Danish Authorities Scramble to Close Safety Loophole in China-made Electric Buses

Officials in Denmark are quickly examining ways to shut an apparent safety vulnerability in many China-produced electric buses that allows them to be shut down from a distance.

Probe Prompted by Discoveries in Neighboring Country

The probe comes after transport authorities in Norway, where these electric buses are also running, found that the Chinese supplier had remote access for software updates and troubleshooting to the bus operating systems – which might be misused to affect buses while operating.

“Our examination revealed risks that we are now working to mitigate,” commented the chief executive of the public transport authority. “Government and municipal authorities have been alerted and must help with additional measures at a countrywide scale.”

Proposed Solution and Its Limitations

Their analysis determined that online disabling could be avoided by removing the buses’ mobile chips, but they have not done this because it would also isolate the bus from support services.

• Stricter security requirements for upcoming purchases
• Acting before the arrival of advanced versions of buses
• Getting ready for vehicles that could be deeper linked and harder to secure

Scale of the Issue in Denmark

Denmark's largest public transport company runs over 450 electric buses from China, with over 260 of these produced by Yutong.

“Electric transports – just as electric cars – can be shut down remotely if their software systems have internet connectivity,” explained a senior operations executive. “This is not a China-made vehicle problem. It is a problem for various sorts of vehicles and systems with China-produced components installed.”

Government Assessment and Alerts

National authorities for public safety and crisis response indicated that it was not aware of any particular incidents in which electric buses had been deactivated, but warned that the vehicles were equipped with “subsystems with online access and sensors (imaging devices, microphones, GPS) that can constitute vulnerabilities which could be exploited to disrupt bus operations”.

Producer Response and Data Protection

The manufacturer declared it “rigorously follows with governing rules and commercial guidelines” and that bus system information in the EU were kept at a server facility in Frankfurt.

“The information is used solely for transport servicing, enhancement and betterment to meet post-purchase service demands,” noted a company representative. “The data is protected by data encoding and permission systems. Not anyone is allowed to access this data without user permission.”

Government Response and Concerns

A regional councillor stated that Denmark has been “far too delayed” when it came to reliance upon Chinese companies.

“This is a significant concern. We ought not be so reliant upon a country that has principles and beliefs so distinct from Denmark,” he remarked. During a period when Denmark was working to boost its resilience amid allegations of hybrid attacks by Russia, “it's not particularly strong to be fully leaning on China”.

The transport ministry in Norway declined to comment on the matter.