Detection of a Potential Cybersecurity Threat
Serious cybersecurity concerns have emerged in Norway regarding public buses manufactured by a Chinese company. Research has shown that the manufacturer has the theoretical capability to remotely stop the vehicles, even if they are thousands of kilometers away from China.
Key Investigation Facts
Secret Testing and Its Results
The discovery was made by Ruter, the country’s largest public transport operator, during secret testing in its own closed facility. The research involved checking Dutch and Chinese buses, with hidden Romanian SIM cards found in the Yutong models.
According to Yutong, these SIM cards allow for remote software updates and technical troubleshooting.
However, this connection also provides the company with the theoretical possibility to stop the buses or render them inoperable via a software update. For now, Ruter has emphasized that it has found no evidence of malicious activity.
Security Measures and Government Response
The testing was part of a broader cybersecurity audit aimed at assessing the vulnerabilities of electric vehicles. Ruter’s CEO Bernt Reitan Jenssen noted that the agency is now “moving from concern to concrete knowledge,” implementing new protective measures and strengthening procurement standards to ensure full local control.
These measures include creating internal firewalls, isolating buses from external cloud systems, and collaborating with national authorities to strengthen cybersecurity protocols in the transport sector.
Norwegian Minister of Transport Jon-Ivar Nygård praised the initiative, stating that the government is reviewing risks from suppliers from countries outside Norwegian security alliances.
Scale of the Problem and Future Actions
The issue arises at a time when Norway is rapidly expanding its fleet of Chinese buses. Out of approximately 1,300 electric buses currently operating across the country, about 850 are manufactured by Yutong. In Oslo and Akershus alone, nearly 300 such buses are in daily operation.
Although Ruter emphasizes that the likelihood of the buses being stopped is low, the test highlights a broader discussion about foreign control over critical infrastructure. For now, Ruter is ensuring that each bus can function independently by removing the SIM cards, effectively maintaining operations locally and offline.
This situation points to a growing need for national control over critical infrastructure, especially in the context of the globalization of vehicle manufacturing. The Norwegian experience could become an important precedent for other countries that also use imported equipment in their transport systems, prompting the development of stricter international cybersecurity standards for public transport.