Denmark's Authorities Rush to Plug Safety Gap in China-made Electric Buses

Officials in Denmark are urgently studying methods to seal an apparent security loophole in hundreds of China-produced electric buses that enables them to be remotely deactivated.

Probe Triggered by Discoveries in Nearby Country

The investigation was initiated after public transit officials in Norway, where the Yutong buses are also in service, discovered that the manufacturer from China had online connectivity for system upgrades and diagnostics to the bus operating systems – which may be manipulated to disrupt transit while operating.

“These trials uncovered vulnerabilities that we are now working to mitigate,” said the chief executive of the transit agency. “Federal and regional authorities have been informed and must support further actions at a countrywide scale.”

Proposed Fix and Its Drawbacks

Their analysis found that remote deactivation could be prevented by extracting the buses’ sim cards, but they have not done this because it would also cut off the bus from other systems.

• Stricter security requirements for new acquisitions
• Taking steps prior to the introduction of advanced versions of buses
• Getting ready for vehicles that could be more integrated and harder to secure

Extent of the Issue in Denmark

The biggest Danish public transport company operates 469 Chinese electric buses, with 262 of these produced by Yutong.

“E-buses – similar to electric cars – can be shut down remotely if their digital systems have web access,” explained a senior operations executive. “This is not a China-made vehicle problem. It is a problem for every kind of vehicles and devices with Chinese electronics incorporated.”

Official Assessment and Alerts

The Danish agency for public safety and crisis response stated that it was uninformed of any particular incidents in which electric buses had been deactivated, but warned that the vehicles were equipped with “subsystems with web connection and detection devices (imaging devices, microphones, GPS) that can represent weaknesses which could be leveraged to disrupt bus operations”.

Producer Statement and Data Security

The manufacturer stated it “fully adheres with governing rules and sector requirements” and that vehicle terminal data in the EU were stored at a data center in Frankfurt.

“These records is used exclusively for bus upkeep, improvement and improvement to meet client support requirements,” noted a company representative. “This information is secured through information scrambling and permission systems. Nobody is allowed to access this data without user permission.”

Political Response and Worries

An elected official said that Denmark has been “way too slow” when it came to dependency regarding Chinese companies.

“This constitutes a major issue. We cannot afford to be so leaning on a country that has principles and beliefs so distinct from Denmark,” he remarked. While Denmark was trying to increase its resilience amid allegations of combined threats by Russia, “it's not particularly strong to be fully leaning on China”.

Government transport officials in Norway chose not to respond on the matter.