Rental Cars Filmed Military Gate Codes During Norwegian Exercise at Oslo Airport

Soldiers discovered sensitive footage on vehicle screens

At least two Deepal rental cars used during a Norwegian military exercise recorded sensitive activity, including soldiers entering vehicles, routes to military facilities and codes used to open gates or doors. The recordings were discovered during Operation Capital, known in Norwegian as Operasjon Hovedstad, at Oslo airport from September 14 to 18.

Home Guard soldiers waiting in the vehicles found the videos while browsing the onboard screens. The military continued using the cars until the exercise ended because replacement vehicles were scarce. Soldiers deleted the footage after discovering it.

Lieutenant Colonel Per Gunnar Grosberghaugen, a spokesman for the Norwegian Home Guard, confirmed that recordings had been found inside the vehicles:

Yes, soldiers from the Home Guard found videos from the vehicles' sensors stored in their systems.

Whether any recordings were transmitted outside the cars remains unknown. Grosberghaugen said he could not rule out sharing with a third party, including in China. Hertz Norge, which supplied the vehicles, said it protects customer information and follows Norwegian and European law.

The incident brings together two practical security problems: ordinary vehicle cameras can capture restricted information, and military personnel may have limited transport alternatives when they discover a problem during an exercise. Norway's military has said it prefers restrictions tailored to particular sites and vehicle capabilities over a general ban on cars made in China.

What the cameras captured

Lieutenant Fredrik Blanck described footage showing who entered and left the cars, who drove them, where they travelled, who their passengers were and how long they stayed at particular locations. Some recordings also showed personnel entering access codes at military facilities.

A gate code is especially sensitive because it serves as a key. A camera facing an entrance can record both the location and the sequence someone uses to get inside. Footage of arrivals and departures can also reveal routines, connecting particular people with particular facilities and times.

The cameras were described as standard dashboard cameras that had remained switched on. Deepal commonly advertises cameras providing a view around the vehicle, although the exact models used in the exercise were not identified. Such equipment can record traffic incidents or help drivers see their surroundings, while also capturing activity near a restricted entrance.

The discovery became public roughly three weeks after the exercise. The central sequence was straightforward:

• September 14 to 18: Norwegian personnel used rental vehicles during Operation Capital at Oslo airport.
• During the exercise: Soldiers browsing vehicle menus discovered stored videos containing sensitive activity.
• Before the exercise ended: Personnel deleted the recordings but continued using the vehicles because alternatives were limited.
• About three weeks later: Details of the recordings became public, followed by confirmation from the Home Guard.

Who made and supplied the cars?

Changan, a Chinese automaker controlled by the state, manufactures the Deepal vehicles. The rental supplier was Hertz Norge, operated by First Rent A Car Norway AS. Volvo Cars controls that rental business, and Volvo Cars is itself controlled by the Geely group.

The ownership chain matters because the manufacturer and rental operator are different businesses. Changan made the Deepal cars. Hertz Norge supplied the rentals through a company connected to Geely. The businesses therefore have different responsibilities concerning vehicle equipment, rental arrangements and information handling.

Hallvard Nerbovik, Hertz Norge's marketing and communications director, gave this assurance:

Our customers' data is safe with us.

Nerbovik also described the company's rules for sharing personal information:

No personal data related to our rentals is shared with car manufacturers, our owners or other third parties without explicit legal grounds.

His response did not specify how the onboard videos were handled or whether they might have been transferred. Changan did not respond to questions about the incident.

Why Norway favours restrictions at individual sites

Norway's military said a blanket prohibition on Chinese vehicles would have an impact out of proportion to the expected security benefit. Its preferred approach is to assess individual sites and, where necessary, exclude vehicles with cameras and sensors regardless of where they were manufactured.

That approach puts the recording equipment at the centre of decisions about access. A camera capable of filming a keypad presents a problem at a secure gate whether it is fitted to a rental car, a privately owned vehicle or a military vehicle.

