dependency regarding Chinese companies.

“This constitutes a huge problem. We cannot afford to be so reliant upon a country that has principles and beliefs so unlike Denmark,” he added. While Denmark was trying to increase its durability amid accusations of combined threats by Russia, “it's not particularly strong to be completely reliant on China”.

Government transport officials in Norway refused to speak on the matter.