'Kill switch' in Chinese-made buses used across Australia sparks urgent warning from cybersecurity boss
- Expert warns of the dangers of Chinese-built EVs
- READ MORE: Shock Chinese discovery in Australia: 'How could this happen'
A Chinese electric bus brand operating across Australia has been revealed to contain a 'kill switch' that can be remotely activated by the manufacturer.
Britain's National Cyber Security Centre, along with the Department of Transport, revealed that Yutong-branded electric buses could be remotely shut down from China, according to a report in The Telegraph.
The feature has sparked fears that Chinese security services could intervene via the SIM cards used for software updates, the agency found.
While there's no evidence a 'kill switch' has been used in Australia, authorities in Denmark and Norway remain wary of the issue.
Norwegian transport operator Ruter found in November that Yutong Group had access to the buses' control systems for software updates and diagnostics.
'In theory, this could be exploited to affect the bus,' the operator said.
Yutong said it had sent more than 1,500 vehicles to Australia since 2012.
The ACT ordered 90 of the battery-electric buses in 2023, while NSW is operating 26 and Queensland four. South Australia is currently undergoing a trial.
CyberCX chief strategy officer Alastair MacGibbon maintains there are security risks that come with Chinese-made electric vehicles in Australia
There are fears that Yutong-branded electric buses could be turned off from China
Chief strategy officer at cybersecurity company, CyberCX, Alastair MacGibbon, told the Australian Financial Review the Chinese-made buses came with security risks.
'Other countries have stopped their governments from purchasing them and not allowing private use of these things. The Australian government has not,' he said.
A spokesperson for the distributor of Yutong buses in Australia, Vehicle Dealers International, told Daily Mail the model tested in Norway was not operating here.
'Vehicles are prepared and supported to Australian requirements, with customer‑authorised access and documented change control,' they said.
'Operational changes are carried out in person with operator authorisation.
'We follow agreed processes with each operator and, where required, with the relevant authority. There is no remote control of acceleration, steering or braking.
'Any changes that affect vehicle operation are completed in person with operator authorisation. This is not a software update.'
But Mr MacGibbon pointed out that internet-connected vehicles had cameras, microphones and other tools that could still be accessed by the manufacturer, adding 'confidentiality in a Chinese-made vehicle does not exist'.
There are hundreds of Yutong-branded electric buses on Aussie roads
A spokesman for Transport for NSW said there was no evidence that buses in the NSW fleet could be remotely disabled.
'These reports have been incorporated into our active risk assessments, and Transport continues to work with manufacturers in seeking further information to assess any potential risks,' the spokesman told the AFR.
Transport Canberra said over-the-air updates have been disabled on the current fleet and that software updates are performed exclusively by Transport Canberra.
In response to the claims, Yutong released a statement saying: 'Yutong vehicle terminal data in Australia is stored at the AWS data centre in Sydney.
'This data is used for vehicle-related maintenance and optimisation to meet customers' after-sales service requirements.'
'All data is protected through storage encryption and access controls. No one is allowed to unlawfully access or view the data without customer authorisation.'
A Transport for NSW Spokesperson told Daily Mail: 'Transport is aware of recent international reports regarding potential vulnerabilities in some bus technologies. These reports have been incorporated into our active risk assessments, and Transport continues to work with manufacturers in seeking further information to assess any potential risks.'
Daily Mail has contacted the Defence Department and Mr MacGibbon for further comment.