The shortage of replacement cars during Operation Capital also shows how transport availability affects security decisions. Personnel had found sensitive recordings, yet the vehicles remained necessary to complete the exercise. The response combined deletion of the footage with continued use of the same cars.

Norway's wider security assessments explain the concern about China. Its National Threat Assessment 2026 described increased capacity among Chinese intelligence and security agencies to conduct operations in Norway, including through digital access and human sources. Israel also barred Chinese vehicles from military bases the previous year, according to accounts of its policy.

In that assessment, the Norwegian Police Security Service, known as PST, identified the cyber domain as the greatest intelligence threat from China. It said Chinese intelligence actors would gather information, map Norwegian digital infrastructure and threaten groups and individuals in Norway to deter criticism of the Chinese Communist Party in 2026.

PST expects more Chinese intelligence operations in Norway to be carried out by commercial cyber contractors and individuals. Chinese security and intelligence agencies not only conduct cyber operations themselves but also pay commercial contractors to act on their behalf. Those contractors have taken on a more central role and are increasingly encouraged to recruit their own source networks, expanding the agencies' capacity.

Chinese intelligence services also try to recruit Norwegian citizens to obtain sensitive and classified information, both directly and indirectly. People with ties to China through studies, work, friends or family are more exposed because those connections give the services greater scope to offer rewards or apply pressure. PST also expects attempts to recruit Norwegian citizens through sources in other Western countries.

In Norway's northern regions, scrutiny of Chinese activity and the government's national security strategy have narrowed Chinese actors' room to operate. PST nevertheless expects efforts to gain a foothold to continue, largely through covert approaches by Chinese research institutions and people acting on behalf of Chinese security and intelligence agencies. It assesses research and education as among the few arenas still open to cultivating contacts and cooperation there.

The assessment also warns that China or Iran may seek technology from Norwegian research and development environments by gaining access to research facilities and specialist communities. Using Chinese technology in critical infrastructure creates opportunities for information gathering because Chinese companies are obliged to cooperate with Chinese authorities and their intelligence services.

Norway's chosen response is broader in its technical scope: local restrictions may cover any vehicle whose equipment can collect information that a particular facility needs to protect.

More than 200 sensors in a modern car

The Norwegian National Security Authority, known as NSM, had already warned about vehicle surveillance in its Risiko 2025 assessment, presented on February 5, 2025. A modern car can contain more than 200 sensors and functions that gather information.

The assessment places vehicles within a wider warning about electronic sensors in mobile phones, smartwatches, electricity meters, electronic door locks and drones. Such sensors make everyday life and work easier, but can also be exploited for eavesdropping, surveillance and tracking. Organisations responsible for sensitive assets or assets requiring protection should recognise those security challenges and take precautions to protect what they manage.

NSM described cameras inside cabins that monitor driver attention and may also film passengers. Microphones support telephone calls and voice commands. Exterior cameras and sensors observe people and objects around the vehicle. Together, those systems can collect images, sound and movement information during an otherwise ordinary journey.

Interior cameras are intended to prevent drivers from falling asleep, becoming inattentive or being dazzled when driving in the dark. Many camera sensors improve road safety, but can also be used for other purposes. NSM warned that both sound and images can be exploited for intelligence gathering, even without the owner's knowledge, and that many security scenarios arise if a threat actor gains access to vehicle sensor data or can remotely control vehicle functions.

Internet connections add another layer of risk. They allow maintenance information and software updates to move between a vehicle and outside systems, but can also carry other data. NSM warned that someone gaining access to a car's sensors or controls could use them for surveillance or interfere with vehicle functions.

Modern vehicles have several networks, including connections through the public internet. NSM said these create a vulnerable surface through which vehicle electronics can be affected or controlled from outside. The connections can also transmit data beyond what is necessary for maintenance and software updates.

Purchase contracts often give manufacturers rights to the data a vehicle collects. That information can be resold, used as big data and combined with other data for analysis. Once information has left the vehicle, it is difficult to know what happens to it, creating problems for both privacy and security.

