It’s one thing to have to deal with the Gummint snooping on your every move — literal, and figurative (i.e. your online activities) — but it’s another thing to having GlobalMegaCorp sniffing into your business as well.
Ruter, the [Norwegian] transit authority that runs public buses across Oslo and Akershus, parked two electric buses inside an isolated facility built into a mountain, the kind of shielded space normally used to keep radio signals from leaking in or out, and let its own security engineers take them apart. One bus came from Yutong, the Chinese manufacturer that has quietly become one of Europe’s largest electric bus suppliers. The other was a three-year-old unit from VDL, a Dutch manufacturer. Ruter chose that pairing deliberately: the two buses sit at opposite ends of how connected a modern transit vehicle can be.
And the findings?
Ruter’s own published findings are blunt about the VDL [Dutch] bus: it has no capability for over-the-air software updates at all. Every change to its systems requires a technician to physically connect a cable. That makes it a hassle to service. It also makes it nearly impossible to hijack remotely, which is exactly why Ruter’s engineers moved past it quickly.
The Yutong [Chinese] bus is the opposite. It receives software and diagnostic updates automatically, the same way a phone downloads a firmware patch overnight, except this particular phone weighs roughly 30,000 pounds and carries dozens of passengers through Oslo traffic. That connection routes through a Romanian SIM card, which gives Yutong direct digital access to the bus’s battery and power management systems. Ruter’s engineers concluded that, in theory, this access could be used to stop the bus or render it inoperable, not through some elaborate hack, but simply because the manufacturer already has a standing door into those systems for legitimate diagnostic and update purposes.
Wile all this is alarming, it’s not really surprising. We’ve known for ages that the godless ChiCommies have their dirty little ears glued to just about every damn piece of electronic equipment our friends (!) in Silicon Valley have outsourced to their manufacture.
So now we get to the part that makes me start fixing a lunch bucket, scoping out high buildings and cleaning the Mauser.
None of what Ruter found is exotic. It’s the standard architecture of any modern connected vehicle, and American drivers have been living with a version of it for nearly two decades. General Motors’ OnStar system can, at the company’s discretion, send a cellular command to a stolen vehicle that blocks the ignition from restarting once it’s parked, or gradually slows a moving vehicle so police can recover it safely. That is functionally the same category of access Ruter found in the Yutong bus: a persistent, manufacturer-controlled cellular link with authority over propulsion-adjacent systems, built into the vehicle before it ever reaches a customer’s driveway.
So Big Auto are a bunch of snooping smegma-eaters. We know that, too.
The distinction that actually matters here isn’t whether a manufacturer can reach into a vehicle remotely. Almost every connected car sold today allows that, by design, for updates, diagnostics, and theft recovery. What matters is who holds the authority to use that access, under what legal process, and how many vehicles go dark at once if that access is ever misused, subpoenaed, or compromised.
A single stolen sedan getting slowed to a stop by its own manufacturer is a feature working as intended. An entire transit authority’s bus fleet answering to a remote command from a foreign supplier’s server is a different order of risk entirely, which is exactly why Ruter escalated this to Norway’s national government instead of treating it as an IT ticket.
Now comes the part that has me checking Ye Olde Ammoe Locquer for 8x57mm:
Chinese abuse of this little backdoor activity [sic] is bad, but in the bigger picture, it can be addressed with a carefully-aimed chunk or two of explosive material on the Three Gorges Dam.
What worries me more is that this little pipeline into our cars can also be — and is — at the beck and call of the auto manufacturers, who are only too ready to “share” that data with, say, the insurance industry (hello, fresh revenue stream), and if pressed just a little, with our own Gummint ghouls who infest the alphabet agencies (DHS, NSA, FBI, just to name the three biggest dicks aimed at out collective rectums).
I need to get to the range. So if you’ll excuse me…