Key points
- Rental cars used during a military exercise in Oslo stored video footage of soldiers and gate codes without their knowledge.
- Personnel discovered the recordings by chance while browsing vehicle menus and deleted them, but kept using the cars due to shortages.
- The rental operator is linked to a Chinese corporate group, prompting scrutiny from Norway’s counterintelligence service regarding foreign intelligence capacity.
The short version
- Dashcams in rented vehicles captured soldiers entering cars, moving around, and typing security codes during a military exercise.
- Military staff found the stored clips by accident and erased them, but continued using the vehicles because alternative transport was scarce.
- The rental company belongs to a chain ultimately controlled by a Chinese holding group, raising questions about data access and intent.
The details
Rental cars utilized by the Norwegian army during an exercise in Oslo recorded and stored video footage inside the vehicles without the users realizing it, according to reports. The recordings showed military personnel getting into and out of the cars, their specific movements, and their locations. Crucially, the clips also captured soldiers typing gate codes while facing the camera lens. This exposure occurred because the cameras were standard dash cams that soldiers had mistakenly left switched on. Recordings accumulated in the storage systems with no one reviewing the content until the soldiers found the clips by chance while browsing the vehicle menus out of boredom.
Despite discovering the sensitive footage, the military continued to use these vehicles for the remainder of the exercise. This decision was driven by a severe shortage of alternative vehicles available for the operation. The soldiers deleted the recordings after finding them, but the initial exposure had already occurred. The situation highlights a routine security breach where access codes were visible to a recording device, regardless of the vehicle owner's nationality. Gate codes protect restricted areas, meaning anyone with access to those clips could potentially learn how to enter them without authorization.
The context
The sensitivity of the incident increased after it was revealed that the rental operator is part of a corporate chain ending with a company based in China. The armed forces rented the vehicles from First Rent A Car Norway AS, a Hertz-branded operator that supplies cars for daily errands, exercises, and operational missions. Volvo Cars gained complete control of First Rent A Car Norway AS. Approximately 79% of Volvo Cars is controlled by Geely's Swedish holding arm, which is entirely controlled by the China-based Zhejiang Geely Holding Group.
Although the rental firm belongs to Volvo, only two of the vehicles involved are confirmed to be Chinese-made Deepals. The brands of the remaining vehicles are unnamed. Ownership structure alone does not prove intent to spy, but it raises questions about whether Chinese services have the capacity to exploit such access in Norway. Norway’s Police Security Service, the counterintelligence body, states that Chinese intelligence and security agencies now possess greater capacity to run operations inside the country.
What to watch
- Monitor for updates on whether the recorded data was exfiltrated from the vehicles before deletion.
- Watch for changes in rental contracts or security protocols for military and government vehicle fleets.
- Observe how the Norwegian military adjusts its use of foreign-linked suppliers for sensitive operations.
- Note any further statements from the Police Security Service regarding foreign intelligence capabilities.
What it means for organisations
Organisations should review how connected devices in fleet vehicles handle data storage and access. Teams usually need to verify who can view or extract recordings from dashcams and onboard systems. Check whether rental agreements allow the supplier to access vehicle data remotely. Security staff should brief personnel on the risks of displaying sensitive codes or documents near recording lenses. Leadership must assess if current vehicle suppliers pose a supply chain risk, especially if ownership links to foreign entities. Incident response plans should include steps for deleting local data immediately upon discovery of unauthorized recording.
Background: Supply chain attacks
A supply chain attack targets the software or hardware you use before it reaches you. By compromising a trusted vendor, attackers insert malicious code that installs automatically on your systems when you update or deploy the product. This bypasses perimeter defenses because the malicious payload arrives with a valid digital signature.
Read the full guide: Supply Chain Attacks: How Trust Becomes Your Biggest Security Risk
What to do and how to stay safe: First Rent A Car Norway
- Audit all fleet vehicles for recording devices and ensure they are turned off when not needed for safety.
- Train staff to never enter security codes or handle sensitive documents inside vehicles with active cameras.
- Review rental contracts to understand data ownership and access rights for vehicle storage systems.
- Implement a policy to wipe all local storage from rented or shared vehicles before and after use.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Norwegian military stop using the rental cars after finding the recordings?
No, the military continued using the vehicles for the rest of the exercise because it had very few alternative cars available.
Were the vehicles definitely Chinese-made?
Only two vehicles are confirmed as Chinese-made Deepals; the brands of the rest are unnamed, though the rental operator is linked to a Chinese corporate group.
Was there evidence of deliberate espionage?
There was no evidence of deliberate espionage; the cameras were standard dashcams left on by mistake, and soldiers deleted the recordings themselves.
