Worries have emerged about the presence of hidden remote access mechanisms in Chinese-made Yutong electric buses, leading the IL party to raise several questions. The party highlights a potential risk beyond technical issues, emphasizing concerns about third-party authoritarian regimes potentially accessing public transport systems, collecting mass data, or affecting operations during critical times.
Despite local inspections, the IL notes a lack of clarity from the Portuguese government regarding digital security audits and possible corrective measures, underlining the national security implications. The questions direct attention to identifying which public companies have purchased these buses, the current number in operation in Portugal, and what inspections the government plans alongside local authorities to ensure these vehicles are free from such mechanisms.
Additionally, the IL inquires if the government is conducting assessments similar to those during the 2023 ban on Huawei’s 5G in Portugal. This includes whether cybersecurity institutions have evaluated the risks associated and if independent audits of Yutong buses’ digital and communication systems have been requested.
Further questions focus on procurement contracts ensuring no remote access or control by manufacturers, the guarantees regarding data ownership, storage, and transmission, and any communication with Norwegian and Danish authorities about detected issues.
The party also seeks information on whether the government is collaborating with the European Commission or other EU states to establish common cybersecurity standards for public fleets or other infrastructures. It questions whether the inspection results will be made public.
Consideration for changes in rules or legislation to ensure national security in future public transport tenders and addressing past alerts about Nuctech scanners at Portuguese ports are also raised. Lessons from the Nuctech case to prevent similar scenarios with Yutong buses are questioned, as is a national strategy to protect against acquiring critical equipment from authoritarian regimes, ensuring Portugal’s digital and operational sovereignty.
Yutong, the Chinese bus manufacturer, has assured that data access requires customer authorization, remote driving is not possible, and data is stored within the European Union.
