# Chinese Rental Cars Filmed Norwegian Troops

> Rental cars used in a Norwegian military exercise filmed soldiers, routes and gate codes. What happened, what is proven, and why connected cars are a risk.

By Marcus · October 19, 2026 · 17 min read · Threats

Source: https://bluwarden.com/blog/chinese-rental-cars-norway-military

---

In mid-September about 5,000 soldiers from Norway's Home Guard spent a week rehearsing how to defend Oslo in a crisis: the parliament, the government quarter and, towards the end of the week, Oslo Airport. Partway through, some of them noticed that the rental cars they were driving had been filming them. The stored video showed who got in and out, where the cars went, who they picked up and how long they stopped. It also showed the codes soldiers typed in to open military gates.

At least two of the cars involved were made by Deepal, a brand of China's state-owned carmaker Changan. All of them were rented from the company that runs Hertz in Norway, which sits, through Volvo Cars, inside China's Geely group. The business daily Dagens Næringsliv (DN) broke the story on 8 October. On 16 October Norway's defence minister confirmed to parliament that the cars had recorded, that the soldiers found it themselves, and that no specific risk assessment of using Chinese rental cars had been made for the exercise.

Nothing published so far shows that the footage left the cars, and nothing shows that it didn't. What the reporting describes is not a hidden spy device but a recording feature the soldiers did not know was running, doing exactly what it was built to do in a place nobody had thought about it. Below: what happened, what is verified, why it matters even if no footage ever reached China, what other countries have done, and what organisations and ordinary drivers should take from it.

## What happened during Exercise Hovedstad

Norway's Armed Forces rent part of their vehicle fleet. Since June 2024 the main supplier under a framework agreement worth up to NOK 350 million has been First Rent A Car Norway, which runs the Hertz brand in the country and is ultimately owned by Geely. The cars are used for everyday driving, for exercises and in operations.

- **14-18 September:** Exercise Hovedstad, the [year's largest Home Guard exercise](https://www.asker.kommune.no/aktuelt/heimevernet-over-i-vart-omrade/), put nearly 5,000 soldiers from the Oslo and Akershus district on the streets. They [secured sites including the Storting and the government quarter](https://www.tu.no/nyhetsstudio/tusenvis-av-soldater-inntar-oslos-gater/131622) before the exercise moved out towards Gardermoen, Oslo's main airport.
- **During the exercise:** soldiers taking part in the defence of Oslo Airport noticed that their rental cars had been storing video. Short of other vehicles, the unit kept using the cars until the exercise ended.
- **20 September:** [DN reported](https://www.dn.no/forsvar-og-sikkerhet/forsvarets-leiebiler-er-kina-eid-brukes-til-ovelser-og-operativ-virksomhet/2-1-2045817) that the Armed Forces' rental cars come from a Geely-owned supplier and are used in exercises and operations.
- **28 September:** in a written answer to parliament, [summarised by The Deep Dive](https://thedeepdive.ca/norwegian-lawmakers-demand-answers-over-chinese-cars-recording-soldiers/), the defence minister said procurement and security staff knew about the Chinese ownership when the contract was assessed, but judged that it did not affect how the cars were used, so it was not made part of the requirements.
- **1 October:** DN reported that other security-sensitive state bodies, including the Norwegian Defence Estates Agency and the Norwegian Defence Research Establishment, are [big customers of the same firm](https://www.dn.no/forsvar-og-sikkerhet/sikkerhetskritiske-statlige-virksomheter-er-storkunder-bruker-kina-eide-leiebiler-for-millioner/2-1-2050850).
- **8 October:** [DN published the story](https://www.dn.no/forsvar-og-sikkerhet/kinesisk-eide-leiebiler-filmet-hemmelig-ovelse-lagret-video-av-soldater-og-koder/2-1-2050958), with Lieutenant Fredrik Blanck, who took part in the exercise, on the record and two further sources confirming. [NRK](https://www.nrk.no/artikkel/kinesiskeide-leiebiler-filmet-forsvarsovelse-1529792), [Aftenposten](https://www.aftenposten.no/norge/i/d74gXX/kinesiskeide-leiebiler-filmet-hemmelig-forsvarsoevelse) and others followed. MPs Himanshu Gulati of the Progress Party and Mahmoud Farahmand filed written questions the same day.
- **16 October:** Defence Minister Tore O. Sandvik [answered Gulati](https://www.stortinget.no/no/Saker-og-publikasjoner/Sporsmal/Skriftlige-sporsmal-og-svar/Skriftlig-sporsmal/?qnid=127634) in writing. His answer is covered below.

