Chinese-Made Rental Cars Secretly Stored Video Footage During Norwegian Military Drills

Automakers market modern connected vehicles as smartphones on wheels designed for driver convenience, but the Norwegian Armed Forces recently discovered these same systems function as rolling surveillance platforms. During a major military exercise, soldiers found that their rented Chinese-made cars had automatically recorded their movements and security codes.[1][4]

The discovery occurred during Exercise Hovedstad in September 2026, when the Norwegian Home Guard rented vehicles from Hertz Norway to support operations around Oslo. The exercise involved approximately 5,000 reservists tasked with protecting key infrastructure, including government buildings and the Oslo airport at Gardermoen.[1][4]

While sitting in the vehicles during downtime, soldiers tapping on the infotainment screens stumbled across stored video files. The footage, captured by the vehicles' built-in 360-degree dashcams, showed personnel entering and exiting the cars, their transit routes, and the exact access codes they typed into military gates.[4][5]

At least two of the vehicles involved were Deepal electric cars, manufactured by the Chinese state-controlled automaker Changan Automobile. The Norwegian military had procured the fleet under a multi-year, 350 million krone ($32.8 million) framework agreement with First Rent A Car Norway AS, which operates the Hertz brand locally.[1][4]

First Rent A Car Norway AS is fully owned by Volvo Cars, which in turn is majority-owned by China's Zhejiang Geely Holding Group. Geely retains an approximate 78.6 percent controlling stake in Volvo Cars, creating a direct ownership link between the rental fleet used by the Norwegian military and Chinese automotive conglomerates.[1][4]

"Yes, soldiers from the Home Guard found videos from the vehicles' sensors stored in their systems," confirmed Lieutenant Colonel Per Gunnar Grosberghaugen, a spokesperson for the Norwegian Home Guard. The soldiers deleted the footage upon discovery, but the incident has sparked a broader debate about operational security.[5]

The OpSec Failure

The incident highlights a significant gap in military operational security regarding civilian technology. Modern vehicles are equipped with dozens of cameras, microphones, and sensors that collect environmental data by default, yet the military procured and deployed them without disabling these features.[1][3]

Despite discovering the active recordings, the Norwegian military continued using the Deepal vehicles until the end of the exercise. Officials cited a lack of alternative rental cars as the reason for keeping the surveillance-capable vehicles in active deployment around sensitive sites.[5]

"Those rental cars had dashcams – as cars do – that the soldiers mistakenly kept on," noted one cyber professional reacting to the news. The Deepal models, like many modern electric vehicles, utilize their external camera arrays for parking assistance and continuous dashcam loop recording.[3]

There is currently no evidence that the recorded footage was transmitted to external servers or shared with Chinese intelligence agencies. The videos were stored locally on the vehicles' internal systems, which the soldiers were able to access and manually delete through the standard user interface.[4][5]

However, the incident has prompted questions in the Norwegian parliament regarding procurement protocols. Opposition politician Himanshu Gulati formally asked Defense Minister Tore Onshuus Sandvik whether sufficient security assessments were carried out before allowing the connected vehicles onto military facilities.[4]

The Connected Car Dilemma

The Norwegian National Security Authority previously warned in its Risiko 2025 assessment that a modern car can contain more than 200 electronic sensors. If external actors gain access to this telemetry, they can track movements, map secure facilities, and gather intelligence on military operations.[1]

Volvo Cars has firmly rejected the suggestion that Chinese ownership inherently represents a security risk. The company maintains that no personal data related to rentals is shared with Geely or other third parties without explicit legal grounds.[4]

Hertz Norway also defended its data practices, stating that it complies with all Norwegian and European data protection regulations. However, the rental company did not specify whether the onboard videos could have been transferred to cloud servers before the soldiers deleted the local copies.[5]

The Norwegian Armed Forces currently do not have a blanket ban on vehicles manufactured in specific countries. Instead, military leadership stated they prefer implementing security procedures tailored to individual sites, which could include local bans on camera-equipped vehicles regardless of their origin.[4][5]

This approach contrasts with previous incidents involving Chinese-made transportation in Norway. In 2025, tests conducted for Oslo's public transport authority, Ruter, revealed that Chinese manufacturer Yutong could theoretically use over-the-air updates to remotely immobilize its electric buses, raising concerns about critical infrastructure reliance.[1]

A Broader Military Pattern

Norway is not the only nation grappling with the security implications of connected vehicles. In August 2025, the Israel Defense Forces banned Chinese-made vehicles from entering military bases as a precautionary measure to prevent sensitive information collection.[1]

Similarly, the German Armed Forces restricted the use of personal smart devices for personnel handling classified information, citing espionage threats from foreign intelligence services. The integration of civilian technology into military operations continues to outpace the development of adequate security protocols.[1][5]

In the United States, lawmakers have introduced legislation targeting Chinese vehicles, software, and critical components over similar surveillance concerns. The Connected Vehicle Security Act aims to keep foreign-manufactured sensor platforms away from sensitive government and military installations.[3]

The Norwegian military's 350 million krone framework agreement for rental vehicles remains active following the September exercise. It remains unclear whether the logistics organization will revise its procurement standards to require the physical disabling of sensors on rented fleet vehicles.[1]

The incident serves as a practical demonstration of how consumer technology defaults clash with military requirements. As automakers continue to add standard surveillance features for driver assistance, military personnel will need to treat every rented vehicle as an active sensor node.[1][3]