Potential Yutong bus investigation

[Omnidekkalover]

UK transport and cyber-security chiefs investigate Chinese-made buses

Move to assess potential risk of remote meddling by Beijing with Yutong buses follows investigations in Norway and Denmark

www.theguardian.com

The UK is to investigate whether hundreds of Chinese-made buses can be controlled remotely by their manufacturer, amid increasing concerns over Beijing’s involvement in British infrastructure.

The Department for Transport and the National Cyber Security Centre are examining whether buses made by Yutong could be vulnerable to interference.


A spokesperson for the Department for Transport said: “We are looking into the case and working closely with the UK’s National Cyber Security Centre to understand the technical basis for the actions taken by the Norwegian and Danish authorities.

“The department takes security issues extremely seriously and works closely with the intelligence community to understand and mitigate potential risks.”

Thought this might be worth bringing up as I do feel this could have implications for cities such as Nottingham and Newport which have a decent number of Yutongs.

 

[Stan Drews]

I suspect almost every new vehicle going on to the roads in the UK (and the vast majority of other countries) could be ‘controlled’ in this way. The ability to alter vehicle settings remotely by ‘dialling in’ is certainly nothing new.

 

[callum3490]

It will be interesting to see a response of some operating a larger fleet as researching there are some comments online such as from Mcgills stating that their fleet isn’t capable of remote over the air updates

NCTs fleet got bogged down a few months back by a failed “over the air” update suggesting some do have this capability and therefore these concerns may apply

Ultimately up to the operator to disable this and manually do updates vehicle by vehicle presumably

 

[Harpers Tate]

Indeed. I have thought for years that all (or virtually all) hacks, whatever the system - are facilitated by our seeming desperation to connect everything to the internet. Keep your "thing" (bus, database, whatever) as a standalone "thing" and the only way it can be affected is in person.

 

[Alpine Rider]

Totally agree with earlier posts - this is borderline clickbait.

As over the air update systems become cheaper and more reliable, most vehicle manufacturers have adopted them. The issue here is whether they have been intentionally designed to provide a master "OFF" switch - and if so have customers been given the option to omit that feature.

The technology has its trade-offs. Several very high spec USA made tractors were "relocated" to farms in Russia during the Special Miliatary Operation. These were leased vehicles and were remotely disabled by the manufacturer - leaving them useless.

 

[edwin_m]

I'd have thought disabling a chunk of our bus network was pretty low on the list of potential security threats.

 

[scosutsut]

Like anything new and evolving, the risk is not understanding and looking after your new technology. Take a brand new Windows laptop. You could boot it up and start using it straight away, but those more savvy and knowledgeable will customise it, remove bloatware and deactivate features they don't want.

If these electric vehicles have been foisted onto previously ICE-only workshops without the necessary training and upskilling, then your going to have situations like this.

I think it's wise to look at it, but rather than blame China (our second favourite national boogeyman) we should blame our own lack of knowledge and preparedness - and address that.

 

[Dai Corner]

Like anything new and evolving, the risk is not understanding and looking after your new technology. Take a brand new Windows laptop. You could boot it up and start using it straight away, but those more savvy and knowledgeable will customise it, remove bloatware and deactivate features they don't want.

If these electric vehicles have been foisted onto previously ICE-only workshops without the necessary training and upskilling, then your going to have situations like this.

I think it's wise to look at it, but rather than blame China (our second favourite national boogeyman) we should blame our own lack of knowledge and preparedness - and address that.

Exactly. An industry where LED 'blinds' and contactless payments, let alone enabling controllers and passengers see where the buses are were considered high tech until very recently is ill equipped to understand or utilise the technology becoming available. Lack of understanding brings fear.

How many operating companies have an IT Director or Manager?

 

[overthewater]

To be fair this tech has been around for years, Does anyone remember those yellow hybrid buses Stagecoach Newcastle had? They were down by Quayside? There are stories of the buses being plugged into the internet and the buses starting up remotely from the computer programmers.

 

[Tetchytyke]

I suspect almost every new vehicle going on to the roads in the UK (and the vast majority of other countries) could be ‘controlled’ in this way.

The Norwegians found that Yutongs can be remotely controlled but VDL buses can’t.

China electric buses: Denmark, Norway investigate security loophole

Bus providers in Denmark and Norway are urgently investigating what they say is a security loophole in electric buses made in China.

www.nbcnews.com

Ruter performed underground tests “inside a mountain” on two buses: the Yutong model and one from the Dutch manufacturer VDL.

While the Dutch buses “do not have the capability for autonomous software updates over the air,” Yutong “has direct digital access to each individual bus for software updates and diagnostics,” it said.

In theory, “this bus can be stopped or rendered inoperable by the manufacturer,” it said, although Yutong wouldn’t be able to remotely drive these vehicles.