## What the cars recorded

According to Blanck, the footage showed who got into and out of the cars, where they drove, who they picked up and how long they spent at each stop. At some gates soldiers pass with a key card plus a code, and those codes were visible in the recordings. He told DN he fears the footage could give foreign actors a detailed picture of military operations, adding, as [Finansavisen reported](https://www.finansavisen.no/motor/2026/10/08/8386234/kinesiske-leiebiler-filmet-norske-soldater-og-militaere-koder): "We don't have an overview of where this ends up."

Norwegian reporting has not named the model or the exact feature. Gulati's question to parliament describes a recording function that stores video of activity around the car. As an example of what these cars can do, spec listings for the Deepal S07 include a [built-in DVR and a "sentinel mode"](https://data.carnewschina.com/database/deepal/deepal-s07/2023/620km-160kw-0-4875) that watches the car while it is parked, and Australian listings for the same model show [front and interior event-recording cameras](https://www.carsales.com.au/research/deepal/s07/2025/no-badge). In other words, factory-fitted cameras facing out of the car and into it. One expert quoted by [Cybernews](https://cybernews.com/security/norway-military-chinese-cars-excercise-footage/) summed the incident up as dashcams the soldiers had mistakenly left switched on.

The detail that matters most is where the recordings sat: on the car itself, where the soldiers could browse them. So could anyone else.

## What is verified and what isn't

| Claim | Status (19 October) | Basis |
|---|---|---|
| Rental cars stored video of soldiers, routes, passengers and gate codes | **Confirmed** | A lieutenant on the record and two further sources (DN); the defence minister confirmed recordings were made and deleted |
| At least two of the cars were Deepals | **Reported** | DN; the minister's answer does not name brands |
| The rental firm is ultimately owned by Geely | **Reported, not disputed** | DN; Volvo Cars disputes that the ownership is a risk, not the ownership itself |
| Footage left the cars, or reached the maker, Geely or Chinese authorities | **No evidence either way** | Recordings were deleted from the cars; nobody has said whether copies existed anywhere else |
| The rental cars were risk-assessed before the exercise | **No** | The minister says the exercise threat assessment covered digital threats, but there was no specific assessment of Chinese rental cars |
| Norway will ban Chinese-made cars from military areas | **Not now** | The minister says a general ban is not appropriate at present; local bans on vehicles with modern sensors and cameras remain possible |

Sandvik's answer is more candid than most official statements. He wrote that the risk of sensors collecting information applies to all modern vehicles, including delivery vans and the private cars of defence staff, and to phones and smartwatches. Units already restrict the use of modern electronics, and several have decided that staff must park private cars outside camp. Before the exercise a threat assessment was written and circulated as usual, covering digital threats and the need to keep the digital footprint small. But because baseline protection was already in place, nobody assessed the Chinese rental cars specifically. When the soldiers found the recordings they reported them straight away, the footage was deleted and the rental company was asked for a complete list of the cars used in the exercise. Filming of exercises is unwanted, he wrote, but hard to avoid completely with today's technology, and the fact that soldiers spotted it themselves shows the kind of awareness the Armed Forces need.

Volvo Cars, for its part, rejects the idea that Chinese ownership is a security risk and says no data can be shared with Geely without a legal basis.

So the honest answer to the question in every headline, whether the cars spied on the military, is that nobody has shown they did and nobody can show they didn't. Deleting the recordings closed the most obvious hole, the next person to open the menu. It cannot tell anyone whether copies existed elsewhere. Answering that takes testing, of the kind Oslo's public transport operator did on Chinese buses last year.

