The Trojan Horse on Wheels: How Modern Vehicles Became a National Security Crisis in Norway

In the digital age, the line between a civilian convenience and a national security liability has become dangerously thin. In September 2026, during the high-stakes Øvelse Hovedstad military exercises in Norway, that line was not just blurred—it was effectively erased. As reservists from the Norwegian Home Guard (Heimevernet) mobilized to secure the Oslo-Gardermoen airport, they found themselves behind the wheels of rented vehicles that were, in effect, rolling surveillance outposts.

The incident has triggered a firestorm in Oslo, sparking intense parliamentary debate and raising uncomfortable questions about the integration of Chinese-manufactured technology into the critical infrastructure of Western nations.

The Chronology of a Security Breach

The crisis unfolded between September 14 and 18, 2026. As part of a massive defensive drill designed to simulate the protection of vital infrastructure, the Norwegian military mobilized nearly 5,000 reservists. To facilitate rapid, discreet transport across the capital, the military relied on a pre-existing logistics contract with First Rent A Car Norway, the entity operating the Hertz brand within the country.

The Discovery

The trouble began when soldiers, tasked with securing sensitive military perimeters, started interacting with the sophisticated infotainment systems of their assigned vehicles—specifically, models from the Chinese brand Deepal, a subsidiary of the automotive giant Changan Automobile.

As soldiers navigated the digital interfaces, they stumbled upon local storage archives that should not have existed. The onboard systems had been recording far more than mere navigation data. The memory banks contained:

• Video footage: High-definition recordings of the surrounding environment, including military checkpoints and secure zones.
• Access Credentials: In a chilling revelation, some files included video sequences of soldiers entering security codes into keypads at restricted military installations.
• Logistical Trails: Detailed timestamps of movements, passenger interactions, and exact coordinates of sensitive stopovers.

While the data had been technically "deleted" from the immediate user interface, the presence of these logs raised an immediate, terrifying question: Were these data packets being transmitted via the vehicle’s constant cellular connection to servers controlled by the manufacturer or, by extension, foreign state actors?

The Anatomy of the Risk: Why Modern Cars Are "Sensors"

To understand the gravity of the Norwegian incident, one must look at the modern vehicle not as a machine of iron and steel, but as a "computer on wheels." The Norwegian National Security Authority (NSM) has noted that a modern, connected vehicle can house upwards of 200 individual sensors.

The Sensor Suite

These vehicles are equipped with a complex array of hardware designed to facilitate "smart" driving features:

• External Cameras: 360-degree vision for parking and autonomous driving assistance.
• Internal Microphones: Used for voice commands and cabin communication.
• GPS and Telemetry: Real-time tracking of every movement.
• External Connectivity: 5G/LTE modems that keep the vehicle in constant contact with the manufacturer’s cloud.

In the context of a military operation, this ecosystem is a goldmine for intelligence gathering. If a vehicle is capable of "seeing" a secure military gate and "listening" to the activity within its cabin, it becomes an unintended—or potentially intentional—spy.

The Web of Ownership: Connecting the Dots to Beijing

The controversy is exacerbated by the ownership structure of the service providers. First Rent A Car Norway is backed by capital involving the Zhejiang Geely Holding Group. The implications of this are not merely commercial; they are geopolitical.

Li Shufu, the chairman of Geely, is a member of the Chinese People’s Political Consultative Conference (CPPCC), a primary advisory body to the Chinese government. This connection, coupled with the fact that the Deepal vehicles are products of Changan Automobile—another major Chinese state-linked player—creates a nexus of influence that has drawn sharp criticism from Norwegian intelligence agencies.

A Pattern of Vulnerability

This is not the first time Chinese technology has been flagged in Norway. In late 2025, an investigation into the country’s electric bus fleet revealed that these vehicles could be remotely disabled or controlled from servers located in China. The realization that critical transport infrastructure could be "switched off" or monitored from a foreign capital shifted the national security discourse from abstract concern to immediate, pragmatic fear.

Official Responses and Bureaucratic Silence

The official response to the Øvelse Hovedstad incident has been characterized by a mix of bureaucratic caution and defensive maneuvering.

The Military Stance

The Norwegian Defense Materiel Agency (Forsvarsmateriell) has remained largely silent regarding the specifics of the Hertz contract. When pressed about requirements for GPS data handling, remote access, and data encryption, the agency cited "national security and defense confidentiality." This opacity has done little to calm public anxiety.

While military spokespeople have admitted to being "aware of the risks" associated with modern automotive electronics, they stopped short of admitting negligence. They maintain that there is currently no formal, blanket ban on using vehicles from specific nations, as such a move would paralyze the logistical operations of the armed forces in a market increasingly dominated by Chinese-owned manufacturers and components.

The Corporate Defense

For their part, companies like Volvo Cars (also owned by Geely) and representatives for the rental entities argue that they strictly adhere to European GDPR standards. They emphasize that there is no "automatic" transmission of data to foreign states without a legal basis. However, critics argue that the legal basis is a moot point if the parent company is subject to Chinese national intelligence laws, which compel companies to assist state security services upon request.

Political Fallout and National Implications

The incident has reached the highest levels of the Norwegian government. Himanshu Gulati, a prominent Member of Parliament representing the Progress Party, has formally requested an inquiry into the matter. His inquiry targets the fundamental question: Is it acceptable for a sovereign military to utilize vehicles that function as mobile intelligence-gathering platforms in sensitive zones?

The Broader Security Paradigm

The Norwegian situation serves as a microcosm for a broader global dilemma. As Western nations push for a rapid transition to electric and connected vehicles, they are importing massive amounts of proprietary software and hardware from geopolitical rivals.

1. The "Supply Chain" Trap: It is increasingly difficult to find a vehicle that does not rely on Chinese-manufactured components, particularly in the battery and software sectors.
2. The Privacy Paradox: While consumers demand "connected" features (real-time traffic, app-based control, over-the-air updates), they are unknowingly consenting to a constant stream of telemetry data being sent to the cloud.
3. The Strategic Blind Spot: Governments often treat "car rentals" as a trivial administrative matter, failing to apply the same rigorous security protocols to a rental sedan that they would apply to a military-grade communication device.

Conclusion: A Wake-Up Call for Western Defense

The September 2026 incident in Oslo is a stark reminder that in the 21st century, the definition of a "sensitive site" has expanded to include any location reachable by a connected vehicle. The ability of a rental car to record military access codes is not just a technological glitch; it is a fundamental flaw in the procurement process of modern defense.

As Norway navigates the fallout, the rest of the world—particularly NATO allies—would do well to take note. If the "smart" features of our vehicles are capable of compromising a military exercise, they are equally capable of compromising civilian privacy and critical infrastructure. The lesson from Oslo is clear: until the security of the data flowing from our vehicles is guaranteed, the most advanced car on the road might just be the most dangerous one.

The future of national security may well depend on our ability to "disconnect" the critical, even if that means sacrificing the convenience of the modern, hyper-connected vehicle.