Norwegian Analysis Finds Cybersecurity Vulnerability in Electric Bus But Cannot Attribute it to Origin Country

Norway's transit authority tested a Chinese-manufactured Yutong electric bus for security vulnerabilities and identified a genuine remote-access risk through the manufacturer's systems that could potentially interfere with vehicle operation. However, when compared to an older European model with different connectivity architecture, the testing could not definitively establish that the security weakness was unique to Chinese manufacturing or a broader risk inherent to connected vehicles generally. The investigation demonstrated that surveillance concerns were largely unfounded while highlighting manufacturing-independent vulnerabilities in modern connected transit vehicles.

Norway's transit authority conducted isolated cybersecurity testing on a Chinese-made electric bus after concerns arose about potential surveillance and remote-access vulnerabilities in connected transit systems. The investigation successfully ruled out covert visual surveillance risks but did identify genuine pathways through manufacturer systems that could theoretically allow interference with vehicle operations. This finding raised questions about security practices in modern public transportation infrastructure during a period of expanding electric bus adoption across Europe.

The study's methodology limitation became apparent when comparing the tested Yutong against an older European bus model with fundamentally different technological architectures. Because multiple variables changed simultaneously—manufacturing origin, vehicle age, connectivity systems, and design philosophy—the findings could not definitively determine whether identified vulnerabilities were specific to Chinese manufacturing or represented broader industry-wide challenges in connected vehicle design.