Danish Authorities Rush to Close Security Gap in China-made E-powered Buses

Officials in Denmark are actively investigating how to close an evident safety vulnerability in many China-produced electric buses that allows them to be remotely deactivated.

Investigation Prompted by Discoveries in Neighboring Country

The investigation follows transport authorities in Norway, where the Yutong buses are also running, found that the Chinese supplier had distant control for program patches and troubleshooting to the vehicles’ control systems – which could be exploited to affect buses while on the move.

“Our examination exposed threats that we are now addressing,” stated the top official of the public transport authority. “Government and municipal authorities have been alerted and must assist with extra steps at a federal level.”

Proposed Solution and Its Limitations

Their analysis found that online disabling could be prevented by removing the buses’ connectivity cards, but they have avoided this step because it would also isolate the bus from support services.

• Enhanced protection requirements for upcoming purchases
• Taking steps prior to the introduction of next generation of buses
• Getting ready for vehicles that could be more integrated and more challenging to safeguard

Scale of the Issue in Denmark

Denmark's largest public transport company runs 469 China-made e-buses, with over 260 of these produced by Yutong.

“E-buses – just as electric cars – can be shut down remotely if their software systems have internet connectivity,” explained a senior operations executive. “It isn't a China-made vehicle problem. It is a problem for various sorts of vehicles and systems with China-produced components built in.”

Government Evaluation and Alerts

Government bodies for civil protection and crisis response indicated that it was not aware of any specific cases in which electric buses had been deactivated, but cautioned that the vehicles were equipped with “component networks with web connection and monitoring equipment (cameras, audio recorders, GPS) that can create security gaps which could be leveraged to hinder bus operations”.

Manufacturer Statement and Data Security

The company stated it “fully adheres with governing rules and commercial guidelines” and that bus system information in the EU were kept at a server facility in Frankfurt.

“This data is used exclusively for transport servicing, enhancement and betterment to meet customers’ after-sales service needs,” added a spokesperson. “These details is protected by storage encryption and permission systems. Nobody is authorized to see this data without client approval.”

Political Reaction and Worries

A regional councillor said that Denmark has been “way too slow” when it came to dependency regarding Chinese companies.

“This constitutes a significant concern. We ought not be so dependent on a country that has ethics and standards so unlike Denmark,” he remarked. While Denmark was working to boost its strength amid claims of combined threats by Russia, “it's hardly robust to be fully leaning on China”.

Transportation authorities in Norway refused to speak on the matter.