China could use its electric cars to attack the West

“Beijing could remotely stop electric cars manufactured in China on UK roads” sounds like the stuff of dystopian nightmares, but this is the real world in March 2024.

MPs have been warned that EVs could be jammed remotely should UK-China relations deteriorate significantly.

But this shouldn’t come as a shock. Electric cars, for all the praise they may receive from politicians eager to burnish their green credentials, have become a sinister threat to the West.

Consider how, just last year, warnings were issued that Chinese tracking devices had been found embedded in the electronics of Downing Street vehicles. At the time, Sir Richard Dearlove, the former head of MI6, warned Chinese EVs could become the “next Huawei”. 

It all felt like something you might expect to read in a le Carre thriller updated for the digital age.

If this story were a spy novel, the device would have been planted by a daring mole within the government system.

But this is the age of the Internet of Things (IoT), and yet another proof of what can be done simply by saturating your target country with products that contain a digital Trojan horse.

This is now the signature weapon of the Chinese party state – industrial-scale cyber espionage capabilities weaponised through normal export trade.

And that means that we could all soon be in the firing line, not just early adopters in the EV revolution.

‘Smart’ technology, which is spreading rapidly through the brave new  IoT, makes use of an interactive component called a ‘cellular IoT module’ or CIM.

These are currently used in all electric vehicles (EVs), but also in smart energy meters, some cameras, speaker and heating systems and even doorbells.

The essence of CIMs is that they collect various types of data, according to the  type of equipment they are installed in. They then share it with other parts of an internet-connected network, from which they in turn can receive data.

Unless this is expressly disabled , e.g. by a user password, CIMs are also continuously connected to their original manufacturers, which may use them to conduct remote repairs and updates.

The risk from CIMs thus becomes obvious. Not only cyber attackers, but also the originators of the CIM can use it to gain access to the data from the device.  A single compromised device somewhere in the wider network can also be used for cyber attacks on other parts of the network.

The only real defence against this risk, in the everyday IoT, is to buy  smart equipment from reliable sources which set out to protect security.  

In April 2023, the US House of Representatives passed a bill to protect US Embassy data from compromise by telecoms equipment sourced from Chinese companies deemed to be ‘untrusted foreign entities’.

Over the last five years, a growing number of Western governments have accepted that China seeks to drain data from targets of state interest using conventional equipment as well as incessant streams of sophisticated cyber attacks.

By degrees, some US allies and partners have begun to strip suspect equipment out of their 4G and 5G structures, in a complex and costly attempt to close the stable door.

But to date, there has been much less attention paid to the increasingly ubiquitous CIM. Many governments, save for their security services,  still  don’t know what the acronym stands for.

For all of us – given that we might be thinking of buying a cheap and trendy Chinese EV, ‘a device to control our hot water and heating at home or numerous other innocuous-sounding and useful applications – a red flag needs to be hoisted.