## Why it's a risk even if nothing left the car

### 1) Anyone who opens the menu can watch it

Rental cars change hands constantly. Footage stored on the car is available to whoever sits in it next: the next renter, staff cleaning or servicing it, a workshop, or a thief. The soldiers found the recordings simply by looking, and anyone else can do the same. The US Federal Trade Commission has warned since 2016 that [rental cars keep personal data](https://www.consumer.ftc.gov/blog/what-your-phone-telling-your-rental-car) from paired phones, such as call logs, contacts and messages, along with places visited, where future renters and rental staff can see it.

A gate code on that screen was compromised the moment it was recorded, whatever did or didn't happen in the cloud. The minister's answer lists the deleted recordings and the request for a list of cars; it does not say whether the codes were changed.

### 2) The car talks to its maker

Most new cars are permanently online. They report location and vehicle data, receive over-the-air software updates and can be reached remotely for diagnostics. Whether any of these Deepals sent camera footage anywhere has not been reported, and some designs keep video entirely on the car. The only way to know is to test.

That is what Ruter, Oslo's public transport operator, did in 2025 with electric buses from the Chinese maker Yutong. It drove them into underground mines to cut off outside signals and studied what they did. The [tests found](https://fortune.com/2025/11/06/chinese-buses-norway-remote-control) that the manufacturer had direct digital access to every bus for software updates and diagnostics, and could reach the battery and power systems over the mobile network, which in theory could be used to stop a bus. The buses' cameras, on the other hand, were not connected to the internet at all. Ruter knew both things only because it checked, and it tightened its controls as a result.

### 3) Who could be made to hand data over

Two different Chinese links are easy to blur. The rental firm's ultimate owner is Geely, a privately owned group whose founder, Li Shufu, sits on China's top political advisory body, and Volvo's assurance is about Volvo sharing data with Geely. The cars that did the recording, though, were Deepals, made by Changan. In 2025 Changan became a [centrally run state-owned enterprise](https://www.electrive.com/2025/07/29/china-changan-promoted-to-state-owned-enterprise), spun out of its former parent, [China South Industries Group](https://www.chinaservicesinfo.com/s/202506/06/WS6842bb93498eec7e1f7392a5/changan-automobile-to-restructure-as-independent-central-soe.html), a state-owned weapons and military equipment maker. Volvo's statement says nothing about what a Deepal's own software and servers do.

Then there is the law. China's National Intelligence Law, in force since 2017, requires in [Article 7](https://www.chinalawtranslate.com/en/national-intelligence-law/) that organisations and citizens support, assist and cooperate with state intelligence work. Legal scholars [disagree about how far that reaches in practice](https://www.chinalawtranslate.com/en/what-the-national-intelligence-law-says-and-why-it-doesnt-matter/), and a law on the books is not evidence that anything was ever requested. What it does mean is that a Chinese carmaker's promise not to share data is one a foreign customer has no way to check.

### 4) One clip is trivia, a fleet is a map

A single video of a soldier at a gate tells you very little. A week of footage from a pool of cars used across an exercise tells you routes, timings, where units gather, who travels with whom, how long they stay and how the gates are opened. That is pattern-of-life intelligence: the raw material for planning disruption in a real crisis, which is exactly what Exercise Hovedstad was rehearsing for. When Israel began withdrawing Chinese cars from its officers last year, an Israeli analyst [told the Times of Israel](https://timesofisrael.com/idf-swerves-away-from-chinese-cars-driven-by-worries-of-spies-lurking-in-everyday-tech) much the same thing: knowing where senior officers are at any given moment is intelligence gold.

None of this is new to military security. In 2018 a global heatmap published by the fitness app Strava turned out to [outline military bases and the routes soldiers ran inside them](https://www.npr.org/sections/thetwo-way/2018/01/29/581597949/pentagon-reviews-gps-data-after-soldiers-strava-tracks-are-seemingly-exposed), simply because personnel were logging their runs. Nobody hacked anything then either.

