Nearly a year after controversy erupted in Europe over the discovery of remote access capabilities and potential data leakage mechanisms in Chinese-made electric buses late last year, South Korea has yet to conduct a related investigation. Critics say an urgent assessment of Chinese electric buses operating in the country is needed, as the issue stems from structural problems affecting Chinese electric bus manufacturers broadly rather than an isolated defect involving a particular brand.
According to relevant authorities on Oct. 26, although information leakage through telematics terminals (T-BOX) in Chinese-made electric buses was identified last year, no related investigation has been conducted in South Korea.
The controversy began in Norway. In December last year, Norwegian public transport operator Ruter analyzed a Chinese-made Yutong electric bus in an enclosed facility and discovered a foreign SIM card in the vehicle's telematics terminal (T-BOX). The investigation confirmed that the manufacturer could use the system to remotely update software and access the battery and power systems. The findings prompted European authorities and transport operators, including Denmark's leading public transport company Movia and the United Kingdom's Department for Transport, to launch investigations.
Calls for an investigation also emerged in South Korea, where Chinese-made electric buses account for a substantial share of the market, but they did not lead to on-site inspections. According to data from the Ministry of Land, Infrastructure and Transport (MOLIT), 3,722 of the 8,505 electric buses deployed by local governments nationwide between 2022 and 2024 were Chinese-made, accounting for 43.8%. Despite more than four in 10 electric buses deployed domestically being manufactured in China, they remain in a blind spot of security inspections.
Authorities are believed to have refrained from launching an investigation because Yutong electric buses, the models involved in the Norwegian case, have not been introduced in South Korea.
However, cybersecurity experts say the issue cannot be regarded as a problem limited to a single manufacturer.
The underlying cause lies in GB/T 32960, a national standard for electric vehicles implemented by the Chinese government in 2016. China requires all electric vehicles operating within its borders to continuously transmit information, including location, driving status and battery data, to government and manufacturer monitoring platforms under the standard. This means that remote data transmission and continuous connectivity were incorporated as mandatory features from the initial design stage, and buses retaining these systems have subsequently entered public transportation fleets around the world.
Most Chinese-made electric buses deployed in South Korea were manufactured and imported in the 2020s, after the standard had become established. The possibility cannot be ruled out that manufacturers also retained communication modules (T-BOX) and control architectures based on China's domestic monitoring standards when producing models for export.
There is currently no institutional procedure in South Korea to verify these functions when vehicles are introduced into the country. Although the Cyber Security Management System (CSMS) certification program took effect in August last year, it focuses on evaluating manufacturers' security management systems to protect against hacking. Remote communication functions and access privileges incorporated by manufacturers from the initial design stage in accordance with Chinese national standards are not classified as external hacking threats and therefore fall outside the scope of the existing certification system.
“Foreign SIM cards may not function in South Korea's telecommunications environment, but there is no way to know whether other communication channels remain or who holds remote control privileges,” an industry official said.
“This is an issue separate from the manufacturer's good intentions,” the official added. “Even legitimate remote access functions could cause unpredictable damage if exploited by third parties, making it necessary to investigate the actual situation.”
