Ruter, the agency that runs public transit across Oslo and Akershus, had a question most fleet operators never get to ask out loud: if the company that built our buses wanted to shut them down from the other side of the planet, could it? Rather than send the manufacturer a questionnaire, Ruter went looking for the kill switch itself. It drove two electric buses into an isolated test site inside a mountain, where no outside signal could reach the vehicles and nothing could leave, and handed them to security engineers with instructions to pull on every wire. What they found was a Yutong bus kill switch that answered to a Romanian SIM card.
One bus was a three-year-old VDL from the Netherlands. The other was a brand-new Yutong, built by the Chinese manufacturer that has spent the past few years becoming one of the biggest electric bus suppliers in Europe. Ruter published what it found, and we covered the findings when they landed. What follows is the part that got less attention: why one bus was safe, why the other wasn’t, and what the U.S. Senate quietly did about the same question last week.
Two Buses, Two Philosophies
Ruter’s engineers ran two scenarios. Could the buses’ onboard cameras be used for surveillance, and could the connectivity systems be used to affect how the bus itself operates? The camera question died quickly. The cameras are not connected to the internet, so there is no path for video to leave the vehicle. The connectivity question is where the two buses split apart.
The VDL bus cannot take software updates over the air at all. If somebody wants to change a line of code on it, they bring a laptop and a cable. That makes it tedious to service and close to impossible to hijack from a distance, which is why Ruter’s report treats it as the low-priority case.
The Yutong bus is built the way a modern phone is built. It takes software and diagnostic updates automatically over a mobile data connection, the same way your phone installs a patch while you sleep. The difference is that this phone weighs somewhere around 30,000 pounds and carries a few dozen people through downtown Oslo.
The Yutong Bus Kill Switch Sits Behind a Romanian SIM Card
Here is the detail that turned a routine audit into a national story. The Yutong bus reaches its maker through a Romanian SIM card. That mobile link gives Yutong access to the control system for the bus’s battery and power supply, and Ruter’s engineers concluded that, in theory, someone with that access could stop the bus or leave it unable to move. That is the Yutong bus kill switch, and it is not a secret backdoor. It is a door the manufacturer built for legitimate diagnostics and updates, the same door every over-the-air system has.
What kept this from being a five-alarm finding was the way the bus is wired. Ruter found a low degree of integration between the vehicle’s systems, with only one route in and out to the bus’s critical functions. One pathway is something you can defend. Ruter can put a firewall on it, hold software updates for inspection before they ever touch the vehicle, and keep control local without gutting the bus. Along the way, the security team also found vulnerabilities in a Chinese software update platform that counts Yutong among its customers. Those were reported to the platform’s provider and have since been fixed.
Why Ruter Didn’t Park the Fleet
Bernt Reitan Jenssen, Ruter’s CEO, described the value of the exercise as moving “from concern to concrete knowledge about how we can implement security systems.” The response is contractual as much as technical: tighter cybersecurity requirements in future bus procurements, firewalls that keep control in Oslo, and work with national authorities on rules that apply to every operator, not just Ruter. Norway has since gone further, carving out a diesel exemption and tightening the rules on where it buys buses.
The timing is deliberate. Ruter’s own experts point out that today’s buses have roughly the functionality of a car from 2016. That is a window. As driver-assistance and autonomous features arrive, the next generation of buses will have far more tightly integrated systems, and a single pathway will become dozens. Ruter would rather write the rules while the kill switch is still a single pathway it can put a firewall around. South Korea rehearsed the worst version of this scenario earlier this month, with a hijacked over-the-air update and a steering wheel that stopped answering the driver.
The Same Kill Switch Has Been in American Driveways for Years
None of this is unique to Chinese engineering. General Motors’ OnStar can send a cellular command that blocks a stolen car’s ignition from restarting once it is parked, or gradually slow a moving vehicle to a crawl so police can recover it. That is a manufacturer-controlled cellular link with authority over propulsion, installed before the car ever reaches a customer, and it is the same category of access behind the Yutong bus kill switch. GM has also demonstrated what else that pipe is good for: the FTC had to bar the company from feeding OnStar driving data to insurers. Further down the market, subprime lenders have been remotely disabling financed cars with GPS starter interrupters for two decades.
The question that matters is never whether a manufacturer can reach into a vehicle. Nearly every connected car sold today allows it, by design, for updates, diagnostics and theft recovery. The question is who holds that authority, under what legal process, and how many vehicles go dark at once if it is ever misused, subpoenaed or stolen. One sedan slowed to a stop by its maker is a feature. A city’s bus fleet answering to a server in another country is a different order of problem, which is why Ruter took it to the national government instead of the IT help desk.
What Changed in Washington Last Week
The Senate has been working through the same problem in the Connected Vehicle Security Act of 2026, which the Commerce Committee advanced on July 22. On September 22, the committee formally reported the bill to the full Senate with a rewritten text, and the rewrite added something the summer version did not have: a weight limit. The bill now applies only to vehicles with a gross vehicle weight rating of 10,000 pounds or less. A 40-foot electric transit bus weighs roughly three times that before anyone boards. The class of vehicle Norway sealed inside a mountain to hunt for a Yutong bus kill switch falls outside the bill entirely, the same gap that already exists in the Commerce Department’s current connected-vehicle rule.
Instead, a new Section 9 orders Commerce to write separate rules for heavy vehicles by December 31, 2028, taking effect no later than December 31, 2032. Buses get six more years of the status quo. The rest of the bill keeps its teeth for passenger cars. Vehicles designed or built in China, Russia, North Korea or Iran, or made by a company more than 15 percent controlled from one of those countries, are barred from January 1, 2027. Software from those countries is barred in model year 2027 and later vehicles, with the ownership threshold set at 25 percent. Connectivity hardware, meaning the modems, telematics modules and battery-management electronics that give a car its always-on link, gets until January 1, 2030, with repair and warranty parts for older vehicles exempted. Violations start at $1.5 million per transaction or five times its value, whichever is larger. The fine print still reaches further than the headline suggests, and the ownership math still catches European nameplates with the wrong shareholders.
There is also a carve-out that reads like it was drafted with one company in mind. A manufacturer owned from a covered country can still receive a Commerce authorization to sell here if it was already selling passenger cars in the United States when the law passes and had been building them on American soil for at least five years. Geely-owned Volvo has been assembling cars in South Carolina since 2018.
The Question to Ask Before You Buy Anything With a Modem
For an individual buyer, the practical risk is low and worth understanding rather than fearing. Software-defined cars mean recalls and fixes increasingly arrive over a data connection instead of a service bay, which is convenient right up until the owner realizes the warranty, insurance and repair relationships all run through code they never see and agreed to with a checkbox at delivery. That is the same fight playing out over the right to repair, where regulators keep deciding that owning the hardware should still mean something even when the manufacturer owns the code.
For fleet buyers, Ruter’s test is a template. Ask what data path the vehicle uses to phone home, who controls it, whether it can be isolated or delayed for inspection, and what the contract says happens if that access is ever used without consent. Those are procurement questions now, not IT questions, and every manufacturer selling connected vehicles into a public fleet should expect to answer them regardless of where the bus was built.
If your own car’s maker can slow it down or lock it out from a server somewhere, does it change anything for you whether that server sits in Detroit, Bucharest or Zhengzhou?