Chinese-manufactured rental vehicles deployed during a Norwegian military exercise in September 2025 recorded sensitive information — including access codes to secure facilities and the movements of military personnel — according to a report by Norwegian newspaper Dagens Naeringsliv, cited by the South China Morning Post. The findings have reignited global concerns over the data-collection capabilities of internet-connected vehicles used in defence-sensitive environments.

What Happened During the Oslo Airport Exercise

The security exercise took place at Oslo Airport between 14 and 18 September, according to the report. Soldiers waiting inside the rental vehicles reportedly accessed the cars' onboard systems and discovered videos captured by built-in cameras and sensors.

The recordings allegedly showed personnel entering and exiting the vehicles, routes taken during the exercise, and codes used to access military facilities — a significant potential security exposure. The vehicles in question were rental cars supplied by Hertz Norge, with at least two identified as Deepal models manufactured by Chinese state-controlled automaker Changan.

Military Confirmation and Unanswered Questions

Norwegian Home Guard spokesperson Lieutenant Colonel Per Gunnar Grosberghaugen confirmed that soldiers found videos stored within the vehicles' systems. However, authorities said it remains unclear whether any of the recordings were transmitted to third parties or stored on external servers — a critical gap that the report acknowledges remains unresolved.

Notably, despite discovering the recordings mid-exercise, military personnel reportedly continued using the vehicles until the operation concluded because suitable alternatives were unavailable. The stored videos were subsequently deleted.

The Broader Connected-Vehicle Security Concern

The incident spotlights a systemic vulnerability that defence planners worldwide are grappling with. Modern vehicles increasingly rely on cameras, sensors, and software systems that continuously collect and process large volumes of data. Questions about where such data is stored, how long it is retained, and who can access it have grown more urgent as governments and militaries routinely use commercially leased vehicles for logistics and personnel transport.

This is not the first time Chinese-manufactured connected vehicles have drawn scrutiny from Western governments. The United States, United Kingdom, and several European Union member states have separately raised concerns about data flows from Chinese-made cars and telecoms equipment over the past two years.

Norway's Response: Targeted Restrictions, Not a Ban

Norwegian defence authorities indicated they do not currently favour a blanket ban on Chinese-made vehicles, arguing that the potential security benefits may not outweigh the operational challenges of sourcing alternatives at scale.

Instead, officials are reportedly considering site-specific restrictions — prohibiting vehicles equipped with cameras and advanced sensors from accessing particularly sensitive locations, regardless of the country of origin. Critics argue this approach, while pragmatic, may underestimate the risk posed by data that is passively collected before vehicles even reach a restricted perimeter.

As connected-vehicle fleets expand and military-commercial boundaries blur, the Oslo incident is likely to inform new procurement and operational security guidelines across NATO member states.