“Information-Gathering Devices on Wheels”: Chinese Connected-Car Security Threats Materialize as Access Restrictions Spread from Military Facilities to Industrial Sites

Militaries in Germany, the United States, the United Kingdom and Poland tighten controls on Chinese connected cars
Risks of information collection, transmission and remote hacking become apparent as vulnerabilities continue to emerge
Private companies also restrict access by Chinese-made vehicles, with vigilance expected to spread

The German military has decided to restrict Chinese-made vehicles equipped with advanced sensors from entering military facilities, amid concerns that onboard cameras, radar, microphones and communications modules could collect and transmit sensitive information from inside the facilities. Similar restrictions are rapidly spreading in other major countries, including the United States, the United Kingdom and Poland. As numerous security investigations and experiments confirm the potential for Chinese-made connected cars to transmit data externally and allow remote access, countries are steadily raising their guard.

Germany and the United States Restrict Chinese Vehicles’ Access to Military Facilities

Bloomberg reported on the 11th (local time), citing people familiar with the matter, that the German armed forces had banned access by certain Chinese-made vehicles equipped with sensors such as advanced cameras, radar and microphones. The use of Chinese-made commercial unmanned aerial vehicles (drones) at military bases and training grounds has reportedly also been suspended entirely. The measures follow concerns raised in an earlier confidential security investigation by Germany’s Military Counterintelligence Service (MAD) that signals collected by drones and vehicles could allow sensitive military information to leak to Chinese intelligence agencies. Regarding the matter, the German Defense Ministry explained, “We are controlling entry and parking at bases, focusing on vehicles and devices equipped with sensors that pose security risks, and are developing detailed guidelines.”

Germany is not the only country restricting the use of Chinese-made vehicles at military facilities. The U.S. Department of Defense raised its guard in June by adding BYD to a list of companies linked to the Chinese military. On the 26th of last month, BYD vehicles were also completely barred from Kadena Air Base, a U.S. military installation in Okinawa, Japan. The reason was that onboard cameras, various sensors and the Global Positioning System (GPS) could leak the locations of fighter jets, radar and ammunition storage facilities inside the base, along with information related to military operations. Kadena is a key U.S. military air operations hub close to China and the Taiwan Strait.

British and Polish Militaries Introduce Similar Measures

The British military is also controlling access by Chinese-made vehicles at some key military facilities. According to British media reports, RAF Wyton, a Royal Air Force intelligence base in Cambridgeshire, introduced its own security guidelines last year requiring electric vehicles containing Chinese-made components to be parked at least 2 miles (approximately 3.2 km) away from key military intelligence facilities. Chinese-made vehicles have reportedly also been banned from RM Poole, a naval special forces facility, and Stirling Lines, an army special forces base. The British Defense Ministry has also instructed military personnel who use Chinese-made electric vehicles not to hold classified conversations inside their vehicles or connect work phones to vehicle systems.

The Polish military also announced plans in February to ban Chinese-made vehicles from military facilities. Exceptions are permitted only when information-gathering functions, such as location, video and audio recording, have been disabled and facility-specific security requirements have been met. Military personnel are also prohibited from connecting work phones to these vehicles’ infotainment systems, and unit commanders have been instructed to provide parking outside military facilities for restricted vehicles wherever possible. However, facilities open to the public, including military hospitals, clinics, libraries, military prosecutors’ offices and social facilities within garrisons, are exempt from the restrictions.

Table 1. Restrictions on Chinese-Made Vehicles and Drones at Military Facilities in Major Countries

Risks of Chinese Connected Cars Come into Focus

Countries’ heightened vigilance toward Chinese-made vehicles appears to be driven by risks that have been verified in practice. For example, on the 8th of last month, Norwegian business newspaper Dagens Næringsliv (DN) reported that cameras in Chinese-made electric vehicles had recorded military facility access codes and troop movement routes during Øvelse Hovedstad, a military exercise conducted by the Norwegian armed forces in September in the capital, Oslo, and around a nearby airport. The vehicles in question had been rented through Hertz, and at least 2 were made by Deepal, an electric vehicle brand under China’s Changan Automobile. Military authorities deleted the footage but could not determine whether the data had been transmitted externally, including to China.

Investigations highlighting the associated risks are also continuing to emerge. In Australia, public broadcaster ABC’s investigative program Four Corners released the results of a hacking experiment involving BYD’s Shark 6 plug-in hybrid vehicle in September. After gaining access to the vehicle’s systems, researcher Dan Hreschuk of cybersecurity firm Fortify Labs used an external laptop to turn off the headlights while the vehicle was moving, activate the wipers and lock the doors. He also demonstrated the ability to track the vehicle’s movements in real time and listen to occupants’ conversations through its internal microphone. However, the researchers said they had physically accessed the vehicle beforehand to install additional software and equipment, and had not demonstrated remote intrusion through BYD’s own communications network.

Potential for External Data Transmission and Remote Access

Similar threats have been identified in Sweden. A joint investigation conducted in October 2022 by local automotive publication Vi Bilägare and Sweden’s KTH Royal Institute of Technology found that the Marvel R, an electric sport utility vehicle (SUV) from MG, a brand owned by China’s SAIC Motor, continuously communicated with and transmitted data to servers owned by China’s Tencent. MG explained that the transmitted information was merely diagnostic log data from a music application installed in the vehicle’s infotainment system, but the researchers could not verify the specific contents of the transmitted data. A follow-up investigation in November of the same year identified a security vulnerability involving 6 vehicle communications ports exposed to external access. MG acknowledged that the ports were open and announced plans to address the issue through a software update.

In Norway, remote-access capabilities that could affect vehicle operation itself have also been discovered. In October last year, Oslo public transport operator Ruter conducted comparative security tests on electric buses made by China’s Yutong and the Netherlands’ VDL, and announced that the Yutong vehicles had functions allowing the manufacturer to update software and perform diagnostics remotely. The finding suggested a potential risk that the manufacturer could digitally access vehicle control systems and interfere with the battery, power supply and operation. By contrast, the VDL vehicles used for comparison did not have the same remote-update capability.

Private Sector Also Keeping a Close Watch

As the security risks of Chinese-made connected cars become increasingly apparent, vigilance is spreading beyond military facilities to private companies’ production sites. A notable example came in March, when Orlen Unipetrol, the Czech subsidiary of Polish energy company Orlen, banned all vehicles manufactured in China from its industrial facilities. In an internal notice, Orlen Unipetrol explained that the advanced data collection systems, sensors and communications modules in Chinese-made vehicles could pose security risks to critical national infrastructure. Last month, 4 Turkish defense companies—Aselsan, Roketsan, Havelsan and TEI—also restricted access by foreign-made electric vehicles because of their potential to photograph and map facilities within their premises.

Industry observers suggest that such restrictions could eventually extend to advanced semiconductor factories, corporate research laboratories and data centers. Their assessment is that connected cars, which continuously monitor their surroundings and can transmit collected information over communications networks, will inevitably be classified as potential security risks at most facilities. Another risk cited is that vehicles themselves could become a pathway for hacking if vulnerabilities in manufacturers’ servers or vehicle software are exploited. Unauthorized access to a vehicle could enable not only real-time information gathering through cameras and microphones, but also the theft of stored data and remote manipulation of vehicle functions.