During a military exercise in Norway, Chinese-made cars captured sensitive information including access codes to secure premises and the entry and exit of officials, raising concerns about the risks posed by connected cars.
According to the Norwegian daily Business Daily, during a security drill held at Oslo Airport from September 14 to 18, waiting soldiers discovered the video recorded by the vehicle camera when they clicked on the vehicle screen.
The footage showed who was getting on and off the vehicle, the routes the vehicles took, and even captured the codes used to open gates or access controls at military installations.
The Daily Business Daily reported three weeks after the exercise that the footage came from rental vehicles, at least two of which were Deepal cars owned by Changan, a Chinese state-controlled automaker. The vehicles are supplied to the military by Hertz Norge, which is indirectly owned by Chinese auto group Geely.
"Yes, the National Guard soldiers discovered that the video captured by the vehicle sensor was stored in the vehicle system," Lieutenant Colonel Per Gunnar Grosberghaugen, spokesman for the Norwegian National Guard, confirmed to AFP.
It was unclear whether the footage was shared with third parties, specifically China, but the officer said he could not rule out the possibility.
This incident highlights a contradiction: while European militaries are strengthening their defenses against espionage and hybrid threats, the vehicles they use may be collecting sensitive information.
Even after the leak was discovered, without replacement vehicles, the military continued to use the vehicles until the end of the exercise, and soldiers deleted the videos, Business Daily reported.
The Norwegian military believes that the impact of a complete ban on Chinese-made vehicles would be disproportionate to the possible safety gains. The military has said it prefers to tailor security procedures to each site, possibly with local bans on vehicles equipped with cameras and sensors, regardless of where they are manufactured.
Hertz Norway emphasized that the company complies with relevant Norwegian and European regulations.
"Customers' data is safe with us," Hallvard Nerbovik, the company's director of marketing and communications, told AFP.
"No personal data related to our rental business will be shared with the vehicle manufacturer, our owners or other third parties without a clear legal basis," he added, without specifying whether in-car video might have been transferred.
Changan Group did not respond to AFP's questions.
Last year, tests for Oslo public transport operator Ruter showed that Chinese manufacturer Yutong could theoretically disable its electric buses remotely through its over-the-air (OTA) update system.
In the event of an emergency, Norway may use these buses to evacuate people.
Root said that relevant mechanisms have since been introduced to monitor and delay the reception of external signals to control system updates.
Hyundai isn't the only potential Trojan horse.
Smartwatches and fitness apps popular with runners, such as Strava, can also leak sensitive military information.
In 2018, Strava released data that allowed outsiders to identify military bases and movement routes of soldiers, particularly in Afghanistan and Syria.
In March this year, the French newspaper Le Monde used this application used by a sailor on board to locate the French aircraft carrier Charles de Gaulle in the Eastern Mediterranean in almost real time.
Norway's National Security Agency (NSM) said Hyundai cars are "mobile computers that collect information."
"We cannot determine where the information was sent or what it was used for," agency official Andreas Skjold-Lorange told AFP.
The agency, which is responsible for minimizing strategic risks, including in the digital sphere, said that in addition to the data being collected, Norway should also be wary of over-reliance on any one country, especially those that do not cooperate with Norway on security matters.
“If we become overly dependent on services or products from one country, no matter which country it is, it makes us vulnerable,” Sjolde-Lauranger warned.