 

[37114]

ADL have also released this on their website about their compliance, I can't help but thinking the timing is deliberate

Alexander Dennis vehicle cybersecurity and software update management systems confirmed under UNECE standards in VCA audits | Alexander Dennis

Alexander Dennis, a subsidiary of NFI Group Inc., a leader in propulsion-agnostic bus and coach mobility solutions, today announced that its Cyber Security Management System (CSMS) has been re-certified and its Software Update Management System (SUMS) certified by the United Kingdom’s Vehicle...

www.alexander-dennis.com

Alexander Dennis’s commitment to the highest standards of cybersecurity encouraged the company to introduce comprehensive business-wide systems in support of the development of its next-generation electric buses, ensuring that their design, production and ongoing support is underpinned by robust protections.

UNECE Regulation 155 provides internationally recognised requirements for vehicle cybersecurity and vehicle cybersecurity management systems. The successful re-certification of Alexander Dennis’s CSMS follows an audit by VCA experts that analysed the manufacturer’s documents, tools, templates and processes against the requirements of the regulation alongside interviews with key members of staff involved in the operation of the processes.

 

[christopher]

I've been road testing a ADL BYD with an engineer plugged into it with a laptop who is streaming it to an engineer in China who could see in real time how much throttle I was applying and other readings.

Yutongs can be updated remotely but don't believe anything else can be

 

[Busmansholiday]

Yutong and Pelican respond to electric vehicle cybersecurity reports

Yutong and dealer Pelican Bus and Coach have responded to cybersecurity-based claims that electric vehicles could be controlled remotely.

www.route-one.net

Yutong and Pelican respond to electric vehicle cybersecurity reports​

UK market software updates controlled by Pelican and only possible via in-person vehicle visit​

Yutong and UK dealer Pelican Bus and Coach have responded to mainstream media claims on cybersecurity alleging that the marque’s battery-electric coaches and buses could be disabled or controlled remotely by the builder.
The manufacturer says that it understands concerns about vehicle safety and data privacy protection. Data generated in Europe is stored in Germany for use in maintenance, optimisation and improvement purposes to meet customers’ aftersales service needs.
“The data is protected by storage encryption and access control measures,” Yutong adds. “Nobody is allowed to unlawfully access or view the data without signed customer authorisation. Yutong strictly complies with the EU’s data protection laws and regulations.”
Pelican Head of Yutong Ian Downie says that all software updates delivered to electric buses here are controlled by the Castleford dealership.
He adds that they are only uploaded to vehicles after written permission is received from the operator and that under a procedure introduced by Pelican earlier in 2025, software updates can only be carried out in-person with the vehicle. Over-the-air updates are not available for vehicles sold in the UK.
Mr Downie underlines that all Yutong products supplied to Europe are in full compliance with UN Regulation 155 that governs cybersecurity and cybersecurity management.
In addition, those vehicles meet UN Regulation 156 on software update and software update management systems, ISO 27001 standards on information security management systems, and ISO 27701 on privacy information management systems.
“These regulations establish unified standards for vehicle cybersecurity and cybersecurity management systems,” the manufacturer continues.
Mr Downie adds that Yutong vehicles sold to European markets support customers’ remote control for comfort-based needs such as scheduling pre-conditioning of the on-board temperature. Operators can log in using private accounts to manage their fleets.
In addition, Yutong says that its vehicles supplied to Europe do not support remote control of acceleration, steering or braking.
“Yutong always prioritises vehicle data security and the protection of customer privacy and fulfils its commitments to cybersecurity management for vehicles and data protection with high standards,” it adds. “Yutong strictly complies with the applicable laws, regulations and industry standards of the locations where its vehicles operate.”
The vehicle OEM has also confirmed that its electronic architecture is similar to what is found on many other battery-electric vehicles and that all data is owned by the operator, not the manufacturer.
“Yutong cannot in any way make changes, update or reduce the speed of the bus without the owner itself being involved or doing so,” Pelican says in a statement.
“Vehicles comply with all UK and EU requirements for data security, having been thoroughly tested, and are monitored by European authorities in the same way as any other manufacturer’s products from Europe, the United States or Asia.”
The dealership adds that any operator of Yutong vehicles that is not happy with over-the-air functionality can disconnect the i-card reader or unplug the SIM card. That will isolate the vehicle and stop it from receiving any data with no impact to on-road performance.
“There is absolutely nothing for operators or stakeholders to worry about in these reports,” adds Pelican Managing Director Richard Crump.

 

[LucyP]

ADL need to have over the air updates. Maybe they would sort out the unreliability of their new battery buses on the 36 Route from Leeds to Ripon, via Harrogate.

Last Wednesday, one had broken down outside St. Marks' church in Harrogate on it's way to Leeds. On Friday, another had broken down at Harrogate bus station. The driver eventually got it going after 10 minutes and some help from another colleague, turning it on and off repeatedly, opening and closing the doors. It then left for Ripon and got to the stop just before the Little Wonder roundabout before it broke down again. 20 minutes of a phone call to the depot and the same turning on and off, doors opening and closing and suddenly the driver announced that "it has lit up" and it was mobile again.