Security Flaws Uncovered in Electric Buses

A city faced a troubling revelation when it tested its electric buses for security vulnerabilities.

While many urban areas are embracing renewable energy and electric public transport, it seems that the understanding of how public property is managed may not align with this vision.

“So, theoretically, buses could be halted or rendered inoperative,” an official remarked.

This became a harsh reality for Oslo, Norway, when its public transport operator, Ruter, conducted tests on a newly acquired electric bus from a Chinese manufacturer.

This year, about 300 electric buses from Yutong, a Chinese company, arrived in Norway, outfitted with electrical outlets. Yutong hailed this as a significant advancement in its global expansion efforts.

The manufacturer offers at least 15 different types of electric buses, with capacities ranging from 60 to 120 passengers.

According to a report from a Norwegian newspaper, Ruter secretly tested some of its electric buses over the summer. The company decided to further investigate both a bus from a European manufacturer and one from Yutong to assess cybersecurity risks.

The test results were alarming.

Investigators discovered that unlike the European buses, the Chinese models could be remotely controlled from their country of origin.

Ruter noted that since the Chinese firm has access to software updates, diagnostics, and battery management, “in theory, the buses could be shut down or rendered unusable by the manufacturer.”

Details were shared by Arild Tjomsland, who was involved in the testing. He also serves as a special advisor at the University of Southeastern Norway. Tjomsland mentioned that while the buses cannot be directly controlled remotely, bad actors could exploit vulnerabilities to stop the buses.

The situation was further explained by a local news source, indicating that the Chinese government could disable the buses at any moment.

Norway’s transport minister commended Ruter for conducting the experiment and announced that a risk assessment would start regarding partnerships “with countries that pose security concerns.”

Ruter’s CEO, Bernt Reitan Jensen, expressed the company’s intention to collaborate with authorities to enhance cybersecurity measures surrounding public infrastructure.

“It is essential to engage all jurisdictions related to cybersecurity and pool our expertise,” Jensen stated.

As a temporary safeguard, Ruter mentioned that the bus can be disconnected from the internet by removing its SIM card, allowing for “local control if necessary.”

However, it’s unclear whether these SIM cards will be specifically sized for the buses.