Yutong rejects remote control claims over electric buses in Norway

As reported earlier this week, the Norwegian public transport operator Ruter identified potential cybersecurity risks related to over-the-air software updates in electric buses from the Chinese manufacturer Yutong following a series of security tests. According to Ruter, digital access to control systems for software updates and diagnostics could, in theory, allow hundreds of Yutong buses in Norway to be manipulated remotely.

Yutong dismissed the allegations that its electric buses operating in Europe could be remotely controlled or deactivated from China. The manufacturer told the German Berliner Zeitung that such control was technically impossible. The electric buses have a data connection for diagnostics and software updates, but no physical link between the main control unit, known as the T-Box, and safety-critical systems such as steering, propulsion or braking.

The Chinese busmaker stated that it stores all vehicle data for the EU at an Amazon Web Services data centre in Frankfurt. The company said the data is used solely for vehicle maintenance and performance optimisation and is protected through encryption and access control.

Yutong also explained that over-the-air updates are carried out only with the operator’s explicit approval and do not affect vehicle control systems. Updates are limited to comfort functions, user interfaces and diagnostic software.

The company confirmed that certain remote features exist for operators, such as the ability to precondition the interior temperature before service begins. However, Yutong said it has no access to those systems, which are managed entirely by the local operator.

Following the concerns raised in Norway, Ruter clarified that its findings were based on a theoretical risk rather than evidence of any incident. The authority confirmed that no safety-related cases had been recorded. The debate nonetheless intensified amid a broader European discussion about the use of Chinese technology in public infrastructure.

The Guardian reports that in Denmark, the national civil protection and emergency management authority has launched an investigation following the Norwegian reports. Movia, the country’s largest public transport company, operates 469 Chinese-built electric buses, 262 of them supplied by Yutong.

The Danish agency said it was not aware of any incidents but confirmed that the vehicles’ connected subsystems, such as cameras, GPS and sensors, could present potential vulnerabilities. The debate over the Yutong buses underscores the growing connection between technology and geopolitics in Europe.

berliner-zeitung.de (in German), theguardian.com