UK and Europe Investigate Yutong Buses Over Remote Kill Switch

Security testing in Oslo, Norway, revealed that electric buses manufactured by Zhengzhou Yutong Bus Co., Ltd. contain a kill switch allowing the vehicles to be accessed and shut down remotely from China. In response, Norway's public transport authority, Ruter, removed SIM cards from its fleet to block external interference, though this action prevents necessary software updates. The discovery prompted Denmark's largest public transport provider, Movia, to investigate its fleet of 262 buses, while similar reviews were launched in the Netherlands.

The issue has extended to the United Kingdom, where more than 2,500 Yutong buses are operated by companies such as First Bus, Stagecoach, and FlixBus. The United Kingdom Department for Transport and the National Cyber Security Centre have launched a formal investigation to determine if the manufacturer can remotely disable vehicles via software updates or diagnostic systems. While Transport for London confirmed it does not use Yutong buses, officials are concerned that the flaw exposes critical infrastructure to the Chinese government.

Zhengzhou Yutong Bus Co., Ltd. denies that unauthorized access is possible, stating that European models do not support remote control of acceleration, steering, or braking. The company maintains that its data collection is limited to maintenance and optimization and strictly complies with industry standards. However, Danish officials and the civil protection agency Samsik warned that microphones and sensors in the vehicles pose additional security risks.