The key facts

  • During exercises on September 14–18 near Oslo Airport, soldiers found in the systems of rented Chinese Deepal cars camera recordings with access codes and routes.
  • The cars were provided by Hertz Norge, indirectly owned by China's Geely; Changan did not respond to AFP inquiries.
  • It is unknown whether the data was transmitted to third parties; the army continued using the cars and deleted the recordings, Dagens Naeringsliv reports.

Discovery of Recordings During Exercises

During security exercises at Oslo Airport on September 14–18, soldiers waiting in cars and using the vehicle's screen discovered videos recorded by onboard cameras. This was reported by the Norwegian newspaper Dagens Naeringsliv (DN) about three weeks after the exercises. The recordings showed who got in and out of the cars, which routes the vehicles drove, and even the codes used to open gates and doors of military facilities.

Source of the Cars and Confirmation

According to DN, the recordings were made by rented cars — at least two vehicles of the Deepal brand, produced by the state-controlled Chinese automaker Changan. They were provided to the army by Hertz Norge, indirectly owned by the Chinese automotive group Geely. Lieutenant Colonel Per Gunnar Grobergshaugen, a representative of the Norwegian Home Guard, confirmed to AFP that soldiers found videos from the cars' sensors saved in their systems.

Unknown Fate of the Data and the Military's Reaction

It is unknown whether the recordings were transmitted to a third party, including in China, but the Home Guard representative did not rule out such a possibility. According to DN, even after discovering the leak, the military continued using the cars until the end of the exercises due to a lack of alternatives, and the soldiers deleted the videos. The military concluded that a complete ban on Chinese cars would be disproportionate to the potential security gain, and preferred procedures adapted to each facility, with possible local bans on cars with cameras and sensors regardless of their origin.

Companies' Responses

Hertz Norge stated that it complies with Norwegian and European legislation. 'Our customers' data is safe with us,' said the company's marketing and communications director Hallvard Nerbovik in a comment to AFP. According to him, personal rental data is not transmitted to automakers, company owners, or third parties without explicit legal grounds, but he did not specify whether onboard video recordings could have been transmitted. The Changan group did not respond to AFP's questions.

Context: Risks of Connected Devices

The case highlights a paradox: Europe's armies are strengthening protection against espionage and hybrid threats, yet the vehicles they use may themselves collect sensitive information. Last year, tests for the Oslo public transport operator Ruter showed that the Chinese manufacturer Yutong could theoretically immobilize its electric buses remotely via an 'over-the-air' update system; Norway could have used these buses to evacuate the population in an emergency. Ruter said it has since implemented monitoring mechanisms and delays for incoming signals to control updates. Cars are not the only potential 'Trojan horses': in 2018, Strava data made it possible to identify military facilities and soldiers' routes, including in Afghanistan and Syria, and in March the French Le Monde was able to determine the location of the aircraft carrier Charles de Gaulle almost in real time thanks to a sailor using the app on board.

Position of the Norwegian National Security Authority

The Norwegian National Security Authority (NSM) called modern cars 'computers on wheels that collect information.' 'We do not know exactly where the information goes and how it is used,' said NSM representative Andreas Schjold-Larange in a comment to AFP. According to him, in addition to the data collected, Norway should be wary of excessive dependence on a single country, especially if it does not cooperate with Norway on security matters: 'If we become too dependent on services or products of some country, it will make us vulnerable, whatever that country may be.'