## It isn't only Chinese cars

The minister opened his answer with this point, and he is right. Sensors that can collect information sit in every modern vehicle, as well as in phones and smartwatches. On 30 September the Dutch security service AIVD published a notice titled "The modern car as a possible spy", telling officials, executives and anyone else handling sensitive information not to hold confidential conversations in or near any modern car, partly because microphones fitted for voice control and emergency calls can technically be switched on remotely. It [named no country or brand](https://thedeepdive.ca/mi5-and-dutch-intelligence-raise-separate-chinese-espionage-alarms-on-the-same-day/). Poland's rules, below, cover any car that can record position, images or sound unless those functions are turned off. And China itself [barred Tesla cars](https://www.aljazeera.com/economy/2021/3/19/chinas-military-bans-tesla-cars-on-camera-sensor-spy-concerns) from military complexes in 2021 over what their cameras could see.

Country of origin changes who might be compelled to hand data over. It doesn't change whether the car can record. A ban on Chinese cars would have kept these particular Deepals away from the gates. It would not have stopped another brand's dashcam filming the same keypad, and that footage would have been just as visible to the next renter.

## What other countries have done

| Who | What | When |
|---|---|---|
| China | [Barred Tesla cars](https://www.aljazeera.com/economy/2021/3/19/chinas-military-bans-tesla-cars-on-camera-sensor-spy-concerns) from military complexes and housing compounds over camera concerns | March 2021 |
| United States | [Final rule](https://www.bis.gov/press-release/commerce-finalizes-rule-secure-connected-vehicle-supply-chains-foreign-adversary-threats) barring Chinese- and Russian-linked connected-car technology, with the software ban applying from model year 2027 | January 2025 |
| Israel | Chinese cars barred from bases, then about 700 Chinese-made cars ordered [withdrawn from officers](https://www.israelhayom.com/2025/11/02/idf-orders-removal-of-chinese-cars-over-espionage-fears) by the end of March 2026 | 2025 |
| Poland | Chinese-made cars [barred from protected military sites](https://www.helpnetsecurity.com/2026/02/19/poland-military-chinese-car-ban/), official phones kept off their infotainment systems, and other cars admitted only with recording functions off | February 2026 |
| Netherlands | AIVD advice not to hold confidential conversations in or near any modern car | September 2026 |
| Norway | No general ban; local bans on vehicles with modern sensors and cameras possible | October 2026 |

Norway is not ignoring the wider question. Its transport ministry [opened a consultation](https://www.regjeringen.no/no/aktuelt/horing-om-risikoreduserende-tiltak-i-bussanskaffelser/id3170855/) in August on limiting the share of public transport buses that come from countries Norway has no security-policy cooperation with. For the Armed Forces' own vehicles and sites, though, the line for now is local judgement rather than a rule.

## What organisations should do

None of this is specific to armed forces. Any organisation with sites, codes or people whose movements matter, from a data centre to an energy supplier to a head office, has the same exposure whenever a connected car comes through the gate.

### 1) Change any code a camera has seen

Treat a code typed in front of a camera you don't control as public. Change it, and make changing codes after exercises, events and contractor visits routine. Don't rely on a code alone where it matters: with a card plus a PIN, as some of the Norwegian gates used, a filmed code is not enough on its own. Shield keypads so the digits can't be read from a car window, consider keypads that scramble the digit layout, and don't reuse the same code across sites.

### 2) Check what vehicles can record, not only who owns them

Norway's procurement looked at who owned the rental firm and judged that it did not affect how the cars were used. What the cars could record is the part nobody has said was checked, and procurement authorities have [declined to disclose](https://thedeepdive.ca/norwegian-lawmakers-demand-answers-over-chinese-cars-recording-soldiers/) what the contract requires on cameras, sensors, remote access or data storage. For any vehicle that enters a sensitive site, whether rented, leased, pooled or privately owned, know what it has: a dashcam or DVR, a sentry or sentinel mode, interior cameras, microphones, a mobile connection. Rental and lease contracts can require recording to be switched off at handover and stored data to be wiped at return, a list of exactly which vehicles were supplied, and a clear statement of where telematics data goes and who can reach the car remotely.

