Tests showing Chinese-made buses can be stopped remotely prompt Norwegian pullback

Norwegian public transport operator Ruter is implementing stricter security requirements and anti-hacking measures after tests revealed Chinese bus manufacturer Yutong Group could remotely access and potentially disable its electric buses. This discovery, highlighting Yutong's control system access for software updates and diagnostics, underscores broader industry concerns among European operators regarding data security and remote control capabilities in EVs, particularly those from Chinese suppliers, although the issue is recognized as a general risk for all vehicles with similar electronics. Ruter plans to develop firewalls and collaborate with authorities on cybersecurity standards, while Yutong asserts compliance with local laws and stores vehicle data in Germany for maintenance.

Analysis

Norwegian public transport operator Ruter discovered that Chinese bus manufacturer Yutong Group possesses remote access capabilities to its electric buses for software updates and diagnostics, a feature absent in Dutch competitor VDL's vehicles. This access, while intended for maintenance, theoretically allows Yutong to remotely disable or affect bus operations, raising significant security concerns for critical infrastructure. Ruter, which operates half of Norway's public transport, has over 100 Yutong buses in its fleet.

This incident highlights broader industry vulnerabilities concerning remote control in electric vehicles, echoing recent U.S. regulatory probes into Tesla's remote command features. While Yutong asserts data is encrypted and stored in Germany, experts from the University of South-Eastern Norway emphasize that this is a systemic issue for all vehicles with integrated electronics, not solely a "Chinese bus concern." The general sentiment is moderately negative, reflecting increased caution around EV supply chain security.

In response, Ruter is implementing stricter security requirements, developing firewalls, and collaborating with authorities on clear cybersecurity standards for future procurements. Danish operator Movia is also reviewing its risk assessments for cybersecurity and espionage on scheduled buses. This proactive stance indicates a potential shift towards more stringent regulatory oversight and contractual demands for data sovereignty and control in public transport technology acquisitions across Europe.

Key Decisions for Investors

• Scrutinize EV manufacturers' cybersecurity protocols and remote access capabilities, as regulatory scrutiny and contractual demands for data control are likely to intensify for critical infrastructure suppliers.
• Evaluate public transport operators' capital expenditure plans for increased cybersecurity investments and potential diversification of EV suppliers to mitigate geopolitical and data privacy risks.
• Monitor for new regulations or industry standards from European authorities regarding data sovereignty and remote access for vehicles in public service, which could impact technology providers and procurement.