Norway transport firm steps up controls after tests show Chinese-made buses can be halted remotely

Article content

OSLO, Norway (AP) — A leading Norwegian public transport operator has said it will introduce stricter security requirements and step up anti-hacking measures after a test on new Chinese-made electric buses showed the manufacturer could remotely turn them off.

Article content

Transport operator Ruter said test results published last week showed that Chinese bus maker Yutong Group had access to their control systems for software updates and diagnostics. “In theory, this could be exploited to affect the bus,” it said.

Article content

Article content

Article content

The tests — with buses driven in underground mines to strip away external signals — were conducted both on brand-new Yutong buses and on three-year old vehicles from Dutch bus manufacturer VDL, the company said. It said the tests showed that the Dutch buses didn’t have the ability to conduct over-the-air software updates, while the Chinese-made buses did.

Article content

Article content

Yutong did not immediately respond to requests from The Associated Press on Wednesday seeking comment.

Article content

The Guardian newspaper, which reported on the issue, cited a statement from the Chinese company that said it “strictly complies” with the laws and rules of places where its vehicles operate. The statement said data about its buses was stored in Germany.

Article content

The newspaper cited an unidentified Yutong spokesperson saying the data is encrypted and is “used solely for vehicle-related maintenance, optimization and improvement to meet customers’ after-sales service needs.”

Article content

According to Yutong’s website, the company has sold tens of thousands of vehicles across Europe, Africa, Latin America and the Asia-Pacific region in recent decades.

Article content

Article content

The study was initiated in part over concerns about surveillance, at a time when many countries in Europe, North America and beyond have been taking steps to protect data about consumers and remote operations.

Article content

Broader worries about remote control of EVs

Article content

The findings showed that “the manufacturer has direct digital access to each individual bus for software updates and diagnostics,” said Ruter, which says it runs half of Norways’s public transport and operates in Oslo and the eastern Akershus region.

Article content

Concerns about remote control of electric vehicles are not new: U.S. regulators in January opened a probe into Teslas after reports of crashes involving the use of company technology that allows drivers to remotely command their vehicle to return to them, or move to another location, using a phone app.

Article content

The Yutong buses are operated by people — they are not driverless vehicles like taxis and shuttles in places like California and China.

Article content

“Following this testing, Ruter moves from concern to concrete knowledge about how we can implement security systems that protect us against unwanted activity or hacking of the bus’s data systems,” Ruter CEO Bernt Reitan Jenssen said in a statement.