Chinese Cars Spying in Norway

No public record shows Chinese cars in Norway sending recorded conversations to China, though Ruter’s 2025 bus tests and a 2026 military exercise documented remote access and stored video. The Norwegian record establishes three capabilities and no completed act of collection. Ruter, the public transport operator for Oslo and Akershus, published tests in the week before November 5, 2025 showing that the manufacturer of its Yutong electric buses holds direct digital access for software updates and diagnostics, including access to battery and power controls. Home Guard soldiers found in September 2026 that rented Deepal cars, a Changan brand, had stored video of personnel, routes, and gate codes. A private researcher reported in September 2026 that about 90 percent of one NIO ES8’s outbound connections over roughly 2.5 years went to servers in China.

None of these findings includes audio of conversations leaving a vehicle, a transfer of the stored video to China, or an attribution to a Chinese intelligence service. PST, the Norwegian Police Security Service, stated in February 2026 that Chinese security and intelligence services have increased their capacity to operate in Norway, and that assessment contains no passage on vehicles. Governments have acted on capability alone: the Commerce Department issued 15 C.F.R. Part 791 on January 16, 2025, and Poland barred vehicles produced in China from protected military sites on February 17, 2026.

The principal dispute separates governments that treat capability as sufficient grounds for restriction from the Norwegian Armed Forces, which told the press in October 2026 that a ban on vehicles from certain countries would bring limited security gains. For any organization that holds sensitive conversations in or near a connected vehicle, the most consequential implication is that the data path determines exposure, and the data path is a contract term that can be audited today.

B. Threat Actor and Attribution

Who Is Behind the Recordings and Data Flows from Chinese Cars in Norway?

No actor is identified. No Norwegian authority, no allied agency, and no private vendor has named a sponsor for any recording, data transfer, or remote access finding in Norwegian vehicles, so each attribution below carries the tier labeled unattributed unless the text states otherwise. The Home Guard recordings are unattributed. The two Deepal cars stored video on board, soldiers deleted what they could reach, and a Home Guard lieutenant told the press that the units have no overview of where the material ends up.

The Yutong findings are a capability finding by the operator, Ruter, which stated that the manufacturer can reach battery and power supply control systems over the mobile network and that a bus could in theory be stopped by the manufacturer. Yutong stated that it complies with the laws of the places where its vehicles operate and stores European data in Germany. Its United Kingdom importer, Pelican, stated that European Yutong vehicles do not support remote control of acceleration, steering, or braking, and did not answer whether the manufacturer has any remote access.

The NIO ES8 finding sits at the preliminary or circumstantial tier. One researcher, a risk management and threat intelligence executive at Telenor Group, reportedly monitored the vehicle for roughly 2.5 years, found about 90 percent of outbound connections going to servers in China, and found the remainder going to Germany, the United States, the Netherlands, and Switzerland. The traffic was encrypted, so destinations and volumes were documented and content was not. NIO has told European customers that their data is processed in Europe.

Where Norway has made a formal government attribution, it concerns Chinese intelligence activity in general. PST stated in February 2026 that the largest Chinese intelligence threat lies in the cyber domain, that Chinese services try to recruit Norwegian citizens for sensitive and classified information, and that the actor known as Salt Typhoon has compromised vulnerable network devices at Norwegian organizations. On May 7, 2026, police announced the arrest of a Chinese citizen on suspicion of complicity in an attempt at serious espionage against state secrets, involving a satellite receiver for polar orbit data. Police suspected that a Norwegian registered company served as a front for a Chinese state actor.

What Does Chinese Law Require of Chinese Companies That Hold Vehicle Data?

Article 7 of the National Intelligence Law of the People’s Republic of China, adopted June 27, 2017 and effective June 28, 2017, provides that all organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law. Article 14 permits national intelligence work institutions to request necessary support, assistance, and cooperation from relevant organs, organizations, and citizens, and Article 10 authorizes the use of necessary means, tactics, and channels domestically and abroad. These provisions establish a duty and say nothing about any act performed under it, and the retrieved record contains no public case in which a Chinese authority compelled a vehicle maker to hand over data from a car abroad. Recorded Future reported in 2017 that China’s Cybersecurity Law, effective June 1, 2017, gives a national security review body run by the Ministry of State Security power to examine foreign technology.

C. Collection Methods and Tradecraft

How Would a Car Record Conversations and Send Them to China?

A car records conversations through a microphone, stores or streams the audio, and delivers it over a cellular link to a back end operated by the manufacturer or a supplier. NSM, the Norwegian National Security Authority, stated in its 2025 risk assessment that many cars carry microphones for hands free calls and voice control, that some carry interior cameras, and t