### 3) Decide where vehicles may go

Distance is the simplest control. Several Norwegian units already make staff park private cars outside camp, and Poland now admits cars with recording devices to protected sites only when those functions are switched off. Decide where vehicles with cameras may park, and keep them away from entrances, keypads and anywhere sensitive conversations happen.

### 4) Make checking the car part of the routine

The control that worked in Oslo was a few soldiers who looked at a screen. Turn that into a habit: before a vehicle is used for sensitive work, someone checks for stored footage and recording settings, switches recording off and knows who to tell if they find something. Keep work phones off vehicle systems; Poland now forbids connecting official phones to the infotainment of Chinese-made cars, and the AIVD suggests going through a USB data blocker rather than connecting a phone directly. And keep confidential conversations out of cars.

### 5) Apply the same thinking to everything with a sensor

Cars are one case of a broader problem that also covers phones, smartwatches, fitness trackers, doorbell cameras and anything else that records images or reports location. As with most real security failures, nothing exotic happened in Oslo. It was the [ordinary kind of failure](/blog/what-actually-breaks-company-security-2026), where a useful feature nobody thought about ends up exposing something that matters. List what can see and hear your sensitive places, and decide what is allowed there.

## What to do in a rental car, or your own

You don't need to guard a military gate for this to apply. A rental car, a car-sharing car or a company pool car may be recording, and it will remember your phone.

- **Look before you drive.** Check the settings for anything called DVR, dashcam, sentry, sentinel or guard mode, see whether any footage is stored, and switch recording off if you don't want it.
- **Charge, don't pair.** The FTC suggests charging from a 12-volt socket adapter rather than the car's USB port, which can sync data automatically. If you do connect, allow only what you need: music does not need your contacts.
- **Wipe it before you hand it back.** Delete your phone from the list of paired devices, clear the navigation history and saved addresses, and delete any stored clips if the system lets you.
- **Keep your home address out of it.** Navigate with your phone rather than typing your home address into a car someone else will drive next. The AIVD gives similar advice for any car.
- **Shield keypads.** Front doors, alarms, garages and cash machines: assume a dashcam or doorbell camera may be pointed at your fingers.
- **Check your own car too.** Review the manufacturer's app, its location history and any cabin camera or voice features, and check what your phone shares with the car through Android Auto or CarPlay. Our [Android](/blog/android-standard-security-hardening) and [iPhone](/blog/ios-standard-security-hardening) guides cover app permissions. A car's location history maps your home, your work and your routine, the same raw material covered in our guide to [avoiding getting doxxed](/blog/how-to-avoid-getting-doxxed).

## Summary

1. **What happened:** in Norway's largest Home Guard exercise of the year, rental cars, at least two of them Chinese-made Deepals, stored video of soldiers, their routes, their passengers and the codes they typed at military gates.
2. **What is proven:** the recordings existed and were deleted. No public evidence shows footage left the cars, and nothing rules it out.
3. **Why it matters:** the next person in the car could watch it, a filmed gate code is compromised either way, connected cars stay reachable by their makers, and a Chinese carmaker's promise not to share data can't be checked from outside.
4. **Not only Chinese cars:** nearly every new car can record. Country of origin decides who could be compelled to hand data over, not whether the car records.
5. **Organisations:** change codes a camera has seen, check what vehicles can record as well as who owns them, control where they park, make checking the car routine, and keep work phones and sensitive talk out of vehicles.
6. **Everyone:** in a rental car, check for recording, charge rather than pair, and wipe your phone and navigation history before you return it.

*Running sites where it matters who comes and goes, or sending staff out in rented and leased cars? [Get in touch](/#contact) - bluwarden can help you work out what your vehicles, devices and suppliers can see, and build it into your staff security awareness. See [what our services cover](/blog/cybersecurity-services-what-they-are).*

*This article reflects public reporting and parliamentary records as of 19 October 2026. Whether any footage was transmitted has not been established, and details may change.*