Norway Keeps Using Chinese-Linked Rental Cars After Finding They Recorded Military Gate Codes
Dashcams in vehicles rented by the Norwegian military captured footage of soldiers entering secure areas and typing gate codes during exercises in Oslo.
Key points
- Rental cars used by the Norwegian army stored video of troops and security codes without detection.
- Soldiers discovered the footage by chance and deleted it, but continued using the vehicles due to shortages.
- The rental operator is part of a corporate chain ultimately controlled by a Chinese holding group.
Standard dashcams installed in rental vehicles used by the Norwegian armed forces recorded and stored video footage of military personnel during exercises in Oslo. The recordings captured soldiers entering and exiting vehicles, their movements, and instances where they typed security codes while facing the camera. Military staff discovered these files by chance while browsing vehicle menus and subsequently erased them.
Root cause
The recordings accumulated because soldiers had mistakenly left the dashcams switched on. No one reviewed the footage as it was being captured, allowing clips of sensitive activities to build up inside the vehicles. The discovery occurred only when bored personnel explored the vehicle’s menu system, revealing the stored data.
Attack path
Although there is no evidence of deliberate espionage or active exploitation, the stored footage presented a significant security risk. Anyone with physical access to the vehicles could have retrieved the clips. The videos showed gate codes typed by troops, which could allow unauthorized entry into restricted areas if the data were accessed by hostile actors.
Affected versions
Only two vehicles are confirmed to be Chinese-made Deepals. The rental operator, First Rent A Car Norway AS, supplies a mix of brands for daily errands and missions. The specific software versions of the dashcams or vehicle systems are not detailed in reports, but the hardware capability to record and store local video was the primary factor.
Mitigation
- Delete all locally stored video footage from dashcams before and after military use.
- Physically cover or disable dashcams when entering secure areas or handling sensitive codes.
- Audit rental vehicle inventory to identify models with persistent local storage capabilities.
- Brief personnel on the risks of unmonitored recording devices in operational contexts.
