UK investigates if China can remotely disable hundreds of its electric buses amid rising cybersecurity fears

Cybersecurity

The United Kingdom has launched a formal investigation to determine whether hundreds of Chinese-made electric buses operating across the country could be remotely disabled by their manufacturer, Yutong. The probe follows similar investigations by Denmark and the Netherlands, both of which raised concerns that Chinese-built public transport systems might be vulnerable to external control.

According to a Financial Times report, the UK Department for Transport (DfT) and the National Cyber Security Centre (NCSC) are jointly examining whether Yutong retains the ability to access and potentially deactivate its buses in the UK through software updates or diagnostic systems. Yutong, based in Zhengzhou, is the world’s largest bus manufacturer and has supplied roughly 700 electric buses to the UK. The company is also seeking to enter London’s market with a new double-decker electric model designed for Transport for London (TfL).

The move comes after Norwegian transport operator Ruter revealed that Yutong buses in its fleet could be “stopped or rendered inoperable” remotely, due to retained access to their power and battery management systems. Similar findings prompted Denmark to begin its own review, although Danish officials noted that the risk could technically be mitigated by removing onboard SIM cards, a step they avoided because it would also disrupt necessary communication systems.

A DfT spokesperson confirmed the UK investigation, stating: “We are looking into the case and working closely with the National Cyber Security Centre to understand the technical basis for the actions taken by the Norwegian and Danish authorities.” TfL clarified that none of its operators currently use Yutong buses and that any vehicle entering service in London must meet “robust technical requirements” and pass “rigorous testing.”

Yutong, for its part, has denied any wrongdoing. In a statement to The Sunday Times, the company said it “strictly complies with all applicable laws, regulations and industry standards” in every market it operates. It added that data collection is limited to “vehicle-related maintenance, optimisation and improvement,” and that all access is encrypted and customer-controlled. “No one is allowed to access or view this data without customer authorisation,” the company stated, emphasising its compliance with EU data protection laws.

While Danish operator Movia noted that remote access is not exclusive to Chinese manufacturers — with most modern EVs supporting software updates over the air — the political climate surrounding Chinese technology in Western infrastructure has intensified. In the UK, some lawmakers have openly debated whether Beijing should be officially categorised as an “enemy” or a “threat,” reflecting growing unease over cybersecurity and critical system dependence on Chinese suppliers.