Authorities from Denmark are urgently studying how to close an evident protection gap in many Chinese-made electric buses that permits them to be disabled remotely.
Probe Triggered by Findings in Neighboring Country
The probe comes after transport authorities in Norway, where similar Chinese buses are also operational, found that the manufacturer from China had distant control for software updates and system checks to the transport management units – which could be exploited to affect buses while on the move.
“These trials uncovered vulnerabilities that we are now working to mitigate,” said the chief executive of the transit agency. “Federal and regional authorities have been informed and must support further actions at a national level.”
Proposed Fix and Its Drawbacks
The research determined that remote deactivation could be blocked by taking out the buses’ connectivity cards, but they have avoided this step because it would also isolate the bus from other systems.
- Stricter security requirements for upcoming purchases
- Taking steps prior to the introduction of newer models of buses
- Anticipating vehicles that could be deeper linked and tougher to protect
Scale of the Issue in Denmark
The major Denmark public transport company operates 469 electric buses from China, with over 260 of these made by Yutong.
“Electric transports – similar to electric cars – can be remotely deactivated if their operating programs have web access,” noted a chief operating officer. “This is not a China-made vehicle problem. It is a problem for all types of vehicles and devices with electronics from China built in.”
Government Evaluation and Warnings
Government bodies for public safety and emergency management indicated that it was had no knowledge of any specific cases in which electric buses had been shut down, but advised that the vehicles were equipped with “secondary systems with internet connectivity and detection devices (cameras, audio recorders, location tracking) that can represent weaknesses which could be leveraged to interrupt bus operations”.
Producer Response and Data Security
The manufacturer said it “strictly complies with relevant regulations and commercial guidelines” and that bus system information in the EU were kept at a datacentre in Frankfurt.
“The information is used solely for vehicle-related maintenance, enhancement and advancement to meet post-purchase service demands,” commented a official speaker. “This information is protected by information scrambling and access control measures. No one is allowed to access this data without customer authorisation.”
Government Response and Worries
A regional councillor said that Denmark has been “way too slow” when it came to dependency regarding Chinese companies.
“This constitutes a huge problem. We ought not be so reliant upon a country that has ethics and standards so different to Denmark,” he added. While Denmark was trying to increase its strength amid claims of hybrid attacks by Russia, “it’s not very resilient to be totally dependent on China”.
Transportation authorities in Norway chose not to respond on the matter.
