Do Chinese carmakers pose a surveillance threat?

A British parliamentary committee has urged the government to bar high-risk Chinese connected technology from critical national infrastructure and tighten oversight of the data that connected vehicles send overseas. The proposals form part of a broader plan for managing the UK’s economic relationship with China. In a report published on 2 November, the House of Commons Business, Innovation, Science and Trade Committee urged the British government to work with telecoms operators to monitor and regulate data traffic between connected vehicles and foreign entities, starting with government, defence and emergency services. It also called for connected equipment from high-risk jurisdictions to be excluded from critical national infrastructure in the UK.

This security threat is even more pertinent when it comes to vehicles, particularly electric vehicles. Navigation systems, cameras, sensors and diagnostic software can record where a vehicle goes, how it is driven and when it needs servicing. Some of that data is sent to manufacturers or service providers, who use it to monitor performance, manage fleets and deliver connected features. For the first time in history, vehicles are being viewed as large, mobile data centers rather than modes of transportation.

More from Business

If that information is collected without proper safeguards or accessed by someone without authorisation, it can reveal more than the details of individual journeys. A vehicle’s location history can show which facilities a public agency visits, when its personnel come and go, or how an emergency service deploys its fleet. From January to October 2026, Chinese marques and SAIC-owned MG accounted for 337,730 new car registrations in the UK, or 17.9 per cent of the market, based on the Society of Motor Manufacturers and Traders’ figures. MG led with 86,767 registrations, followed by BYD at 74,470. The concerns appear at a time when India’s own market for Chinese EV brands continues to grow substantially with Chery sub-brands like Jetour and other EV marques like BYD’s Denza and Stellantis’ Leapmotor prepare to enter the market soon, bringing with them fresh concerns regarding surveillance and remote immobilisation which the public evidence suggests the capability is real while evidence of intent is nonexistent.

What is a kill switch?

A kill switch is a mechanism designed to disable a vehicle by interrupting a function it needs to run. In a connected car, it can take the form of a software command sent over a mobile network to the vehicle’s onboard computers. Depending on how the system is designed, that command could prevent a parked car from starting again, limit the power it can deliver while moving, or cut propulsion altogether. Preventing a restart leaves the driver stranded after stopping, while cutting propulsion in motion takes away the ability to accelerate and leaves the vehicle coasting.

Should India be concerned?

The public evidence reviewed so far gives Indian regulators grounds to test whether connected EVs can be immobilised remotely. It offers no verified case of a Chinese manufacturer deliberately disabling a customer’s EV in India, or evidence that a manufacturer intends to do so. The strongest technical finding concerns a Yutong electric bus tested in Norway. The manufacturer could remotely reach its battery and power management systems for diagnostics and software updates. The operator concluded that this access could theoretically render the bus inoperable, but its published findings describe no shutdown in motion. British MPs are concerned that a Chinese supplier could be compelled by its government to use access it already holds. Whether that access exists depends on the model, the software and the market where the vehicle is sold

Immobilisation is also a crucial anti-theft feature offered by manufacturers, many of whom offer remote diagnostics as a way to fix bugs on the go without necessitating the need to drive over to a service centre. In India, Hyundai’s Bluelink allows owners of the 2026 Ioniq 5 to immobilise the car remotely when it is connected to the network. Owners can activate the feature while parked, and once immobilised, the car cannot be restarted even with its original key.

India’s road transport ministry published draft rules in June covering vehicle cybersecurity and software updates under AIS-189 and AIS-190. Public fleet tenders could use those requirements as a starting point and ask suppliers to demonstrate who can approve updates, whether a local operator can delay them, and what data leaves the vehicle. Those answers would tell an Indian bus operator whether it can still dispatch its fleet if a supplier’s servers are compromised or become unavailable.