There are 14 Yutong buses in the capital that can be accessed remotely, but can not be turned off by the company, Metlink says. Photo / Mark Mitchell
More than 100 Chinese-made buses on New Zealand roads are the same as those under investigation internationally over security concerns they could be remotely turned off.
Local public transport providers said they are closely monitoring developments overseas but are not concerned there is a risk for fleets at home.
The company that makes the buses has also strongly rejected international claims over their security.
Security services have found vehicles made by popular electric bus brand Yutong could be interfered with via a remote “kill switch”, prompting investigations in the UK, Denmark, and Australia.
The issue relates to the buses’ remote access capabilities enabled through SIM cards installed on board, intended for software updates.
An investigation in Norway last year found the Zhengzhou-based company could, in theory, disable the buses mid-transit via a remote “kill switch”, Norway’s public transport authority, Ruter, said.
The troubling findings triggered Denmark to launch its own urgent review of Yutong buses.
The UK followed, with the Department for Transport working with the National Cyber Security Centre to investigate, according to the Times of London.
Last week, Transport Canberra launched a fresh investigation into its Yutong electric buses. The agency told ABC it had looked into the issue last year and found no vulnerabilities, but decided to relaunch an investigation following recent developments overseas.
While the UK’s National Cyber Security Centre reported it was “technically possible” for the buses to be remotely disabled by Beijing, there is no evidence this has actually happened.
Public transport operators in Auckland, Christchurch, and Wellington all operate Yutong electric buses as part of their cities’ fleets. Each operator said it was aware of the concerns, but confident its vehicles were safe, and “do not have reason to be concerned”.
In the capital, 14 buses of Metlink’s 122 electric bus fleet were manufactured by Yutong, including those on its Airport Express service.
Metlink confirmed the 14 buses are fitted with Yutong sim cards, a feature of Yutong’s onboard telematics system called Yutong Vehicle Plus.
“This allows Yutong to remotely retrieve information that the bus produces and collects,” Metlink’s Fiona Abbott said.
“It also allows Yutong to perform remote actions such as software updates or turning on or off individual functions like air conditioning,” she said.
“Yutong does not have enough control to turn off the bus,” she said.
Abbott said Metlink was aware of the international reporting of the “kill switch”, but said they “do not have reason to be concerned about our buses here in Wellington”.
Meanwhile, 22 Yutong buses are operated on Auckland Transport’s (AT) bus network.
“AT has not been aware of any vehicle security issues that have affected the electric buses operating in Auckland,” AT public transport operations group manager Rachel Cara said.
“We are continuing to closely monitor developments overseas with bus safety and security alongside our bus operators, but we remain confident that Auckland’s buses are safe for the more than 75,000 bus services we run each week,” Cara said.
Environment Canterbury, which is responsible for Christchurch’s Metro bus network, operates 25 Yutong buses, but said they are an older generation, “and don’t have the level of connectivity of the newer buses”.
“The operator who owns these buses has assured us these buses can’t be accessed externally as these buses do not have this level of access, and they would not allow such modification,” public transport general manager Stewart Gibbon said.
In a statement to the Herald, a spokesman for the company rejected the international findings, saying Yutong can not remotely control its vehicles.
“Yutong operates independently on market principles and is not controlled by the government,” the spokesman said.
“Yutong strictly complies with the applicable laws, regulations, and industry standards of the locations where its vehicles operate.”
It said the technology on board is designed for “after-sales service needs”, allowing Yutong access to functions like scheduling air conditioning, but the system can not be accessed without customer authorisation and “cannot be remotely controlled for acceleration, steering, and braking”.
“Yutong cannot remotely control customers’ vehicles and does not have the so-called ‘kill switch.’”
The company confirmed it has around 150 buses in New Zealand.
Founded in 1963 as Zhengzhou Bus Repair Factory, Yutong is now the largest bus manufacturer in the world by sales volume.
While publicly listed, the company has recorded receipts for tens of millions of dollars in subsidies from the Chinese Communist Party.
A spokesperson for the Government Communications Security Bureau (GCSB) said the New Zealand Intelligence Community has not investigated or provided specific advice on the issue.
In its most recent threat assessment, the New Zealand Security Intelligence Service (NZSIS) raised concerns over Chinese interference, saying China is the most active force undertaking foreign interference on our shores.
“Foreign states continue to target New Zealand’s critical organisations, infrastructure and technology to steal sensitive information,” the report said.
“Some foreign states seek access to, or control of, critical infrastructure assets. Suppliers or service providers to these assets can also be targeted due to the amount of harm that can be caused.”
“Access or control could be gained, for example, by creating physical or remote entry points to key assets for later exploitation, creating supply chain dependencies, or compromising significant and sensitive data sets.”
Ethan Manera is a Wellington-based journalist covering Wellington issues, local politics and business in the capital. He can be emailed at ethan.manera@nzme.co.nz.