When Norwegian transit authority Ruter sent a Chinese Yutong electric bus into an isolated mine for cybersecurity testing, the investigation was responding to two very different fears. One was explicitly geopolitical: could a Chinese-built bus passing through sensitive locations such as Lutvann, headquarters of Norway’s intelligence service, function as a rolling visual-surveillance platform? The other was technological: could a manufacturer with remote diagnostic and software-update access reach systems important enough to disable the bus? The Lion Cage material framed both “Lutvann” and “Kill Switch” as scenarios to investigate. The visual-surveillance scenario was not supported by what the investigators found. The remote-access scenario was.
That distinction largely vanished as the story travelled. The Lutvann concern had attracted political attention because Yutong buses had entered a military facility associated with Norway’s intelligence services, raising obvious questions about the cameras and sensors increasingly built into modern vehicles. But Lion Cage found that the Yutong’s exterior camera system was isolated from the manufacturer’s online systems and concluded that the Lutvann scenario, as it related to images and video, was not possible with the bus. The interior surveillance system had its own operator-side connectivity rather than a covert pathway to Yutong. The most explicitly espionage-focused part of the investigation therefore produced a reassuring result: the bus was not sending the exterior imagery that had made the Lutvann story alarming.
The second finding was real and important. The Yutong was a modern connected vehicle with over-the-air software updating and remote diagnostics, and Ruter found an internet-connected path through the manufacturer’s systems into operationally important parts of the bus, including the battery and power-supply control environment. Sufficiently privileged access could therefore potentially interfere with operation and render the vehicle unusable. My reaction when I first encountered that result, however, was much less dramatic than the headlines: of course it could. A manufacturer that can diagnose a vehicle remotely and send software updates to it necessarily has a communications path from outside the vehicle to systems inside it. Cars, trucks and buses have been becoming networked computers for years. The meaningful security questions are what that path can reach, what it can change, how it is authenticated and logged, and who can sever it. None of those questions is inherently Chinese.
