In the summer of 2025 two city buses were taken into a disused mine outside Oslo. The mountain was the point. Inside it, no stray signal could reach them, so whatever the buses said to the outside world could be heard alone. One was a VDL from 2021, built in the Netherlands. The other was a Yutong from 2025, built in China. Both carried passengers for Ruter, the public transport authority for Oslo and the surrounding region, and Ruter wanted to know what they did when nobody was looking.

The answer for the Yutong began with a SIM card. It was Romanian. Through it, over the ordinary mobile network, the manufacturer could reach the bus for software updates and diagnostics, and could reach the system that controls its battery and power supply. Ruter's press release, published on 28 October 2025, drew the conclusion in one sentence: "I teorien kan derfor denne bussen stoppes eller gjøres ubrukelig av produsenten." In theory, therefore, this bus can be stopped or made unusable by its manufacturer.

The Dutch bus was not completely offline. It sent diagnostic data to a Swedish supplier and had an alcohol lock that checked in over the network. But it had no online route to the systems that make it move. The 27-page technical report behind the press release, written by Tor Indstøy and Arild Tjomsland of the Lion Cage Project, put the difference in a table. Could the manufacturer switch the bus on and off? For the Yutong: "Fullt mulig." Fully possible. For the VDL: "Svært lite trolig." Very unlikely.

The bus belonged to an operator in Norway. Part of the power to change how it ran stayed with the company that built it.

Three things in that report matter as much as the finding itself. The testers did not stop a bus, and the report records no case of one being stopped. The report's own introduction calls the results "bedre enn fryktet," better than feared. And Ruter's page, last updated in September 2026, carries a line that most of the coverage left out: the issue is the connectivity technology, "ikke til produsent og opprinnelsesland." Not the manufacturer, and not the country of origin.

That last sentence is easy to skip. This piece is about what happens when you do not.

Europe's Chinese Cars: About 6 Percent in 2025, 11.7 Percent in August 2026

The buses arrived in a market that was changing faster than its rules. In 2025, Chinese brands sold about 811,000 cars in Europe, roughly 6 percent of the market, according to the data firm Dataforce. In August 2026 they reached a record 11.7 percent. In the Netherlands their share in the first quarter of 2026 was 6.65 percent, against 3.14 percent a year earlier, on BOVAG's figures, with BYD, Lynk & Co and Leapmotor selling the most. In October 2026 Leapmotor began building cars inside a Stellantis plant in Zaragoza.

Buses travelled the same road. Qbuzz began with about fifty Yutongs around Leiden and ordered 62 more. In January 2026 Arriva bought 128 Yutong buses for routes across central and north-eastern Brabant, around Den Bosch, Oss and Tilburg. Yutong buses also run in Groningen, Drenthe and the province of Utrecht.

The European debate about all this has mostly been a debate about price. In October 2024 the European Union imposed extra duties on Chinese battery-electric cars, from 17.0 percent for BYD to 35.3 percent for SAIC, on top of the normal 10 percent. Plug-in hybrids were left out, and Chinese hybrid sales grew. In January 2026 Brussels and Beijing agreed on guidance for replacing the duties with minimum prices, model by model. Every one of those measures asks what a Chinese car should cost. None of them asks what it can do once it is parked in a European street.

That second question had already been asked, and answered, somewhere else.

What Washington Wrote Down, January 2025

On 14 January 2025, in the last week of the Biden administration, the US Commerce Department finalised a rule on connected vehicles. It took effect on 17 March 2025 and survived the change of government with its prohibitions intact. From model year 2027, cars sold in the United States may not contain connectivity or self-driving software from companies owned by, controlled by, or subject to the jurisdiction of China or Russia. From model year 2030 the same applies to the connectivity hardware. From model year 2027, car makers owned by, controlled by, or subject to the jurisdiction or direction of China or Russia may not sell connected cars in the United States at all.

The rule's preamble explains why, and it is unusually concrete. Connectivity and self-driving systems, it says, "have significant control over and access to critical vehicle functions, including steering, braking, speed control, ignition, and almost all other mechanical functions of the vehicle." A foreign adversary "could even exploit compromised VCS or ADS components to impair or disable a connected vehicle while in transit." And then the scenario that turns a car into infrastructure: "A disabled, impaired, or erratically functioning connected vehicle, or potentially multiple connected vehicles all experiencing problems simultaneously, could cause traffic patterns that would effectively block critical transportation arteries."

