European countries were thrown into confusion after it was confirmed that manufacturers can remotely access Chinese-made electric buses that dominate the European market. As security concerns grew, some countries launched emergency investigations.
On the 9th (local time), the Financial Times (FT) of the United Kingdom reported that British transport authorities, working with the National Cyber Security Centre (NCSC), opened a probe into whether Chinese electric bus maker Yutong has remote access rights to the control systems of buses it supplied.
Yutong has supplied about 700 buses to the U.K., which are operating in places including Nottingham, South Wales, and Glasgow. The Department for Transport said it is "working closely with the U.K. National Cyber Security Centre to understand the technical basis for the actions taken by the authorities in Norway and Denmark."
The investigation began after security vulnerabilities in Chinese electric buses were exposed in Northern Europe. On the 28th of last month, Ruter, Norway's largest public transport operator, said a security check of Chinese-made Yutong electric buses and Dutch-made VDL electric buses found that Yutong buses were equipped with Romanian SIM cards. The issue was not found in VDL buses.
According to Ruter, Yutong holds the authority to install software updates remotely on its electric buses through the SIM cards, and in this process can also access battery and power supply control systems. Ruter said, "In theory, the manufacturer could stop a bus or render it inoperable."
FT reported that "such vulnerabilities in electric buses are becoming politically sensitive amid strained U.K.-China relations." Yvonne Stainbank, a Labor Party lawmaker representing Falkirk, Scotland, urged the U.K. government to assess the risks of Chinese electric buses, saying, "The mass rollout of Chinese electric buses on U.K. roads is increasingly clearly a potential national security risk."
Yutong, headquartered in Zhengzhou, Henan province, has exported 110,000 vehicles to more than 60 countries so far. According to the Italian outlet "Sustainable Bus," Yutong ranked No. 1 in the European electric bus market in the first half of this year with a 16% share. Of the roughly 1,300 electric buses currently operating in Norway, 850 are Yutong buses.
Denmark's largest transport company Movia also recently received notice from the Danish Emergency Management Agency that Yutong electric buses could be remotely controlled. The Emergency Management Agency warned Movia that "electric buses are equipped with internet connectivity systems and various sensors including cameras, microphones, and the Global Positioning System (GPS), which could be exploited as vulnerabilities that may disrupt bus operations."
According to FT, Movia is investigating security vulnerabilities in Yutong buses and explained that such issues are not confined to Chinese-made buses but are common to many electric vehicles, including Western-made EVs capable of remote software updates.
Yutong told The Sunday Times in the U.K. that it "strictly complies with relevant laws, regulations, and industry standards in the regions where Yutong vehicles operate," adding, "The collected data is used only for vehicle maintenance, optimization, and improvement and is protected through storage encryption and access control measures." It added, "No one can access or view this data without the customer's permission."