Norway's Army Rented Its Own Spy: Chinese Cars Filmed Soldiers and Gate Access Codes

Norway's army rented its own spy. During the Øvelse Hovedstad exercise in Oslo in September, which brought together 5,000 Home Guard soldiers, the troops drove Chinese electric cars. One of their assignments was to secure Gardermoen Airport in the event of war. The routes and schedules around that airport would matter enormously in a real war, and now those very details were sitting on the hard drives of Chinese vehicles. The cars recorded massive amounts of footage. They captured who got in and out and where the vehicles went. At least two of them were Deepal models made by the Chinese manufacturer Changan, and two anonymous sources confirmed the findings.

The discovery was completely accidental. A few bored soldiers were clicking through the onboard system's menus when they came across stored videos. An ordinary rental car had been recording things no outsider should ever get to see. Nobody had turned on the cameras. They were simply running. "You can see who gets into the car and who gets out, where we drive, who we pick up, and how long we stay at each location," said Lieutenant Fredrik Blanck, who took part in the exercise.

The cameras had also recorded the gate access codes. At some barriers, you need a key card and a code, Blanck explained, and that exact process was now captured on video. Vehicles were in short supply, so the troops kept using the cars until the exercise ended, including on military property. The videos weren't deleted until afterward, and only in the cars where deleting them was even possible. In the others, everything that had accumulated remained. A military force tasked with securing its own gates couldn't even get control of its own recordings in the end.

"We have no idea where this ends up," Blanck said. His concerns go further. A foreign intelligence service could piece together the fragments to build a picture of how a military operation unfolds, step by step. The microphones bother him, too. When you make a call through the hands-free system, you're speaking into a microphone whose connections nobody knows. The car is listening, and its connection to the outside world remains invisible. The discovery was reported up the chain of command in a separate report. Norway's armed forces did not answer questions about it. Their spokeswoman, Caroline E. Lysne, said they currently did not consider a ban on cars from certain countries appropriate. The security benefits would be limited, while the disadvantages for the troops and their suppliers would be greater. So the gap remains open because closing it is considered too inconvenient.

The vehicles came from First Rent A Car Norway, which operates the Hertz brand in Norway and is listed as the primary supplier under the military's rental agreement. The contract is worth up to 350 million Norwegian kroner. The ownership chain ends with China's Zhejiang Geely Holding Group. The army pays a lot of money and gets its vehicles through a chain whose final link is in China. The company says it complies with Norwegian and European law. Whether any law controls where the footage goes once it crosses the Chinese border is another matter entirely.

The problem is bigger than a fleet of rental cars. Every connected car a soldier drives carries cameras and microphones and records where it goes. Such a vehicle is a rolling memory bank, remembering routes and voices and passing both along as soon as it connects to the network. Next door in Sweden, the armed forces had 42,338 personnel at the turn of the year, or 65,581 including the Home Guard. Many of them ride in cars like these. It's easy to mock the Chinese models, but a Tesla recording everything would be no less dangerous. The danger lies in the connectivity, regardless of which manufacturer's badge is on the hood. Hardly anyone has considered this vulnerability until now.

Poland has already drawn its conclusion. Since February, Chinese cars have been banned from protected military facilities over fears that their cameras and sensors could collect classified information. Connecting official work phones to the onboard systems of such vehicles is also prohibited there. In Oslo, the troops kept driving the cars because there weren't enough vehicles available. To this day, nobody knows what data may have left those onboard storage systems during that time. The enemy no longer needs to send in a spy when the army drives one right up to its own gate.