Denmark may have just realised that China can deactivate hundreds of buses in the country

Authorities in Denmark are reportedly investigating a ‘dangerous’ security vulnerability in hundreds of Chinese-made electric buses that potentially allows them to be remotely deactivated.

The investigation has been prompted by findings from Norway, where transport officials discovered that the Chinese supplier, Yutong, maintains remote access to the vehicles’ control systems for diagnostics and software updates. This access, authorities fear, may be exploited to disrupt buses while they are in transit.Movia, the country’s largest public transport company, operates 469 Chinese electric buses, with 262 manufactured by Yutong, a report by The Guardian said.

Jeppe Gaard, Movia’s chief operating officer, acknowledged that he was recently informed that “electric buses – like electric cars – can be remotely deactivated if their software systems have web access.”Gaard added that the problem is not specific to Chinese buses but affects “all types of vehicles and devices with Chinese electronics built in.”The Danish agency for civil protection and emergency management, Samsik, confirmed it has been contacted by Movia.

Samsik warned that the vehicles are equipped with subsystems with internet connectivity and sensors – including cameras, microphones, and GPS—that “can constitute vulnerabilities which could be exploited to disrupt bus operations.”

Norwegian test confirmed security risk

The initial alarm was raised by Ruter, Norway’s public transport authority. Amid growing concerns over potential security flaws, Ruter tested two electric buses from Yutong in an isolated environment.

Bernt Reitan Jenssen, Ruter’s chief executive, stated that the testing “revealed risks that we are now taking measures against,” and noted that national and local authorities have been informed.While investigators found that removing the buses' SIM cards could prevent remote deactivation, they opted against this action as it would also disconnect the vehicles from essential operating systems.In response to the security concerns, a spokesperson for Yutong stated that the company "strictly complies with the applicable laws, regulations, and industry standards" of the locations where its vehicles operate. Yutong also says that its vehicle data in the EU is stored at an Amazon Web Services (AWS) datacentre in Frankfurt and is used solely for maintenance and optimisation.