Yutong, another major Chinese manufacturer, has delivered more than 1,500 vehicles to Australia since 2012. This massive influx has raised alarm bells with cybersecurity experts and government officials alike. For instance, the company operates service centers in each Australian major city — Sydney, Melbourne, Brisbane, Perth, and Cairns. Here, their vehicles receive tangible, hands-on physical upgrades as opposed to remote, digital over-the-air updates. Recent Congressional oversight has revealed concerns about the impact these buses could have on data security. Alarm bells are ringing about the national security threats posed.
Cybersecurity experts, including Dennis Desmond and Alastair MacGibbon, have voiced apprehension over the data collection practices associated with Yutong vehicles. They argue that the issue deserves greater scrutiny as more Australians demand foreign-made cars.
Yutong’s Operations in Australia
Yutong Australia has already set up a firmly rooted base in the country, offering maintenance workshops and dealer support across major Australian cities. So far, Yutong has delivered just those 133 low-floor, all-electric, battery-powered city buses. On top of that, there are an estimated 12 charter or coach buses employing the same technology.
In Europe, there has been concern about the Euro VI version of the same Yutong model. It’s crucial to note that this model is very different from the ones running today in Australia. A spokesperson for Yutong reassured that “Yutong vehicles in Australia do not support remote control of acceleration, steering, or braking signal,” emphasizing their commitment to safety.
More broadly, Yutong has claimed that it operates in strict accordance with Australian data protection laws and regulations. In their words, “no-one is allowed to unlawfully access or view the data.” This commitment is intended to help us protect customer privacy by making it a fundamental value of our work.
Data Security and Connectivity Issues
Meanwhile, cybersecurity experts are sounding the alarm at the prospect of an electric fleet that depends on continuous connectivity to manufacturers. Desmond, a former FBI special agent, is now embedded as a cybersecurity expert at the University of the Sunshine Coast. The biggest alarm he raised was over how these vehicles gather intelligence. He pointed out that “Yutong only collects vehicle operational data, which is transmitted via the onboard terminal through the local mobile network directly to the AWS [Amazon Web Services] data centre in Sydney, Australia.”
He’s still concerned about what data exactly they are collecting, and how that data is being stored and shared. His statement reflects a broader issue: “In my opinion, until a clear answer can be given as to what data is collected, how often that data is collected, to where it is transmitted…and who has access to that data…I would be concerned about the risk that using these vehicles presents.”
Expert Opinions on National Security Risks
Alastair MacGibbon, chief strategy officer at CyberCX and former head of the Australian Cyber Security Centre, reiterated the importance of scrutinizing foreign-made electric vehicles. He called on the government to at least stop public servants or politicians from using these kinds of vehicles in the first place. He accepted the high-stakes, dangerous cybersecurity threats facing Yutong. He pointed out that these risks are a symptom of a problem all foreign manufacturers face.
MacGibbon stated, “They have to be able to update software and firmware. That means they can degrade the device, turn it off, turn off certain features…it’s not about made in China, but controlled by China.” This shows up some possible weaknesses in the way foreign manufactured vehicles are required to perform when operating within Australia.
Desmond opened with these remarks, stressing that a lot of Australians are not aware of how vehicles made overseas track data. He stressed the importance of increasing understanding around these practices. He asserted that “Australians have become extremely reliant on foreign manufacturers for a variety of devices…and often are completely unaware of the data collection and exploitation processes involved.”