The rule does not say that China has done this, or that it intends to. It describes a capability and a consequence. In that respect it reads like the Ruter report written in the language of national security.

I read the rule looking for the sentence that would limit the capability itself. A cap on what any manufacturer may do to a car after it is sold. A requirement that brakes and ignition work without a server. It is not there. I could not find the words "over-the-air" anywhere in it. Every prohibition depends on one thing: who supplies or controls the system. Updates are a concern when an adversary sends them. For everyone else, the rule even specifies, in its paperwork provisions, that "covered software updates alone do not constitute a material change." Under this rule, at least, an update by a manufacturer that is not Chinese or Russian does not trigger a new declaration.

Washington looked at the switch and wrote a rule about the hand.

Warsaw, Prague, Tel Aviv, The Hague

Europe has not written one rule. It has written several smaller ones, mostly at the gates of military bases.

On 19 February 2026 Poland's General Staff barred Chinese-made vehicles from secure military sites and told personnel not to connect work phones to them. The Czech army restricted some Chinese cars at selected sites in June 2026, after a formal warning from the national cyber security agency. Israel's army reportedly took about 700 Chinese cars back from senior officers. Britain has no ministry-wide ban and leaves it to individual sites.

The Dutch answer has been the most careful, and the most revealing. In 2024 the whole Tweede Kamer backed a motion, aimed mainly at Chinese cars, asking the government to study the risk. In March 2025 the responsible minister reported back, with input from the AIVD, the data protection authority and the RDW. Much of the result is classified. The public part found "een bepaalde mate van risico," a certain degree of risk, of espionage and sabotage. But the study covered all connected vehicles, not only Chinese ones.

In late September 2026 the AIVD published a short guide titled "De moderne auto als mogelijke spion," the modern car as a possible spy. It is about eavesdropping and tracking, and about the officials whose cars could be used for both. It names no country and no brand. In May 2026, asked about the Yutong buses in Dutch service, state secretary Bertram said a kill switch "valt niet uit te sluiten." It cannot be ruled out.

For a while I read this as a story about China and a hesitant Europe. Washington had acted; The Hague was still studying. The obvious next step would be a European version of the American rule. Then I went looking for proof that the thing everyone feared had happened, and found it, in the wrong place.

The Switch Has Already Been Used, Mostly by Western Hands

In September 2017, as Hurricane Irma moved toward Florida and roads north filled with people trying to leave, Tesla sent a software update to some of its cars. Owners of Model S and Model X versions sold with a 60 kilowatt-hour battery suddenly had more range. Their cars had always carried a 75 kilowatt-hour pack. Software had held part of it back, and owners who wanted the rest could normally buy it. For the evacuation, Tesla released it for free, for a limited time. It was a generous act. It was also a demonstration that the range of a car someone owned had been set, all along, by someone else.

In May 2019 an update went the other way. Older Model S cars with 85 kilowatt-hour packs lost range and charging speed. Tesla said the change was meant to protect the batteries. Owners in the United States sued, and in 2021 Tesla settled, paying $625 each to 1,743 owners, $1.5 million in all. Owners in Norway went to court as well. Norwegian courts found for them, and in April 2026 the Supreme Court turned down Tesla's last appeal, leaving the company owing about NOK 5.75 million to the remaining 115 owners in that case. Norwegian courts had looked at a remote change to a car and found that it had taken something from the people who owned it.

In December 2023 a regulator pushed the switch. The US road safety regulator, NHTSA, had pressed Tesla over its Autosteer system. On 12 December Tesla filed a recall covering 2,031,220 cars, every one with Autosteer built until then, and fixed it with a software update sent over the air. Tesla recorded that it was recalling "while not concurring with the agency's analysis." About two million cars changed their behaviour within days, at a government's insistence, through the manufacturer's channel. Weeks later China's market regulator did the same for more than 1.6 million Teslas in China.

General Motors offers a feature called Stolen Vehicle Slowdown. With a police report, an OnStar adviser can slow a stolen car to a stop. It is sold as a safety service, and it is one. The European risk assessment discussed below lists more of the same kind in Western cars: remote engine disabling through Stellantis's Mopar Connect, remote immobilisation from Volvo and Nissan, a BMW "engine lock". It notes that such services require the owner's consent.