NSM also warned that large amounts of information from sensors and social media, combined with voice or facial recognition and location data, can make it possible to track people with access to protected or other important assets. The same information can reveal where those assets are, what their surroundings look like and where vulnerabilities lie. Sensor data could therefore potentially be used to target national assets.

NSM official Andreas Skjold-Lorange described modern vehicles as:

rolling computers that collect information

He also explained the uncertainty surrounding the information they gather:

We don't know for sure where the information is sent or what it's used for.

NSM's advice is concrete: avoid sensitive conversations near equipment with cameras or sensors, including inside modern vehicles. Organisations protecting sensitive assets should also consider how to shield them from observation, listening and mapping by vehicles nearby.

The recommended precautions extend to other products equipped with such sensors, with equivalent measures for mobile phones.

Oslo's buses raised a different security concern

Tests carried out for Oslo's public transport authority, Ruter, found that Chinese manufacturer Yutong could theoretically immobilise its electric buses remotely through the system used to deliver software updates.

An update delivered over the air reaches a vehicle through a network connection rather than through a cable at a workshop. This can make repairs and software changes easier to distribute. It also creates a connection through which changes affecting vehicle operation can arrive.

Ruter said it introduced mechanisms to monitor and delay incoming signals so it could control updates. That gives the transport operator a way to manage when changes reach its buses.

The issue has a direct civil defence consequence. Norway could use buses to evacuate people during an emergency. If vehicles became unavailable at that moment, the problem would extend beyond cancelled journeys to the ability to move people away from danger.

The rental car incident concerns information captured during military activity. The bus tests concern control over whether vehicles can operate. Both place everyday transport equipment inside a national security calculation: authorities need to understand what a vehicle can observe and who can change what it does.

Fitness apps have exposed military movements too

Strava, an app used to record exercise, has already shown how personal technology can reveal military activity. In 2018, published Strava data allowed military sites and soldiers' routes to be identified, particularly in Afghanistan and Syria.

In March, a sailor's use of the app allowed the French aircraft carrier Charles de Gaulle to be located in almost real time in the eastern Mediterranean. A record intended to track exercise instead exposed the location of a military vessel.

The connection with the Norwegian cars is practical. A device carrying out a familiar task can collect details that become sensitive because of where it is used. A running route can reveal a ship's position. A dashboard recording can reveal an access code. Personnel therefore have to account for the information a device gathers around them, as well as the task they are using it to perform.

Dependence adds another layer of vulnerability

NSM's warning extends beyond individual recordings. The authority, which works to reduce strategic and digital risks, says heavy dependence on products or services from one country can leave Norway exposed, particularly when that country does not cooperate with it on security matters.

Skjold-Lorange described the concern in terms that apply to any supplier country:

If we become too dependent on services or products from a given country, that makes us vulnerable, whatever that country may be.

Operation Capital offers a small but concrete example of dependence limiting choices: a shortage of substitute vehicles kept the affected cars in service after the videos were found. Ruter's response addresses another part of the problem by giving the local operator more control over incoming software changes.

For soldiers, transport operators and the people who rely on them, the immediate issue is control. Authorities need vehicles when an exercise or emergency demands them, while also protecting access codes, movements and the ability to keep those vehicles running.

Key Points

• Rental cars used during Operation Capital at Oslo airport from September 14 to 18 recorded military movements and access codes.
• At least two vehicles were Deepal cars manufactured by Changan and supplied by Hertz Norge.
• Soldiers deleted the footage but used the cars until the exercise ended because replacements were scarce.
• Whether recordings were sent outside the vehicles remains unknown.
• Norway's military favours restrictions tailored to individual sites and recording capabilities rather than a blanket ban on Chinese cars.
• NSM has warned about vehicle sensors, remote access and dependence on suppliers, while Ruter has introduced controls over incoming bus software updates.