Researchers Drove a Chinese EV into an Underground Mine. It Kept Calling China

Researchers led Project Lion Cage, buying a NIO ES8 and monitoring its network behavior for about 2.5 years. They drove the SUV into a Norwegian underground mine to sever outside connections, yet the vehicle continued to try to reach remote servers, roughly 90% of which were located in China. All outbound traffic was encrypted, so inspectors could log destinations and volumes but not packet contents; the team found no direct evidence that sensitive personal data was exfiltrated and did not prove that data was handed to authorities. The experiment highlights persistent, always-on phone-home behavior by the vehicle and contradicts manufacturer assurances that customer data is processed locally in Europe.

A parallel test by Norway’s public transport operator compared a Chinese-made Yutong electric bus with a Dutch VDL bus and found a clean split: the VDL had no over-the-air update capability or standing remote connection, while the Yutong carried a Romanian SIM and supported remote diagnostics and updates, with manufacturer access reaching battery and power-management systems. Those remote-access capabilities can, in theory, be weaponized against vehicles or fleets; the Yutong’s cameras were offline and no misuse was detected, vendors patched vulnerabilities, and Norway strengthened cybersecurity procurement rules. The debate centers on tradeoffs between useful remote diagnostics and the legal risk posed by China’s National Intelligence Law, which can compel companies under Chinese jurisdiction to cooperate with state intelligence.