During a recent Norwegian military exercise, Chinese-made vehicles rented by the armed forces recorded sensitive information, raising security concerns about the use of connected cars in defense operations. The exercise took place at Oslo airport from September 14 to 18, during which soldiers discovered videos stored on the vehicles’ onboard cameras capturing details such as personnel movements, routes, and access codes to secure military sites.

The vehicles involved included Deepal models manufactured by Changan, a Chinese state-controlled automaker. These cars were provided to the military through Hertz Norge, a rental company indirectly owned by Chinese automotive group Geely. Lieutenant-Colonel Per Gunnar Gösberghaugen of the Norwegian Home Guard confirmed that soldiers found recordings from the cars’ sensors but said it was unclear whether the data had been transmitted to any third party, including entities in China. He did not rule out the possibility of external access.

Despite the discovery, the military continued to use the vehicles until the exercise concluded, citing a lack of viable alternatives, and soldiers promptly deleted the captured videos. Authorities have decided against an outright ban on Chinese-made vehicles, considering such a step disproportionate relative to the potential security risks. Instead, the military plans to implement site-specific security measures, including selective restrictions on vehicles equipped with cameras and sensors, regardless of their manufacturer.

Hertz Norge stated that it adheres to Norwegian and European data protection regulations. Its representative, Hallvard Nerbovik, emphasized that customer data is handled securely and is not shared with manufacturers or third parties without explicit legal justification, though he did not clarify whether recorded onboard video footage might have been transmitted.

The case underscores broader concerns about modern technology in the defense sector. Norwegian authorities have previously flagged vulnerabilities related to smart devices and connected equipment. In 2025, tests conducted by the Oslo public transport authority showed that Chinese-made Yutong electric buses could theoretically be remotely immobilized via over-the-air updates—posing risks given the buses’ potential use in emergency evacuations. While Ruter, Oslo’s public transport company, has since implemented monitoring systems to mitigate this threat, the incident highlights the precarious balance between technological reliance and security.

Additionally, concerns extend beyond vehicles. Wearables and fitness applications like Strava have been shown to inadvertently reveal sensitive military information by mapping soldiers’ movements and identifying bases, as observed in conflicts in Afghanistan and Syria. Earlier this year, a French newspaper was able to locate the aircraft carrier Charles de Gaulle in near real-time through such data.

Officials from the Norwegian National Security Authority (NSM) highlighted the opacity surrounding the destinations and uses of data collected by modern digital devices. Andreas Skjold-Lorange of NSM warned that overdependence on technology or services sourced from any single country, especially one without security cooperation, can create vulnerabilities that adversaries might exploit. The episode serves as a cautionary example of the risks inherent in integrating connected technologies into military and critical infrastructure environments.