Denmark's Officials Rush to Close Safety Loophole in Chinese Electric Buses

Officials in Denmark are quickly examining methods to seal an seeming protection gap in hundreds of Chinese-made electric buses that allows them to be disabled remotely.

Probe Prompted by Findings in Neighboring Country

The probe follows public transit officials in Norway, where similar Chinese buses are also running, determined that the Chinese supplier had distant control for software updates and diagnostics to the bus operating systems – which may be manipulated to affect buses while in transit.

“These trials uncovered vulnerabilities that we are now taking measures against,” said the chief executive of the transit agency. “National and local authorities have been informed and must help with additional measures at a federal level.”

Suggested Fix and Its Drawbacks

Their analysis found that online disabling could be avoided by extracting the buses’ mobile chips, but they have avoided this step because it would also isolate the bus from additional networks.

• Enhanced protection requirements for new acquisitions
• Taking steps prior to the introduction of newer models of buses
• Preparing for vehicles that could be more integrated and tougher to protect

Extent of the Problem in Denmark

The biggest Danish public transport company runs 469 Chinese electric buses, with approximately 260 of these produced by Yutong.

“E-buses – like electric cars – can be remotely deactivated if their operating programs have web access,” stated a chief operating officer. “It isn't a Chinese bus problem. It is a problem for all types of vehicles and equipment with electronics from China installed.”

Government Assessment and Warnings

The Danish agency for civil protection and crisis response reported that it was uninformed of any specific cases in which electric buses had been deactivated, but cautioned that the vehicles were equipped with “subsystems with online access and monitoring equipment (cameras, microphones, location tracking) that can constitute vulnerabilities which could be leveraged to hinder bus operations”.

Manufacturer Statement and Data Security

The company declared it “strictly complies with relevant regulations and industry standards” and that bus system information in the EU were maintained at a data center in Frankfurt.

“These records is used only for transport servicing, optimisation and advancement to meet customers’ after-sales service needs,” added a company representative. “This information is protected by storage encryption and access control measures. No one is allowed to access this data without client approval.”

Political Response and Concerns

A political representative said that Denmark has been “way too slow” when it came to reliance upon Chinese companies.

“This constitutes a significant concern. We should not be so reliant upon a country that has principles and beliefs so distinct from Denmark,” he continued. At a time when Denmark was attempting to enhance its durability amid claims of combined threats by Russia, “it's not particularly strong to be fully leaning on China”.

The transport ministry in Norway chose not to respond on the matter.