A pressing issue has emerged in Denmark, where authorities are racing to address a critical security concern involving Chinese-made electric buses. This story is a cautionary tale about the potential risks of remote access and the urgent need for enhanced security measures.
The Looming Threat: Remote Deactivation
It all began when Norwegian transport authorities discovered a hidden capability within Yutong electric buses - the ability to remotely deactivate them. This revelation sent shockwaves through the industry, prompting an urgent investigation.
The Norwegian public transport authority, Ruter, took swift action. They tested two electric buses in isolation, uncovering risks that demanded immediate attention. Bernt Reitan Jenssen, Ruter's CEO, emphasized the need for national-level action, stating, "The testing revealed risks that we are now taking measures against."
A Complex Web of Security Concerns
Here's where it gets controversial: removing the SIM cards to prevent remote deactivation would also disconnect the buses from essential systems. It's a delicate balance between security and functionality.
Ruter plans to implement stricter security requirements for future procurements, but the concern remains. Jeppe Gaard, COO of Denmark's largest public transport company, Movia, highlights the broader issue: "This is not a Chinese bus problem. It is a problem for all types of vehicles and devices with Chinese electronics built-in."
Movia operates a significant fleet of 469 Chinese electric buses, including 262 manufactured by Yutong. The Danish agency for civil protection has warned of potential vulnerabilities in these vehicles, stating that "subsystems with internet connectivity and sensors can constitute vulnerabilities."
Yutong, for its part, asserts its compliance with applicable laws and industry standards. They store vehicle terminal data in an AWS datacentre in Frankfurt, protected by encryption and access control measures.
A Call for Action and Discussion
Thomas Rohden, a prominent Danish councillor, criticizes the country's slow response to the growing dependence on Chinese companies. He emphasizes the need for Denmark to reduce its reliance on a country with vastly different values and ideals.
In a time when Denmark aims to bolster its resilience against potential hybrid attacks, being dependent on China is a cause for concern.
The Norwegian ministry of transport, however, declined to comment on the matter.
This story raises important questions about the balance between technological advancement and security. Should we prioritize convenience and connectivity over potential risks? How can we ensure the safety of our critical infrastructure in an increasingly interconnected world?
What are your thoughts on this matter? Feel free to share your opinions and engage in a constructive discussion in the comments below!
