{"id":7613,"date":"2026-08-19T06:00:00","date_gmt":"2026-08-19T11:00:00","guid":{"rendered":"https:\/\/okdiario.com\/techy\/en\/?p=7613"},"modified":"2026-08-18T21:19:41","modified_gmt":"2026-08-19T02:19:41","slug":"norway-tested-a-chinese-built-bus-inside-a-mountain-and-found-a-foreign-sim-card-holding-a-hidden-kill-switch","status":"publish","type":"post","link":"https:\/\/okdiario.com\/techy\/en\/norway-tested-a-chinese-built-bus-inside-a-mountain-and-found-a-foreign-sim-card-holding-a-hidden-kill-switch\/7613\/","title":{"rendered":"Norway tested a Chinese-built bus inside a mountain and found a foreign SIM card holding a hidden kill switch"},"content":{"rendered":"\n

Norway\u2019s public transit authority Ruter did not settle for a paperwork audit when it wanted to know whether its electric buses<\/a> could be disrupted from afar. It moved a new Yutong bus and a three-year-old VDL bus into an isolated facility inside a mountain, then let security engineers examine how each vehicle communicated with the outside world.<\/p>\n\n\n\n

The headline finding sounds alarming, but the detail matters. The Romanian SIM card was not a physical \u201ckill switch\u201d by itself. It provided a cellular route into the Yutong bus\u2019s battery and power-management systems, giving the manufacturer access for legitimate updates and diagnostics while also creating a theoretical path to stop the bus or render it inoperable.<\/p>\n\n\n\n

What the mountain test found<\/h2>\n\n\n\n

Ruter examined two risks. Could onboard cameras be used for surveillance, and could the buses\u2019 connected systems be exploited to interfere with operations? The cameras passed the test because they were not connected to the internet, meaning their images could not simply be transmitted out of the vehicles.<\/p>\n\n\n\n

\n
\n
\n

Also Read: London’s Waterloo station has started flying drones over the tracks to catch trespassers who keep walking along the rail lines<\/a><\/h4>\n<\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n

The buses handled software very differently. The older VDL could not receive over-the-air updates, while the new Yutong could, and its mobile connection used a Romanian SIM card to reach systems governing the battery and power supply. That modern convenience is also the opening that concerned the investigators.<\/p>\n\n\n\n

There was some good news. Ruter found little integration between the bus\u2019s separate systems and only one route between the outside world and critical functions, making that path easier to isolate, monitor, or delay while an update is inspected. <\/p>\n\n\n\n

Researchers also found vulnerabilities in a Chinese update platform used by Yutong and other customers, but those flaws were reported and fixed before the findings were published.<\/p>\n\n\n\n

\"An
Transit authority Ruter tested electric buses in an isolated facility, uncovering cellular connectivity routes linked to remote update controls.<\/figcaption><\/figure>\n\n\n\n

This was a risk test, not proof of sabotage<\/h2>\n\n\n\n

No evidence shows that Yutong shut down a bus, attempted to interfere with Ruter\u2019s fleet, or used the cameras for spying. The buses cannot be remotely driven<\/a>, and Ruter\u2019s conclusion was deliberately narrower. Manufacturer access to battery and power controls could theoretically be abused by the supplier, a hacker, or someone who compromised the update chain.<\/p>\n\n\n\n

Yutong has said that its European vehicle data are encrypted, stored in Frankfurt, and used for maintenance and service with customer authorization. Ruter gave the company the report before publication and said Yutong\u2019s clarifications added context without changing the main technical findings.<\/p>\n\n\n\n

That distinction is important. A SIM registered in Romania does not prove that commands came from Romania or China, just as a U.S. phone number does not reveal where every cloud service behind an app is located. The security issue is the persistent connection and the authority attached to it.<\/p>\n\n\n\n

Your car already works this way<\/h2>\n\n\n\n

Remote influence over a vehicle<\/a> is not an exotic Chinese feature. General Motors says OnStar can block a stolen vehicle from restarting, reduce it to idle speed while preserving braking and steering, and let authorized fleet managers remotely disable vehicles through Drive Block. Those tools are designed for safety and theft recovery, not sabotage.<\/p>\n\n\n\n

