When Naive Environmentalism Becomes a Strategic Vulnerability

Norway has just made an explosive discovery: 850 electric buses running in Oslo can be stopped remotely by their Chinese manufacturer, Yutong. A bit of software access, a built-in SIM module, and a foreign player can, in theory, shut down an entire public transit fleet in a European capital.

Is this serious? Yes.

But it is no surprise. It is the direct consequence of a system that wants energy sovereignty without industrial sovereignty. Of a European model that demands flawless emissions standards while forcing its states to source from those who respect nothing but their own interests.

What exactly do Ruter's tests reveal?

The alert did not come from a hacker or a think tank, but from the operator itself. Ruter, the public transport authority for Oslo and its region, had two buses tested in an isolated environment high in the mountains: a brand-new Yutong and a three-year-old European VDL, for comparison.

The result is unambiguous. The Chinese bus carries a fully autonomous over-the-air software update system, known as OTA, which gives the manufacturer direct digital access to every vehicle. Above all, the experts found access to the battery and power management system, over the mobile network, through a hidden Romanian SIM card. Ruter's conclusion, word for word: "in theory, this bus can be stopped or made unusable by the manufacturer". The VDL used for comparison did not show the same level of remote access.

Ruter has said what comes next: tougher security requirements in upcoming tenders, firewalls to keep control locally, cooperation with national and local authorities.

Yutong denies it. The world's leading bus manufacturer says it complies with "the laws, regulations and standards of the countries where its vehicles operate", states that data stored in the Union serves "only maintenance and the improvement of after-sales service", and that remote control of critical systems is impossible. The fact remains that the technical capability was indeed observed in the lab. The debate is not about stated intent, but about the fact that a foreign third party holds the key.

Is the whole of Europe exposed?

Oslo is not an exception. Of the roughly 1,300 electric buses Norway operates, around 850 carry the Yutong badge, and the country is simply the first to have looked under the hood.

In Denmark, the main operator Movia runs 469 Chinese electric buses, 262 of them Yutong. The Danish civil protection agency has opened an investigation; it has found no remote shutdown to date, but acknowledges that connected systems with internet access and sensors "may constitute exploitable vulnerabilities". In the United Kingdom, around 700 Yutong buses are already on the road, notably in Nottingham, in South Wales and in Glasgow. The Department for Transport and the NCSC, the cyber arm of GCHQ, have been notified. The British importer disputes the claims and insists that updates are applied "by hand by engineers".

The underlying problem is an industrial balance of power. In 2025, the European electric bus market jumped 48 %, to 11,607 registrations. Yutong leads with 15.5 % market share, BYD follows at 11.2 % after tripling its volumes. Between them, these two Chinese manufacturers now account for more than a quarter of new electric buses sold in Europe. This is not an isolated incident in Oslo. It is a continental transport infrastructure tipping, city after city, into a single dependency.

The green dream that manufactures dependency

Since January 2025, Norway has required that all new city buses be emission-free; the obligation has applied to local buses since 2024, and the electric share of new city buses already reached 72 % at the end of 2024.

On paper, it's magnificent. In practice, it translates into massive imports of Chinese equipment. Why? Because in Europe, we have abandoned industrial ambition, the supply chains are broken, and the few remaining manufacturers cannot compete on volume or price.

The result? We offshore production.

And, out of naivety or cynicism, we let onto our roads technical systems that can be steered remotely by an authoritarian regime. The question is no longer whether a hacker can immobilise a bus: it is why a foreign government had that capability in the first place.

Going all-digital is a prison

We can debate for hours about firewalls, audits, the SIM cards we'll pull out by hand. But the heart of the problem is elsewhere: it's the obsession with connecting everything, with everything modern, everything digital. Every "smart feature" we add is a new door opened to interference, a new dependency we accept. And this time, it isn't a bug. It's a policy.

Because this kind of remote access is not an accidental flaw. It is an architectural choice, deliberate, documented, planned. And if it is there, it is because Europe wants modern buses but no longer wants to design them itself. It wants green technologies, but no longer wants to have to produce the batteries, the chips or the control units.

Don't want to depend on a foreign power anymore?

Then become self-reliant again. A country that cannot build its own vehicles, its own networks, its own tools, is not a sovereign country. It can sign every treaty in the world, congratulate itself on its standards and pile up conferences on "cybersecurity": it stays vulnerable the moment an outside player decides to make it pay for its naivety.

The only durable solution is not a software patch. It is not an expert committee. It is reshoring. Mastery. Reconquest. Because you cannot legislate on a bus's carbon emissions while refusing to take charge of the means to produce it. And above all, you cannot, in the name of the ecological transition, hand yourself over to powers that turn technology exports into a strategic weapon.

Either we want digital and sustainable infrastructure that is under our control, and we have to rebuild supply chains. Or we keep making laws in committee rooms without producing a single bolt, and there will be no point crying the day Beijing unplugs Oslo. This is not cybersecurity. It is security plain and simple. And at this game, Yutong's engineers are more consistent than our ministers.

Rethinking public procurement, reviving strategic industry

If Europe wants to break this dependency, it must fundamentally reform the way it thinks about and buys technology. Today, public procurement favours cost and short-term compliance with environmental standards.

The result: we sacrifice strategic autonomy on the altar of "lowest-bidder" tenders. The specifications have to change.

Factor in sovereignty, resilience, component traceability. Reward European offers, even if they are 15 % more expensive. Because that difference is not an overcost: it is the price of our freedom.

Others have already made their choice. Since a rule that took effect on 17 March 2025, the United States bans connected vehicle software and hardware designed in China or Russia: software from model year 2027, hardware from 2030. Meanwhile, Europe is debating labels.

And you do not rebuild a sovereign industry by stacking up labels, but by investing, training and owning our choices. Producing a 100 % European, emission-free bus is possible, and it may even already be the case.

We just have to demand it. Responsible digital starts with political responsibility. And for now, that responsibility is nowhere to be found.

---

Sources

• Ruter, extensive security testing of electric buses (official statement)
• Euronews, Chinese-made buses can be halted remotely in Norway, 6 November 2025
• NBC News, Denmark and Norway investigate the Chinese Yutong bus security loophole
• Sustainable Bus, Denmark (Movia) investigates connected buses
• Sustainable Bus, Yutong's cybersecurity reply to Ruter
• The Register, UK probes the remote shutdown claim on Chinese buses, 11 November 2025
• Sustainable Bus, European electric bus market 2025 (11,607 units, Yutong and BYD)
• European Alternative Fuels Observatory (European Commission), Norway: zero-emission city bus purchase obligation
• Gibson Dunn, the US connected vehicles rule effective as of 17 March 2025