more

The ‘Kill Switch’ Controversy: Are Our Electric Buses a Security Risk?

Recent investigations in Europe have raised unsettling questions about the security of Yutong electric buses, the world’s largest manufacturer, and their potential vulnerability to remote control – even disabling – by external actors. While authorities in New Zealand remain publicly unconcerned, the implications for critical infrastructure and national security are prompting a closer look at the risks associated with relying on foreign-made technology.

From Norway to New Zealand: A Global Scrutiny

The initial alarm was raised in Norway last year, where an investigation revealed a theoretical “kill switch” capability within Yutong buses. This discovery triggered urgent reviews in Denmark and the UK, with the UK’s National Cyber Security Centre confirming the technical possibility of remote disablement, though no actual incidents have been reported. Now, the concerns have reached New Zealand, with investigations launched in Wellington and ongoing monitoring in Auckland and Christchurch.

New Zealand currently operates approximately 150 Yutong buses across its major cities. While local transport authorities express confidence in the safety of their fleets, the international scrutiny highlights a growing awareness of the potential security vulnerabilities inherent in interconnected, digitally-controlled infrastructure.

The Connectivity Conundrum: Convenience vs. Control

Yutong buses are equipped with onboard telematics systems, like ‘Yutong Vehicle Plus’, utilizing SIM cards to remotely retrieve data and perform functions like software updates and even control features like air conditioning. This connectivity, while enhancing operational efficiency, also creates potential entry points for malicious actors. Metlink in Wellington acknowledges this, stating Yutong has access to certain functions, but insists complete control – the ability to shut down a bus – remains with the operator.

However, the debate centers on the extent of that control and the potential for unauthorized access. The question isn’t simply *can* a bus be remotely disabled, but *who* has the capability, and under what circumstances? This is particularly pertinent given Yutong’s ties to the Chinese Communist Party, which has received tens of millions in subsidies to the company.

Beyond Buses: The Broader Threat to Critical Infrastructure

This isn’t an isolated incident. Globally, there’s a growing recognition of the risks posed by foreign interference in critical infrastructure. New Zealand’s own Security Intelligence Service (NZSIS) recently highlighted China as the most active force attempting to gain access to sensitive information and control over key assets. The Yutong bus situation serves as a microcosm of this larger threat.

Consider the implications for other connected systems: power grids, water treatment facilities, and transportation networks. The increasing reliance on digital technology, coupled with geopolitical tensions, creates a complex security landscape. A 2023 report by the World Economic Forum identified cybersecurity failures as one of the most likely global risks in the next two years, with potentially devastating consequences.

What’s Being Done – and What More Needs to Happen?

Currently, New Zealand’s Government Communications Security Bureau (GCSB) hasn’t launched a specific investigation into the Yutong buses. However, the situation is prompting a re-evaluation of security protocols and supply chain risk management. Experts suggest several key steps:

• Enhanced Cybersecurity Audits: Regular, independent audits of all connected systems within public transport fleets.
• Supply Chain Due Diligence: Thorough vetting of suppliers and manufacturers, including assessing their geopolitical affiliations.
• Independent Verification: Third-party verification of security claims made by manufacturers.
• Redundancy and Fail-Safes: Implementing redundant systems and fail-safe mechanisms to ensure continued operation even in the event of a cyberattack.

Environment Canterbury, operating older Yutong models with limited connectivity, offers a potential mitigation strategy: prioritizing less-connected technology where feasible. However, this approach may compromise the benefits of real-time data and remote diagnostics.

Pro Tip:

When evaluating technology for critical infrastructure, prioritize security by design. This means incorporating security considerations from the very beginning of the development process, rather than attempting to bolt them on as an afterthought.

FAQ: Yutong Buses and Security Concerns

• Can Yutong buses be remotely shut down? Technically possible, according to the UK’s National Cyber Security Centre, but no evidence of this happening exists.
• Are New Zealand buses at risk? Authorities currently state there is no reason for concern, but ongoing monitoring is in place.
• What is being done to address the concerns? Investigations are underway, and authorities are reviewing security protocols.
• What is Yutong’s response? The company denies the ability to remotely control its buses and attributes the concerns to misinformation.

Did you know? The global electric bus market is projected to reach $87.8 billion by 2032, according to a report by Allied Market Research, highlighting the increasing reliance on this technology and the growing importance of addressing security concerns.

Further investigation and transparency are crucial to ensure the safety and security of New Zealand’s public transport system. The Yutong bus controversy serves as a stark reminder that convenience and efficiency must be balanced with robust cybersecurity measures and a critical assessment of supply chain risks.

What are your thoughts on the security of connected infrastructure? Share your opinions in the comments below!

Explore more articles on cybersecurity and national security here.

Subscribe to our newsletter for the latest updates on critical infrastructure security.