Norway spent months trying to prove that a Chinese-built city bus could be remotely disabled by its manufacturer. It found that proof. What nobody expected is that the same capability has been sitting inside American cars for nearly two decades, sold back to drivers as a safety feature. Ruter, the transit authority that runs public buses across Oslo and Akershus, parked two electric buses inside an isolated facility built into a mountain, the kind of shielded space normally used to keep radio signals from leaking in or out, and let its own security engineers take them apart. One bus came from Yutong, the Chinese manufacturer that has quietly become one of Europe’s largest electric bus suppliers. The other was a three-year-old unit from VDL, a Dutch manufacturer. Ruter chose that pairing deliberately: the two buses sit at opposite ends of how connected a modern transit vehicle can be. The Boring Bus Turned Out to Be the Safer One Ruter’s own published findings are blunt about the VDL bus: it has no capability for over-the-air software updates at all. Every change to its systems requires a technician to physically connect a cable. That makes it a hassle to service. It also makes it nearly impossible to hijack remotely, which is exactly why Ruter’s engineers moved past it quickly. The Yutong bus is the opposite. It receives software and diagnostic updates automatically, the same way a phone downloads a firmware patch overnight, except this particular phone weighs roughly 30,000 pounds and carries dozens of passengers through Oslo traffic. That connection routes through a Romanian SIM card, which gives Yutong direct digital access to the bus’s battery and power management systems. Ruter’s engineers concluded that, in theory, this access could be used to stop the bus or render it inoperable, not through some