Chinese cars a potential Trojan horse for Norway

Chinese-made cars filmed sensitive information during a Norwegian military exercise, including access codes at secure sites and officials’ comings and goings, raising concerns about the risks posed by connected vehicles.

During a security exercise at Oslo airport on Sept. 14 to 18, waiting soldiers tapping on their vehicle’s screen discovered videos recorded by the onboard cameras, the Dagens Naeringsliv (DN) newspaper revealed.

The recordings showed who was getting in and out of the cars, the routes taken and even the codes used to open gates or doors to military facilities.

Premium car models from Chinese automaker Changan’s all-electric Avatr brand are displayed at a dealership in Chongqing, China, on April 20.

Photo: Reuters

In its report three weeks after the exercise, DN said the recordings came from rental vehicles — at least two of them Deepal-brand cars, made by Chinese state-controlled automaker Changan. They were supplied to the army by Hertz Norge, which is indirectly owned by the Chinese auto group Geely.

“Yes, soldiers from the Home Guard found videos from the vehicles’ sensors stored in their systems,” Lieutenant Colonel Per Gunnar Grosberghaugen, Norwegian Home Guard spokesperson, said.

It was not known if the recordings were shared with a third party, notably in China, but the officer could not rule out the possibility.

The case highlights a paradox: While Europe’s armies are bolstering their protection against espionage and hybrid threats, the vehicles they use can collect sensitive information. Even after discovering the leaks, the military continued to use the vehicles until the end of the exercise due to a lack of alternatives and the soldiers deleted the videos, DN reported. Judging that the impact of a general ban on Chinese-made vehicles would be disproportionate to the potential security gain, the military said it preferred security procedures tailored to each site, with possible local bans on vehicles equipped with cameras and sensors regardless of their origin. Hertz Norge stressed that it complies with Norwegian and European regulations.

“Our customers’ data is safe with us,” Hertz Norge marketing and communications director Hallvard Nerbovik said. “No personal data related to our rentals is shared with car manufacturers, our owners or other third parties without explicit legal grounds,” he added, without specifying whether the onboard videos might have been transferred.

Changan group did not respond to AFP’s questions.

Last year, tests carried out for Oslo’s Ruter public transport authority revealed that Chinese manufacturer Yutong could theoretically remotely immobilize its electric buses with their “over-the-air” update system.

Norway could use the buses one day to evacuate the population in the event of an emergency.

Ruter has since introduced mechanisms enabling it to monitor and delay incoming signals in order to control updates, it said.

Modern vehicles are not the only potential Trojan horses. Smartwatches and fitness apps such as Strava, popular with joggers, can also expose sensitive military information.

In 2018, data published by Strava made it possible to identify military sites and soldiers’ routes, notably in Afghanistan and Syria. In March, French newspaper Le Monde was able to locate the French aircraft carrier Charles de Gaulle in almost real time in the eastern Mediterranean, thanks to a sailor on board using the app. The Norwegian National Security Authority (NSM) said modern vehicles are “rolling computers that collect information.”

“We don’t know for sure where the information is sent or what it’s used for,” NSM official Andreas Skjold-Lorange said.

The organization, which is responsible for minimizing strategic risks, including digital, said that beyond the data collected, Norway should be wary of excessive dependence on a single country.

Especially if that country does not cooperate with Norway on security matters.

“If we become too dependent on services or products from a given country, that makes us vulnerable, whatever that country may be,” Skjold-Lorange said.