So what makes a city bus fleet different? Scale, governance, and public dependence. One remotely disabled sedan is an incident, while dozens of buses failing together could interrupt commutes, school trips, hospital access, and emergency mobility across a region.<\/p>\n\n\n\n

\n
\n
\n

Also Read: Nvidia sells one chip for every four Huawei chips, and DeepSeek’s CEO just explained why that gap won’t close<\/a><\/h4>\n<\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n

The right question is not simply whether a manufacturer can reach a vehicle. It is who can approve a command, what records are created, whether the owner can revoke access, and how the vehicle behaves when its cloud connection disappears. That is where convenience turns into critical-infrastructure<\/a> policy.<\/p>\n\n\n\n

Clean transit needs local control<\/h2>\n\n\n\n

Both vehicles in Ruter\u2019s test were zero-emission buses, and the authority stressed that the concern came from connected technology rather than electric propulsion or a manufacturer\u2019s nationality. <\/p>\n\n\n\n

Over-the-air service can fix bugs quickly, improve energy management, and keep a bus out of the workshop. Anyone who has waited weeks for a software-related repair can see the appeal.<\/p>\n\n\n\n

But the greener a city\u2019s fleet becomes, the more its climate strategy<\/a> may depend on software written, hosted, and updated beyond the city\u2019s direct control. A bus is no longer only a battery on wheels. To a large extent, it is a rolling computer that happens to carry passengers.<\/p>\n\n\n\n

U.S. safety officials recommend layered defenses around wireless and wired entry points, with special protection for safety-critical controls. Network segmentation, local firewalls, authenticated updates, event logs, rollback plans, and a safe offline mode. Ruter\u2019s plan to inspect or delay incoming updates follows that same basic logic.<\/p>\n\n\n\n

Washington is drawing a similar line<\/h2>\n\n\n\n

The United States already restricts certain connected-vehicle<\/a> software and hardware linked to China and Russia. The Commerce Department rule begins with model year 2027 for covered software and manufacturers, then model year 2030 for covered connectivity hardware, although the current rule applies to vehicles weighing less than 10,001 pounds.<\/p>\n\n\n\n

Congress is considering a broader response. On July 22, 2026, the Senate Commerce Committee advanced the Connected Vehicle Security Act of 2026 by voice vote. The latest official action listed by Aug. 9 was that the amended bill had been ordered reported favorably<\/a>, meaning it had not yet become law.<\/p>\n\n\n\n

\"An
Norway’s transit authority Ruter tested electric buses inside a mountain facility, revealing how over-the-air updates and remote connections function.<\/figcaption><\/figure>\n\n\n\n

This debate reaches beyond the badge on the grille. A European brand can rely on foreign telematics hardware, while a Chinese-built vehicle can use European mobile and cloud infrastructure. Regulators are trying to identify who ultimately controls the software, hardware, updates, and data rather than relying on the final assembly location alone.<\/p>\n\n\n\n

What fleet buyers should demand?<\/h2>\n\n\n\n

Ruter\u2019s response offers a practical model for transit agencies, school districts, delivery companies, and other large buyers. <\/p>\n\n\n\n

\n
\n
\n

Also Read: The Pentagon wants a fleet of reusable bomber drones, but its new prototype can barely lift eighteen pounds of payload off the ground<\/a><\/h4>\n<\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n

Before signing a contract, they should map every data route, identify every party with remote privileges, require local approval for safety-related updates, preserve audit logs, and establish what happens if a supplier, cloud provider, or mobile network becomes unavailable.<\/p>\n\n\n\n

They should also test the vehicle they are actually buying. The VDL and Yutong comparison was useful, but it was not a simple Europe-versus-China experiment because the buses differed in age and capability. A supplier without wireless updates removes one attack path, yet it also gives up fast security patches and remote diagnostics.<\/p>\n\n\n\n

The clean-transport transition does not need fewer connected buses. It needs buses whose digital keys remain accountable to the people operating them.<\/p>\n\n\n\n

The official technical security report was published on Ruter<\/em><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Norway\u2019s public transit authority Ruter did not settle for a paperwork audit when it wanted to know whether its electric … <\/p>\n