Norway’s public transit authority Ruter did not settle for a paperwork audit when it wanted to know whether its electric buses could be disrupted from afar. It moved a new Yutong bus and a three-year-old VDL bus into an isolated facility inside a mountain, then let security engineers examine how each vehicle communicated with the outside world.
The headline finding sounds alarming, but the detail matters. The Romanian SIM card was not a physical “kill switch” by itself. It provided a cellular route into the Yutong bus’s battery and power-management systems, giving the manufacturer access for legitimate updates and diagnostics while also creating a theoretical path to stop the bus or render it inoperable.
What the mountain test found
Ruter examined two risks. Could onboard cameras be used for surveillance, and could the buses’ connected systems be exploited to interfere with operations? The cameras passed the test because they were not connected to the internet, meaning their images could not simply be transmitted out of the vehicles.
The buses handled software very differently. The older VDL could not receive over-the-air updates, while the new Yutong could, and its mobile connection used a Romanian SIM card to reach systems governing the battery and power supply. That modern convenience is also the opening that concerned the investigators.
There was some good news. Ruter found little integration between the bus’s separate systems and only one route between the outside world and critical functions, making that path easier to isolate, monitor, or delay while an update is inspected.
Researchers also found vulnerabilities in a Chinese update platform used by Yutong and other customers, but those flaws were reported and fixed before the findings were published.
This was a risk test, not proof of sabotage
No evidence shows that Yutong shut down a bus, attempted to interfere with Ruter’s fleet, or used the cameras for spying. The buses cannot be remotely driven, and Ruter’s conclusion was deliberately narrower. Manufacturer access to battery and power controls could theoretically be abused by the supplier, a hacker, or someone who compromised the update chain.
Yutong has said that its European vehicle data are encrypted, stored in Frankfurt, and used for maintenance and service with customer authorization. Ruter gave the company the report before publication and said Yutong’s clarifications added context without changing the main technical findings.
That distinction is important. A SIM registered in Romania does not prove that commands came from Romania or China, just as a U.S. phone number does not reveal where every cloud service behind an app is located. The security issue is the persistent connection and the authority attached to it.
Your car already works this way
Remote influence over a vehicle is not an exotic Chinese feature. General Motors says OnStar can block a stolen vehicle from restarting, reduce it to idle speed while preserving braking and steering, and let authorized fleet managers remotely disable vehicles through Drive Block. Those tools are designed for safety and theft recovery, not sabotage.
So what makes a city bus fleet different? Scale, governance, and public dependence. One remotely disabled sedan is an incident, while dozens of buses failing together could interrupt commutes, school trips, hospital access, and emergency mobility across a region.
The right question is not simply whether a manufacturer can reach a vehicle. It is who can approve a command, what records are created, whether the owner can revoke access, and how the vehicle behaves when its cloud connection disappears. That is where convenience turns into critical-infrastructure policy.
Clean transit needs local control
Both vehicles in Ruter’s test were zero-emission buses, and the authority stressed that the concern came from connected technology rather than electric propulsion or a manufacturer’s nationality.
Over-the-air service can fix bugs quickly, improve energy management, and keep a bus out of the workshop. Anyone who has waited weeks for a software-related repair can see the appeal.
But the greener a city’s fleet becomes, the more its climate strategy may depend on software written, hosted, and updated beyond the city’s direct control. A bus is no longer only a battery on wheels. To a large extent, it is a rolling computer that happens to carry passengers.
U.S. safety officials recommend layered defenses around wireless and wired entry points, with special protection for safety-critical controls. Network segmentation, local firewalls, authenticated updates, event logs, rollback plans, and a safe offline mode. Ruter’s plan to inspect or delay incoming updates follows that same basic logic.
Washington is drawing a similar line
The United States already restricts certain connected-vehicle software and hardware linked to China and Russia. The Commerce Department rule begins with model year 2027 for covered software and manufacturers, then model year 2030 for covered connectivity hardware, although the current rule applies to vehicles weighing less than 10,001 pounds.
Congress is considering a broader response. On July 22, 2026, the Senate Commerce Committee advanced the Connected Vehicle Security Act of 2026 by voice vote. The latest official action listed by Aug. 9 was that the amended bill had been ordered reported favorably, meaning it had not yet become law.
This debate reaches beyond the badge on the grille. A European brand can rely on foreign telematics hardware, while a Chinese-built vehicle can use European mobile and cloud infrastructure. Regulators are trying to identify who ultimately controls the software, hardware, updates, and data rather than relying on the final assembly location alone.
What fleet buyers should demand?
Ruter’s response offers a practical model for transit agencies, school districts, delivery companies, and other large buyers.
Before signing a contract, they should map every data route, identify every party with remote privileges, require local approval for safety-related updates, preserve audit logs, and establish what happens if a supplier, cloud provider, or mobile network becomes unavailable.
They should also test the vehicle they are actually buying. The VDL and Yutong comparison was useful, but it was not a simple Europe-versus-China experiment because the buses differed in age and capability. A supplier without wireless updates removes one attack path, yet it also gives up fast security patches and remote diagnostics.
The clean-transport transition does not need fewer connected buses. It needs buses whose digital keys remain accountable to the people operating them.
The official technical security report was published on Ruter.