None of this is sinister. Most of it is useful. A recall fixed by software reaches every car at once, without a garage visit. A stolen car that slows to a stop is better than a police chase. But it settles one question the debate about Chinese cars treats as open. The capability is not hypothetical, and it is not foreign. It is a normal property of the modern connected car, and Western manufacturers and Western governments use it. The infrastructure that makes a car safer can also make its owner more dependent.

It also pays. Tesla has sold Model 3 owners $2,000 of extra acceleration as a software unlock, and up to 50 miles of range already sitting in some Model Y batteries for $1,600. Since February 2026 its driver-assistance package in North America is sold only as a subscription, at $99 a month. BMW tried monthly fees for heated seats already fitted to the car, and dropped the idea in 2023 after a backlash. General Motors told investors in 2021 that it expected software and services to bring in $20 to $25 billion a year by 2030. None of this makes the safety case a pretext. It means the same channel that delivers a recall also delivers a revenue stream, and a manufacturer is rewarded twice for keeping it.

It is also important to say what the record does not show, because the word switch hides several different things. A maker that receives diagnostic data cannot necessarily change anything. A maker that can install software can change behaviour, within whatever the car's architecture allows. Some cars accept remote commands, from unlocking to immobilising a parked car. Steering, braking and propulsion sit behind their own safety systems, and access to one system is not control of all of them. Stopping a moving vehicle is the heaviest category, and the one least documented. I found no documented case of Tesla immobilising a whole car against its owner's will. The switches above change range, charging speed, features and behaviour. Remote connectivity does not automatically mean remote immobilisation. But it raises a question that ownership law has not settled: which functions may stay under the manufacturer's authority after the car is sold? The closest documented case of a Chinese maker reaching into a car after sale comes from outside Europe. In July 2026 a Chinese owner who drove his Zeekr 9X into Kazakhstan found its navigation, glovebox and fuel door remotely restricted for more than thirty hours, triggered by an anti-theft rule that detected the car abroad, before Zeekr apologised. The car itself kept driving. I found no report of a Chinese car in Europe being switched off.

So the attractive explanation fails. The danger in the Oslo mine was not that the bus was Chinese. It was that the bus could be reached. Ruter had said so itself.

That should have been the end of the China question and the start of a different one. Somewhere in Europe, I assumed, someone was asking it.

The Document That Saw the Switch, February 2026

In February 2026 the NIS Cooperation Group, the body where EU member states coordinate cyber security with the European Commission and ENISA, published a risk assessment of connected and automated vehicles. It is the most serious European document on the subject, and it is not timid. It lists 107 risks. Among them is scenario RS_17: "A hostile third country pressures a CAV manufacturer operating within its jurisdiction" to "implement hidden and malicious hard- or software, updates or configurations" in order "to physically manipulate the fleet."

It also cites the Oslo test, describing "an undisclosed functionality that allows for the manufacturer to remotely stop the vehicle or render it inoperable," and it refers to "other potentially far-reaching controls that manufacturers or telematics platform providers possess." It admits that the rules cars are approved under were "mainly created to ensure traffic safety." And about updates sent through the legitimate channel, the channel Tesla used in a hurricane and NHTSA used for a recall, it says: "Intentional malicious updates are therefore not adequately captured by the existing mitigation measures."

Here, I thought, was the harder question. The assessment had looked straight at the switch.

Then come the recommendations. The first is to de-risk from high-risk suppliers, explicitly for "vehicle control systems that can receive remote updates." Another asks member states to have rules "to restrict or exclude high-risk suppliers." There is advice on data localisation and on informing consumers about data. There is no recommendation to limit what manufacturers can do to a car remotely, to require critical functions to work without a connection, or even to make manufacturers disclose which remote controls exist.

The legislation that may follow points the same way. In January 2026 the Commission proposed a revision of the Cybersecurity Act with a mechanism to designate third countries of concern and restrict high-risk suppliers. It names telecom networks, not cars. The car industry's association, ACEA, argues that car makers fall under it anyway, through the NIS2 directive, and has asked to be exempted. The proposal is still being negotiated.

I had expected Europe to be asking the harder question. It is not. Brussels is converging on Washington's answer. Europe described the switch in its own risk assessment, and then recommended changing the hands that hold it. That is a reading of where the documents point, not a policy anyone has announced, and the Cybersecurity Act negotiations could still change it.

