Two governments got handed the exact same discovery. One called it a managed risk and moved on. The other used it to rewrite its own emissions law. That gap says more about where this story is headed than another SIM card ever could.
We covered the original discovery back in July: Norwegian transit authority Ruter cracked open a Yutong electric bus inside a mountain facility and found a foreign SIM card with a standing line into the vehicle’s power systems, access Ruter’s own engineers said could, in theory, disable the bus remotely. What’s happened since is the part that actually matters, because this stopped being a story about one test in one country. It became a story about two governments deciding, in public, how much they trust a supply chain neither of them can fully see.
Britain Did the Math and Called It a Managed Risk
Britain’s answer arrived quietly, in a letter. Transport Secretary Heidi Alexander confirmed in May that just over 600 of the roughly 5,000 electric buses running in the UK were built by Yutong, then delivered her department’s verdict in a phrase built for a filing cabinet: the situation is a “managed” risk. Officials leaned on the Vehicle Certification Agency, Britain’s vehicle type-approval body, and a trade association representing the operators who had already bought the buses, before concluding the software update protocols in place matched government security expectations.
Nobody in that process found evidence the kill switch had ever actually been used. That’s true, and it’s also beside the point. Ruter’s test never proved Yutong had done anything malicious. It proved the access existed at all, built into the bus as a standing feature of how it talks to its manufacturer. Britain looked at that same standing feature and decided a polite bureaucratic label was enough to keep the buses running. Given that London was simultaneously trying to smooth relations with Beijing over a new embassy site and renewable energy investment, that conclusion didn’t require much imagination.
Norway Looked at the Same Numbers and Rewrote the Rulebook
Norway’s Ministry of Transport took the opposite road. On August 19, it opened a formal consultation on risk-reducing measures for bus procurement, and buried in that dry title is one of the stranger regulatory reversals in recent European transport policy.
Here’s the number that should stop you. According to Norway’s own vehicle registry, buses built in countries Norway has no security-policy cooperation with made up zero percent of new bus registrations in 2018. By 2025, that figure was 65 percent. In seven years, a category of vehicle Norway barely had a relationship with became the majority of everything new hitting its roads, inside a national fleet of roughly 12,600 buses. Norway spent that same decade chasing one of the most aggressive zero-emission transit mandates in the world, and the fastest way for county transit agencies to hit those targets was buying whichever manufacturer could deliver electric buses at scale and at price. Overwhelmingly, that turned out to be Chinese builders.
So the ministry’s fix is almost funny, in the way serious policy sometimes is. To reduce a security risk that its own climate mandate helped create, Norway is now proposing an exemption to that mandate, letting county agencies buy diesel buses again when a zero-emission option isn’t technically practical or would cost significantly more, specifically to avoid leaning on manufacturers from countries it has no security relationship with. Norway spent a decade building one of the most electrified bus fleets on Earth. It is now telling its own counties that the safer version of that fleet might need a diesel engine.
The Fine Print That Actually Decides Who Wins
Two details matter more than the headline. First, none of this is retroactive. County transport officials, including Vestfold’s transit director, have already confirmed that buses already under contract or already in production are untouched; the new scrutiny only applies to future purchases. Second, Norway isn’t inventing new legal authority. Its public procurement law already lets buyers weigh security and preparedness in tenders. What’s actually happening is a government telling its own county agencies to start using a power they already had and mostly weren’t using.
Add that up and the near-term effect is narrower than the headlines suggest. This isn’t a ban, and it doesn’t touch a single bus already on the road. It’s an instruction to buy differently starting with the next contract, paired with a diesel exemption to make that instruction actually followable. The buses already in Norwegian cities today, Chinese-built or otherwise, keep running exactly as planned. It’s next decade’s tenders that just got harder to win for anyone Oslo doesn’t already have a security agreement with.
This Is the Huawei Playbook, Just Riding on Four Wheels
None of this is happening in a vacuum. Norway restricted Huawei equipment from its 5G networks years before anyone tested a bus inside a mountain, on the same logic: hardware that phones home to a manufacturer you have no security relationship with is a liability no matter how well it currently behaves. What’s changed is which category of object gets that treatment. A city bus used to be judged on seating capacity and range. Now it is risk-assessed the way telecom infrastructure is, by the same kinds of national security agencies, using the same framework of who controls the connection rather than who built the box. Norway’s own risk assessment leaned on its National Security Authority and Police Security Service alongside its road and rail regulators, the same bench normally reserved for telecoms and energy, not bus tenders.
The same logic is driving the Connected Vehicle Security Act moving through the US Senate, which we covered alongside the original Ruter findings. Different country, different bill, identical premise: the ownership and control chain behind a connected vehicle’s software matters more than the badge on its grille.
What to Remember
The kill switch was never the interesting part. What’s interesting is watching two governments handed identical evidence reach opposite conclusions about what that evidence is worth, and realizing the real gap between calling something a managed risk and rewriting a procurement law isn’t about the buses at all. It’s about how much of your own infrastructure you’re willing to admit you don’t fully control.
Norway spent a decade building one of the most electrified bus fleets on Earth. It just decided the safest version of that fleet might need to run on diesel again. That’s not a climate story anymore. That’s a border, drawn in software, and Norway just decided which side its buses need to stand on.