Denmark Reviews Electric Bus Security After Norway Finds Remote Access Risk

Norwegian tests prompt checks on hundreds of Danish buses

Denmark is moving to secure its public bus network after controlled tests in Norway found that remote connections on Chinese manufactured electric buses could potentially be used to switch vehicles off during service. The review includes 262 Yutong buses operated by Movia in and around Copenhagen, part of its fleet of 469 Chinese built electric buses across Zealand.

As of November 6, 2025, there were no recorded cases of buses being shut down remotely in either Norway or Denmark. The concern comes from testing that exposed a possible route for interference, rather than an attack on a working bus service.

Ruter, Norway's public transport operator, tested two Yutong buses in an isolated environment. Engineers confirmed that the manufacturer could connect to systems supporting software updates, remote diagnostics and energy management. Those connections serve legitimate maintenance purposes, but security reviewers warned that misuse could interrupt operations.

Yutong rejects the suggestion that a supplier could remotely steer, brake or accelerate its buses. The company says its connection supports maintenance and that systems responsible for essential driving functions are separated from outside access. Ruter's findings focus on a narrower concern: whether connected power or battery management systems could be altered in a way that leaves a bus unable to move.

Danish agencies and operators are now examining how to prevent unmanaged remote access from affecting daily services. Their challenge is to close potentially dangerous routes into a vehicle while retaining the information and maintenance tools that help buses run reliably.

What Ruter found inside the buses

Ruter's engineers found embedded SIM cards and storage modules that enabled a secure mobile connection between the Yutong buses and external servers. A SIM card allows equipment to connect to a mobile network. In these buses, the connection supported remote fault checks and the delivery of software updates.

The engineers concluded that a malicious user, or someone using a compromised vendor account, might be able to interrupt the power supply or other functions needed to keep a bus moving. A compromised account is a legitimate account that someone else has gained access to, allowing that person to use permissions originally granted to the supplier.

Ruter's test did not demonstrate remote steering or braking. It identified the possibility of stopping a bus by cutting traction or power. Traction is the force that moves the vehicle, supplied in an electric bus by its electric drive system.

Ruter also examined buses from a European manufacturer that were of a similar age. Those vehicles did not use remote update functions. This reduced the number of possible entry points for an attacker, while also limiting the flexibility and maintenance efficiency that remote updates can provide.

The comparison helped persuade Norwegian officials that procurement requirements need to be clearer for any bus brand using connected services. Ruter has notified national and local authorities and is preparing stricter security requirements for future purchases.

Why removing a SIM card is an incomplete solution

Ruter's investigators found that removing the SIM cards blocked outside contact with the buses. This offered an immediate way to cut the remote connection, but it also removed services that operators depend on to manage their fleets.

Live arrival information, remote fault detection and predictive maintenance were affected. Predictive maintenance uses information from a vehicle to identify developing problems early, giving technicians a chance to act before a fault takes the bus out of service.

Arrival boards and mobile app predictions rely on vehicle connectivity. Remote software maintenance planning also depends on access to vehicle information. A permanent disconnection would therefore affect both what passengers see and how efficiently operators can keep buses running.

Technicians would lose detailed telemetry, meaning measurements and status information sent from the vehicle, along with early warnings about faults. Service recovery could become slower and maintenance costs could rise because support teams would have less information available before inspecting a bus.

Operators are considering more targeted protections that preserve essential information flows while blocking vendor access unless it is explicitly authorized and supervised. The practical aim is to keep useful connections working without leaving control over important vehicle functions outside the operator's oversight.

How serious is the risk of interference?

Ruter has described its findings as a theoretical risk and said there have been no safety related cases. Officials also say there have been no cases of live remote manipulation of buses. The concern is the possibility that a connected channel could be used to make a vehicle inoperable.

Bernt Reitan Jenssen, Ruter's chief executive, said the likelihood of attempted interference remains low. He nevertheless called for action to reduce the exposure:

We must take the risk seriously.

Yutong says steering, propulsion and braking do not accept commands from external networks. Ruter's tests and explanations from experts point instead to disruption through power or battery management. Such interference could interrupt a service even while the driver retains command of the vehicle's steering and brakes.

Operators regard uncontrolled access to critical equipment as an unacceptable risk. Their concern extends beyond a single bus: if hundreds of vehicles share the same configuration and supplier account, one breach could disrupt a large part of a fleet.

Denmark examines its fleet and purchasing rules

The Danish Agency for Civil Protection and Emergency Management says it is not aware of any confirmed remote deactivation in Denmark. It warns, however, that subsystems and sensors connected to the internet could be exploited to disrupt services if security controls are weak.

The agency is monitoring developments and assessing whether existing guidance is adequate. It is also ready to advise transport operators on preventing interference and responding if it occurs.

Movia, Denmark's largest public transport company, operates 469 Chinese built electric buses across Zealand, including 262 from Yutong. The Yutong vehicles account for about 56 percent of that Chinese built fleet, calculated from those two figures.

Jeppe Gaard, Movia's chief operating officer, has acknowledged that connected vehicles can be exposed to remote interference when their software systems sit on open networks. He said the concern applies to a broad range of connected vehicles and devices, rather than being limited to Chinese buses.

Movia plans to strengthen cybersecurity requirements in new tenders and is evaluating safeguards for buses already in service. This creates two tasks: setting firmer conditions for future purchases and checking how existing vehicles can be protected.

Political voices and civil society groups want national standards that treat public transport as critical infrastructure. They argue that heavy dependence on foreign vendors weakens resilience during a crisis. Lawmakers are exploring uniform tender criteria, supplier risk screening, data residency rules and restrictions on unmanaged remote access.