Informed, Not Asked

The rules every new car in the EU must already meet show why that answer comes so naturally. Since July 2024, all new cars must comply with two UN regulations adopted into EU law, R155 on cyber security and R156 on software updates.

R155 requires manufacturers to manage risks from suppliers and to protect the vehicle against attackers, including through "back-end servers used as a means to attack a vehicle." Its threat list includes "manipulation of functions designed to remotely operate systems, such as remote key, immobilizer..." Its answer is security: "Security controls shall be applied to systems that have remote access." The remote channel is assumed. The job is to keep strangers out of it.

R156 governs the updates themselves. They must be authentic, they must not leave the car in an unsafe state, and the car must not be driven if updating while driving is unsafe. On the owner, it says this: "the vehicle user is able to be informed about an update before the update is executed." Informed. Not asked. R156 does not require the owner's prior consent for each update. That does not mean nothing else limits what an update may do; it means this regulation, the one written for updates, leaves consent to the contract signed at purchase.

The newer EU laws step around the car. The Cyber Resilience Act, which will require security updates for connected products, states in Article 2 that it does not apply to products covered by Regulation (EU) 2019/2144, the vehicle approval rules that brought in R155 and R156. The Data Act gives owners access to the data their car produces; the Commission's guidance for vehicles, published in September 2025, is about data, not commands. The UN rule on immobilisers deals with unlocking them remotely, not with manufacturers locking them.

Nothing in this framework is careless. It reflects a reasonable view of the connected car as a device that is safer when it can be patched. But it means that two different questions have been folded into one. The first is nationality: whose hand is on the switch. The second is architecture: whether a car's critical functions should depend on a switch outside the owner's control at all. Washington answered the first. Brussels is preparing to answer the first. In the instruments examined here, the second has no clear, general answer. Consumer law, product liability and contract law may each limit what a manufacturer can do in a particular case. None of them sets a general rule for what may stay switchable after the sale.

The Strongest Case for Changing the Hands

There is a serious argument that Europe has chosen correctly, and it deserves to be made in full.

The switch is also a lifeline. Over-the-air updates close security holes in days rather than months. The same channel that can disable a car can fix two million cars' worth of defective software without a single garage visit. A car that can only be updated in a workshop is updated late, and an unpatched connected car is its own risk. Taking the channel away would make many cars less safe, not more.

The risk can also be managed without abolishing anything. Ruter did not take its Yutongs off the road. It is building firewalls to keep control local and a delay that lets it inspect updates before they reach the buses. Yutong says its update system is certified under R156, that the operator must confirm each update, that steering, brakes and accelerator cannot be controlled from outside, and that the SIM card can be removed without affecting normal driving. In Denmark, an assessment by EY for the transport company Movia, published in September 2026, found existing regulation "relevant og tilstrækkelig," relevant and sufficient, and no basis for treating Chinese buses as less secure. Zuid-Holland's transport executive, Frederik Zevenbergen, put it bluntly in November 2025: remotely steering or stopping a moving bus "kan niet." It cannot be done.

And choosing suppliers is something governments know how to do. Europe did it with 5G. A rule about who may build a car's connectivity can be written, enforced and defended. A rule about how every car must be designed reaches into engineering decisions across the whole industry, including Europe's own. A government can also reasonably judge that one foreign state poses a specific threat that others do not, even when the technology is the same. Supplier restrictions can reduce the risk posed by a particular government. They do not, by themselves, settle how much remote authority any manufacturer should keep.

That is the strongest case, and most of it is true. What it does not resolve is in the European risk assessment itself. The threat it describes runs through the legitimate update channel, sent by the legitimate manufacturer, under pressure. Choosing a different manufacturer moves that risk to a hand that is trusted today. It does not remove the channel through which any hand could act.

And the hands do not stay where they are put. Volvo is Swedish and owned by Geely; according to Echo24, the Czech army's restriction already covers it. Leapmotor cars now come out of a Stellantis factory in Spain. Tesla, the Western maker whose switches fill this piece, builds the Model 3 it sells in Europe in Shanghai, which is why the EU's anti-subsidy duty on Chinese-made electric cars applies to Tesla too, at 7.8 percent. Volkswagen builds cars in China on an electronics architecture developed with Xpeng, for the Chinese market. A line drawn by nationality has to be redrawn every time a company is bought, merged or reorganised. The switch, meanwhile, stays in the car.

