Ruter has completed a controlled cybersecurity test of two electric buses in an isolated mountain facility, aiming to assess the resilience of public transport systems against potential digital threats.
The “Lion Cage” test exposed vulnerabilities and provided Ruter with a clearer understanding of how to strengthen protection against hacking and unauthorised remote access.
The test, conducted at Franzefoss in Sandvika, involved two vehicles: a newly delivered Yutong bus from China and a three-year-old model from Dutch manufacturer, VDL. The purpose was to examine potential cybersecurity risks and ensure that Ruter’s future electric bus operations remain secure from unwanted activity or interference.
Key findings
Two main scenarios were investigated. The first assessed whether bus camera systems could be used to transmit footage for intelligence purposes. Testing confirmed that the cameras on both buses are not connected to the internet and therefore cannot send or receive external data.
The second scenario looked at cloud-based connectivity. The Yutong bus allows the manufacturer direct digital access for software updates and diagnostics, including battery and power management systems. In theory, this means the manufacturer could disable or interrupt the bus remotely. The VDL bus, by contrast, does not have remote update capability and is therefore considered less exposed to such risks.
Ruter currently maintains local control by being able to disconnect a bus from the internet through a single access point — the onboard SIM card. Removing this card immediately severs connectivity, ensuring that Ruter can isolate the system if necessary.
Ruter CEO Bernt Reitan Jenssen said:After this testing, Ruter is moving from concern to concrete knowledge about how we can build in security systems that protect us against unwanted activity or hacking of the bus's computer systems.
We have also informed national and local authorities and are collaborating to establish clear cybersecurity requirements in future procurements.
Ruter is already implementing measures based on the findings, including introducing stricter cybersecurity and infrastructure requirements in future procurements. The company is also exploring the development of a firewall solution to ensure local control and prevent remote interference.
The test highlighted how rapidly bus technology is evolving. The Yutong and VDL models differed significantly in digital integration, underscoring that newer vehicles may be more complex to secure.
Ruter’s approach emphasises managing cybersecurity risk proactively rather than limiting technological progress.
Jenssen added:The next generation of buses will have greater technological integration between systems, which will make it more difficult to build in firewalls. We therefore have a technological window of time to implement the necessary security measures right now. This is good news, and we are already preparing measures that will significantly increase our resilience.
Public transport in Oslo and Akershus should have access to the best technology – and the best security. Ruter identifies risk before it becomes a threat and builds in the right protection, rather than shutting out technology based on fear.
Summary of Results
- The VDL bus has no remote update function and is considered less vulnerable
- The Yutong bus includes a remote update capability, giving the manufacturer digital access to control systems
- Vulnerabilities identified in the update platform have already been corrected
- Bus systems remain relatively simple, allowing Ruter to isolate them quickly and delay update signals when needed
The test was carried out with support from Tor Indstøy, Vice President of Risk Management and Threat Intelligence at Telenor Group, and Arild Tjomsland, Special Advisor at the University of South-Eastern Norway.
