Technological security and data protection were “central priorities” in the development of the specifications for the public procurement procedure for 35 buses for Braga Urban Transport (TUB) from the Chinese manufacturer Yutong.
In a statement, the municipality says that the tender establishes “strict rules that prevent any form of unauthorized remote access to the vehicles and guarantees that all information extracted from them is the exclusive property of the contracting entity, including data collected through the black box.”
“Furthermore, the contract establishes the obligation to comply with legislation relating to data protection, namely the General Data Protection Regulation (GDPR), and limits the onboard technology to what is strictly necessary for operation, namely communication systems, CCTV, passenger information and diagnostics, mostly supplied by European and national companies,” it adds.
At Monday’s executive meeting, councilman Rui Rocha, from the Liberal Initiative party, raised the issue, citing international news reports that raise doubts about alleged cybersecurity flaws associated with vehicles from that manufacturer.
He recalled that the matter has already generated concern in Norway and Denmark, and that these countries are already taking measures to “isolate the information” transmitted by the buses in question.
The buses in question are electric buses from the Chinese manufacturer Yutong, which will be equipped with a SIM card that allows the manufacturer to remotely access the buses’ systems.
Today, Mayor João Rodrigues met with the TUB (Urban Transport Company of Brasília) administration to find out what is happening.
In the statement, the municipality and TUB clarify that currently there are no Yutong vehicles in circulation in the municipality.
They add that the public tender launched in February 2025, with a contract signed in August, is in the contractual execution phase and foresees the phased supply of 35 buses, with the first delivery scheduled for the end of this year.
