When Norwegian transit authority Ruter put a Chinese Yutong electric bus through cybersecurity testing inside an isolated mine, the investigation began with two very different concerns. One was geopolitical: whether the bus could act as a visual-surveillance platform near sensitive sites. The other was technical: whether the vehicle's systems had real security flaws.
The testing ultimately found a genuine cyber risk in the bus, according to CleanTechnica. However, the findings did not show that the risk was Chinese in origin, nor did they support the idea that the bus was being used for surveillance. In short, a real vulnerability existed, but the evidence did not match the geopolitical suspicion.
The episode highlights the importance of separating evidence from assumptions when assessing critical infrastructure. A real flaw deserves attention and remediation, but attributing it to a specific nation-state requires more than a bus's country of origin. For transit agencies adopting electric buses, the lesson is to run thorough, context-specific security reviews rather than relying on origin-based judgments.