LONDON—In a move underscoring growing tensions over supply chain vulnerabilities, the UK government has enlisted its top cybersecurity experts to investigate whether hundreds of Chinese-manufactured electric buses operating on British roads could be remotely disabled by their maker. The probe, initiated by the Department for Transport in collaboration with the National Cyber Security Centre (NCSC), follows alarming discoveries in Norway and Denmark, where similar vehicles were found to have remote access capabilities embedded in their systems.

The buses in question are produced by Yutong, a leading Chinese electric vehicle manufacturer. According to reports, these vehicles have been integrated into public transport fleets across England, with estimates suggesting over 2,500 units in operation since 2018. The concern centers on software and diagnostic modules that could allow remote intervention, potentially halting buses mid-operation—a scenario that raises national security alarms amid escalating geopolitical frictions with Beijing.

Officials are racing to assess the risks after Norwegian authorities revealed that Yutong buses could be ‘stopped or rendered inoperable’ via remote controls in their battery and power systems, as detailed in a report by Cybernews. Similarly, Danish transport providers launched urgent investigations into security loopholes allowing remote access for software updates, according to The Guardian.

European Precedents Spark UK Action

The UK’s investigation mirrors a broader European scrutiny of Chinese technology in critical infrastructure. In Norway, tests uncovered SIM cards in the buses that enabled remote updates and control, prompting Transport Minister Jon-Ivar Nygård to vow enhanced security measures, as reported by Euronews. ‘We cannot accept that foreign actors have the opportunity to interfere with our public transport,’ Nygård stated in a public address.

Denmark’s response was equally swift. Bus operators there discovered that Yutong’s systems allowed remote diagnostics, potentially compromising vehicle control. ‘This is a rush to close a security loophole,’ noted a Danish official in coverage by NBC News, highlighting the urgency as providers worked to patch vulnerabilities.

These incidents have amplified fears in the UK, where Yutong buses serve routes in towns and villages. The Financial Times reported that the probe aims to determine if the vehicles can be ‘turned off from afar,’ with sources indicating that remote meddling by Beijing could disrupt public services, as per Financial Times.

Technical Vulnerabilities Under the Hood

At the heart of the issue are the buses’ embedded telematics and battery management systems. Cybersecurity experts warn that these features, designed for maintenance and efficiency, could be exploited. In Norway, diagnostics revealed remote shutdown capabilities in the power control systems, a finding echoed in a detailed analysis by The Register, which noted that while the UK importer claims compliance with local laws, the potential for remote access persists.

Industry insiders point to China’s national security laws, which mandate companies like Yutong to cooperate with state intelligence efforts. ‘Under Chinese law, every Chinese company can be requested to turn over any and all data or access,’ observed a user on X, reflecting sentiments in posts discussing the risks, as seen in various X threads on the topic.

The Times of India highlighted that the UK probe follows similar actions in Denmark and the Netherlands, investigating potential deactivation of hundreds of buses, per The Times of India. This has led to calls for diversifying supply chains away from Chinese dominance in electric vehicles.

Geopolitical Implications and Supply Chain Risks

The controversy arrives amid heightened UK-China tensions, including recent hacks attributed to Chinese actors. Bloomberg reported on widespread efforts by Chinese state actors to access British critical infrastructure, as noted in X posts referencing a 2024 incident involving the UK Defense Ministry’s payroll system.

Experts like those from MI5 have warned of the ‘epic scale’ of Chinese espionage, with over 20,000 UK individuals approached online, according to X discussions citing a 2023 statement. This backdrop fuels concerns that buses could be weaponized in hybrid warfare, disrupting transport networks.

The Daily Mail reported that Yutong vehicles, purchased by UK transport networks, might be remotely taken over, with the total fleet exceeding 2,500 units, as per Daily Mail. ‘This is not just about buses; it’s about the integrity of our infrastructure,’ a cybersecurity analyst told Moneycontrol in their coverage of rising fears.

Industry Responses and Mitigation Efforts

Yutong has defended its products, asserting that remote features are for legitimate purposes like diagnostics. However, UK importers are under pressure to demonstrate compliance, with The Register noting assurances that the supplier adheres to British regulations.

In response, European nations are bolstering defenses. Norway is increasing security protocols, while Denmark rushes to seal loopholes. The UK’s NCSC is conducting thorough audits, potentially leading to software patches or fleet replacements.

Posts on X, including those from industry watchers, emphasize the need for vigilance, with one noting, ‘UK investigates remote ‘kill switch’ on Chinese-made buses,’ linking to broader globalization and cybersecurity debates.

Broader Lessons for Global EV Adoption

This scandal highlights vulnerabilities in the global shift to electric vehicles, where China controls much of the supply chain. Analysts warn that similar risks could extend to other EVs, smart grids, and IoT devices.

The Telegraph discussed Yutong’s ambitions in London despite accusations, but access restrictions limited details. Nonetheless, the incident prompts a reevaluation of procurement policies, favoring domestic or allied suppliers.

As investigations continue, the UK aims to safeguard its transport sector. ‘We must ensure our public services are not at the mercy of foreign powers,’ a government source told The Guardian, encapsulating the stakes in this evolving cyber threat landscape.