The choice is not between a car that the maker can reach without limit and a car that can never be updated. The other option was parked in the same mine. The Dutch bus sent diagnostic data out and received none of its control from outside; its critical functions were, in the report's words, "isolert," isolated. Ruter's own fixes point the same way: a firewall that keeps control local, a delay that lets the operator look at an update before the bus accepts it. Updates can be signed, as R156 already requires, and still need the owner's or operator's approval. Safety-critical systems can be kept apart from the connected ones. The commands a maker may send remotely can be listed, limited and logged. None of this is exotic, and not all of it fits every architecture. But it is a set of design choices, and supplier selection is only one of them. Trusting the hand and limiting what any hand can do are two different kinds of security. The policy debate so far has been about the first. It trusts the hand to limit the switch. It has not yet asked the switch to limit the hand.

128 Buses in Brabant

In January 2026 Arriva ordered 128 Yutong buses for Brabant, for routes around Den Bosch, Oss and Tilburg. They are built to the same rules as every other bus in Europe, and those rules require their makers to keep strangers out and to tell operators about updates. Whether a city bus should be able to be stopped by anyone other than the people running it is a question none of those rules asks. In The Hague, the official answer is that a kill switch cannot be ruled out.

The question is no longer only who built the vehicle. It is who still has authority over it after someone else has paid for it. Ownership changes hands at the moment of sale. Control, it turns out, does not have to go with it.

Evidence Map

Facts, interpretations, forecasts, and disconfirming signals.

Core claim. The United States regulates who may hold remote access to cars (Chinese and Russian suppliers out from model year 2027). The EU's own risk assessment describes the same danger, including undisclosed manufacturer stop functions, and recommends the same answer: change the supplier. No US or EU rule examined here limits what any manufacturer may do to a car remotely, or requires critical functions to work without a connection; other law (consumer, liability, contract) may constrain specific cases. Remote access is not the same as remote immobilisation: the documented Western cases change range, features and behaviour, or immobilise with the owner's consent.

Evidence level. Facts, high: Ruter press release and TSU report; 90 FR 5360 and the BIS press release; the NIS Cooperation Group risk assessment (dated 30 January, published 13 February 2026); UN R155 and R156; Cyber Resilience Act Article 2(2); NHTSA recall 23V-838; Norwegian rulings and the US settlement on Tesla's 2019 update. Reported, medium: GM's 2021 software revenue target, Tesla's software unlock prices, Chinese market shares (Dataforce, BOVAG), the Israeli withdrawal, the Kazakhstan Zeekr lockout, the Czech restriction covering Volvo. Interpretation, medium: that Europe is converging on a nationality answer rather than an architecture answer; the Cybersecurity Act revision is still being negotiated and could change.

What would confirm this. A final EU instrument that restricts high-risk vehicle suppliers without any requirement on local control of critical functions; national bus tenders that address remote access only through supplier origin.

What would weaken this. An EU or member-state proposal requiring that braking, steering, propulsion or ignition cannot be disabled remotely, or that critical functions keep working without a connection; or a requirement that owners consent to, not only be informed of, updates affecting those functions.

What would contradict the mechanism. Evidence that remote access to critical functions is technically unnecessary for safety updates in current vehicle architectures and that regulators have rejected limiting it for that reason, or a documented case showing that supplier exclusion alone removed the remote-stop capability Ruter found.

Watchlist. Council and Parliament positions on the Cybersecurity Act revision; the Digital Fairness Act proposal expected in Q4 2026; Dutch follow-up on the Yutong buses and on the 2025 risk study; Ruter's Romerike tender requirements; the UK review of Yutong buses.

Sources. Ruter, press release on the bus security test and the TSU report by the Lion Cage Project; US Commerce Department, connected vehicles rule, 90 FR 5360 and BIS press release; NIS Cooperation Group, risk assessment on connected and automated vehicles; UN R155 and UN R156; Cyber Resilience Act; NHTSA recall 23V-838; Electrek on Hurricane Irma; electrive on the Norwegian Supreme Court; Notes from Poland on the military ban; Binnenlands Bestuur on the kill switch in Dutch buses; Movia/EY assessment.

Jerry van der Laan writes The Manifest Archive, Forensic Narrative Intelligence Writing on the systems beneath power, money, and history. He traces the structures beneath them.