Norway’s leading public transport operator, Ruter, has announced new cybersecurity measures after tests revealed that Chinese-made electric buses in its fleet could theoretically be turned off remotely by their manufacturer, as reported by AP.
The discovery came during controlled trials conducted on Yutong electric buses, one of the largest bus makers in China. The tests showed that Yutong had direct access to the vehicles’ control systems for software updates and diagnostics. “In theory, this could be exploited to affect the bus,” Ruter said in a statement.
The tests were carried out underground to block external signals and compared the Yutong models with Dutch-made VDL buses. The results found that the VDL buses lacked the ability to perform over-the-air updates, while the Yutong vehicles did. That difference raised concerns about how much remote control a foreign manufacturer could have over Norwegian public transport systems.
Yutong, which has sold thousands of vehicles across Europe, Africa, and Asia-Pacific, told The Guardian that it “strictly complies” with local laws and that all data collected from its buses is stored in Germany. A spokesperson said the data is encrypted and used solely for maintenance and performance optimization.
The issue has fueled debate across Europe about cybersecurity risks in imported electric vehicles. Several countries, including the United States, have raised similar concerns about remote control capabilities, data collection, and potential surveillance risks in EVs connected via mobile networks.
Ruter’s CEO, Bernt Reitan Jenssen, said the company is now moving from “concern to concrete knowledge” about the vulnerabilities in these systems. “We can now implement security measures that protect us against unwanted activity or hacking of the bus’s data systems,” he said.
Denmark’s transport operator Movia also said it was reviewing its own risk assessments following the Norwegian findings. While no cases of remote interference have been reported, Movia noted that “this is not a Chinese bus concern, it is a problem for all types of vehicles and devices with these kinds of electronics built in.”
Ruter clarified that onboard cameras are not connected to the internet, ruling out live video or image transmission. However, the company confirmed that Yutong buses remain accessible to the manufacturer for battery and power system monitoring via the mobile network. In theory, this means buses could be stopped or disabled remotely.
In response, Ruter said it is imposing stricter cybersecurity rules for all future bus purchases, building new firewalls to ensure local-only control, and working with Norwegian authorities to establish “clear cybersecurity requirements.” It also plans to delay inbound digital signals so that updates from manufacturers can be inspected before reaching the vehicles.
The episode underscores a broader challenge as cities around the world electrify their public transport fleets. More connectivity means more convenience – but also more ways for someone, somewhere, to pull the plug.