Norway Found A Real Bus Cyber Risk. It Didn’t Show It Was Chinese.

This is about public transit buses, not home upgrades, but it touches on a broader question of connected-device security worth knowing about. Norway's transit authority tested a Chinese-made electric bus for cybersecurity risks and found something real: the manufacturer had a remote-access path into important vehicle systems through the internet, which with enough access could potentially interfere with how the bus runs. But the test also checked whether the bus could be used for visual spying near a sensitive government site, and that concern was not supported.

The catch is in how the test was set up. Investigators compared the modern, highly connected Chinese bus to an older European bus that barely connected to the internet at all and couldn't receive remote software updates. That mismatch meant the test could show a connected bus was reachable remotely, but it couldn't tell whether that risk had anything to do with the bus being Chinese, since newer European buses from other manufacturers also have similar remote-access features. A separate assessment in Denmark, comparing cybersecurity practices across Chinese and European bus makers, found no evidence Chinese manufacturers were less secure than the others.

The broader point: many modern vehicles and connected devices, regardless of where they're made, can be reached remotely by their manufacturers. The real question is who can access those systems, what they can change, and how quickly that access can be cut off if needed.