Last week, the main public transport operator in Norway, Ruter, announced the results of a test showing that buses produced by Chinese bus manufacturer Yutong Group can be remotely controlled. The company stated that it would strengthen security measures in response to this finding.
According to a report from the Associated Press on Wednesday, the test was conducted in an underground mine to block external signals. The test involved new Yutong buses as well as vehicles manufactured by VDL in the Netherlands three years ago.
The results showed that the Dutch VDL buses did not have remote connectivity capabilities, while the Chinese Yutong buses could be remotely controlled for software updates and diagnostics. In theory, buses could be remotely forced to stop at any time.
Ruter stated, “The Chinese manufacturer has direct remote access to each bus for software updates and diagnostics.”
Following the test, Ruter’s CEO Bernt Reitan Jenssen stated in a release, “Our attention has shifted from previous concerns to how to implement concrete security systems to protect us from unnecessary manipulation or hacker attacks on buses through remote connection.”
Ruter also emphasized that the cameras inside the buses are not connected to the internet, eliminating the risk of transmitting images or videos externally. The buses are manually operated and cannot be remotely driven. However, manufacturers can access the battery and power control systems through wireless networks, theoretically allowing them to stop or disable the buses at any time.
Ruter noted that Chinese manufacturers have not abused their access rights at present, and the remote connection function is part of the system architecture and is not illegal. However, this raises questions of Europe’s trust in Chinese technology.
Ruter operates half of Norway’s public transport routes, mainly in the Oslo and Akershus regions in the east, with a fleet of over 100 Chinese Yutong buses.
After announcing the test results, Ruter declared that it would introduce stricter security requirements, develop firewalls for local control, prevent hacker attacks, and collaborate with authorities to establish “clear network security requirements.” The company stressed that this risk is not exclusive to Chinese vehicles but a security issue shared by all vehicles with such electronic equipment built in.
The Guardian reported on Yutong’s statement, which emphasized the company’s strict compliance with laws and regulations for vehicle operations, with bus data stored in Germany. An unnamed Yutong spokesperson mentioned that remote connection data is encrypted and solely used for vehicle maintenance, optimization, and improvement to meet customer after-sales service needs.
Yutong’s official website indicates that the company has sold tens of thousands of vehicles to Europe, Africa, Latin America, and the Asia-Pacific region over the past few decades.