Any changes would need to comply with Danish and European Union procurement law while giving operators practical ways to maintain service. The measures remain under consideration, and no implementation date has been given.

Yutong's explanation of access and data storage

Yutong says remote control of functions essential to driving safety is not possible on its buses. According to the company, the main control unit is separated from the systems responsible for steering, propulsion and braking.

The manufacturer says the data connection supports diagnostics, performance monitoring and comfort functions, including cabin preconditioning. Preconditioning means preparing the cabin's temperature before passengers board. Yutong also says software updates require explicit approval from the operator.

For data within the European Union, Yutong says storage takes place at an Amazon Web Services facility in Frankfurt. The company says encryption and strict access controls protect that data. Encryption makes information unreadable without the appropriate key, while access controls determine who is allowed to use it.

Yutong's position places the focus on how separate systems are connected and what remote accounts are allowed to do. Operators are seeking controls they can verify, including clear authority over updates and the ability to stop external connections immediately if they suspect misuse.

How a maintenance connection can become a disruption risk

Modern buses use a telematics unit connected to cellular networks. This unit communicates with a cloud platform, sending vehicle status information and receiving software packages or configuration changes. It gives maintenance teams a way to check equipment without being physically beside the bus.

Inside the vehicle, a controller area network links systems such as propulsion, batteries, doors, heating and driver displays. This network carries messages between components. Good design places the control loops essential to safety on separate lines with strong isolation from other systems.

Interfaces still exist between networks so that support teams can diagnose faults and install fixes. Those interfaces can attract attackers when identity checks or access rules are weak. Security therefore depends on both the separation of vehicle systems and the permissions assigned to people connecting remotely.

The central concern is a command that disables propulsion or power, or a software update that damages the operation of a component and leaves the bus unable to move. Either could cause serious service disruption without someone taking over steering or braking.

Agencies want proof that remote channels are disabled by default, that access is restricted according to each user's role, and that operators can immediately shut off external connections when misuse is suspected. A shared supplier account or common configuration across many buses makes those controls especially relevant to the continuity of an entire service.

Which vehicle functions need protection?

Security teams are examining pathways that could affect power, charging and supporting equipment. Their work covers both the systems that move a bus and the smaller electrical systems that allow its controllers and sensors to operate.

• Traction power enable settings and the conditions that allow an inverter to start. The inverter controls electrical power supplied to the motor.
• Battery management settings, including limits on charging and discharging.
• Charging control logic and charging schedules.
• Low voltage power distribution supplying control units and sensors.
• Cabin equipment, including heating, ventilation and lighting.

The aim is to strengthen protection around these pathways while retaining the information needed for safe and efficient operation. Remote diagnostics and updates to functions outside essential driving systems can remain useful, provided robust controls prevent a remote action from immobilizing a vehicle without local approval.

Power management deserves particular attention because it determines whether the bus has usable energy for propulsion and supporting equipment. Drivers may still have control of steering and brakes while a disruption elsewhere prevents the vehicle from continuing its route.

What stronger security requirements could include

Transport companies, regulators and suppliers are developing safeguards for connected fleets. Contracts, certification and technical controls will need to work together so that operators have the final say over what enters a bus network and when.

The proposed measures cover access, software changes, network design and supplier accountability:

• Local control of connectivity, including the ability to disable vendor access immediately.
• Review and signing of firmware and configuration changes before installation. Firmware is software built into a device to control how it operates.
• Strict separation between diagnostic networks and networks serving functions essential to safety.
• Access permissions based on each user's role and authentication using more than one identity check for every remote session.
• Logs of remote connections that cannot be altered, supported by independent audits.
• Clear rules on where data are stored and the encryption standards used to protect them.
• Supplier screening during tenders, covering secure development practices and the ability to respond to incidents.
• Independent penetration tests and certification of connected vehicle platforms. Penetration tests check security by attempting to find and exploit weaknesses.

These measures are intended to preserve telemetry and remote support while closing unmanaged routes into the drive system. They also give operators a way to check what access suppliers have, authorize changes and investigate activity when something goes wrong.

What passengers and cities can expect

Passengers should expect no immediate changes to services. The buses are driven by humans, and Yutong says they cannot be operated from outside the vehicle. Operators also say cameras in the buses are not connected to the internet, so there is no risk of live image transfer through those cameras.

Passengers could notice less reliable live arrival information if an operator removes SIM cards to isolate its buses. Fleet dashboards and remote diagnostics would also lose information, making it harder for maintenance teams to spot faults early and respond efficiently.

Cities face a practical trade off between the convenience of remote maintenance and tighter local control. Disconnecting a vehicle can reduce exposure, but it can also hurt reliability and increase costs. Operators therefore prefer several layers of protection that keep service information flowing while preventing unauthorized commands.

Strong governance, transparency and technical controls that can be verified are central to that approach. Denmark's review is focused on keeping the advantages of connected electric buses while ensuring that outside access cannot disrupt the equipment needed to run them.

Key Points

• Denmark is reviewing bus security after Ruter's isolated tests on two Yutong buses identified a potential route for remote disruption.
• No remote shutdowns have been recorded in Norway or Denmark, and Ruter describes the findings as a theoretical risk.
• Movia operates 469 Chinese built electric buses across Zealand, including 262 Yutong vehicles.
• Removing SIM cards blocks outside contact but also disables useful arrival information, diagnostics and maintenance tools.
• Yutong denies remote control of steering, propulsion and braking, says updates require operator approval, and says EU data are stored in Frankfurt.
• Operators are examining power and battery management access, supplier permissions and the possibility of disruption across multiple buses.
• Proposed safeguards include local control of connections, approved updates, separated networks, stronger authentication and independent security checks.
• Movia plans stricter requirements for future tenders while evaluating protections for its current fleet.