Chinese rental cars reportedly filmed Norwegian soldiers and military access codes

OSLO, NORWAY – Norwegian soldiers discovered that Chinese Deepal cars had stored video recordings of them during a military exercise in September. The footage also reportedly captured codes used to open military gates and doors, according to Norwegian business newspaper Dagens Næringsliv (DN).

The Norwegian Armed Forces rented the vehicles through Hertz Norway for use by the Home Guard, Norway’s territorial defence force. The discovery raises questions about the use of civilian vehicles equipped with cameras and internet connections around military facilities.

Lieutenant Fredrik Blanck, who took part in the exercise, told DN that soldiers found the recordings in the cars’ systems. The footage showed who entered and left the vehicles, where they travelled, whom they picked up and how long they stayed at different locations. Two anonymous sources corroborated the account to the newspaper.

At least two vehicles were reportedly Deepal cars. According to DN, the recordings were deleted from the vehicles after the exercise. Whether the information was also transmitted or stored elsewhere remains unclear.

Two separate links to Chinese companies

Both the rental operator and the vehicle manufacturer have Chinese ownership connections, through separate corporate groups.

Hertz Norway is operated by First Rent A Car Norway, whose ownership chain runs through Volvo Cars to China’s Geely group. The Norwegian military signed its rental agreement in 2024.

Deepal belongs to carmaker Changan, part of a Chinese state-controlled group. In July 2025, China’s state assets regulator, SASAC, announced the establishment of China Changan Automobile Group, with SASAC exercising ownership responsibilities on behalf of the state.

Volvo Cars told DN that Chinese ownership posed no security risk and that sharing data with Geely required a legal basis. Establishing what the Deepal vehicles collected and transmitted during the exercise requires separate evidence from the manufacturer and the vehicles themselves.

Manual describes recording and data transmission

Changan’s Norwegian owner’s manual for the Deepal S07 provides an insight into the vehicle’s recording capabilities. Its cameras can record video in front of, behind and on both sides of the car. The system can also record cabin audio and vehicle information, including speed and time.

According to the manual, continuous video recording and cabin audio recording are disabled by default at startup. Recording must be activated manually. The precise Deepal model and software version used by the military remain unconfirmed, leaving the circumstances in which recording began unresolved.

The same manual describes electronic systems that register journey information, speed, direction of travel and location. Driving data is transmitted periodically and wirelessly to Changan Auto, according to the manufacturer.

This establishes that the model has systems for sending information to the manufacturer. Whether footage or access codes from the exercise were transmitted remains unconfirmed.

Navigation can leave a separate data trail

The navigation service can also record vehicle movements. Telenav, a navigation provider for Changan vehicles, states in its privacy policy that connected navigation can store GPS positions, destinations, previous routes and journey start times.

The information can be stored locally or in the company’s cloud database. Telenav identifies servers in Frankfurt, Germany, for connected services used by European customers. Whether this service was active during the military exercise remains unclear.

Deleting local camera recordings therefore addresses only one part of the data handling. An examination of the incident would also need to establish which connected services the cars used and what information those services received.

Authorities had considered the risk before the exercise

Norway’s National Security Authority, known as NSM, had already described the potential use of modern vehicles for eavesdropping, surveillance and tracking in its Risk 2025 report. It identified cameras, microphones and network connections as possible sources of sensitive information.

Nearly 5,000 Home Guard soldiers trained in Oslo and the surrounding area during Exercise Hovedstad, or Exercise Capital, from September 14 to 18. Their tasks included movement, command and the protection of essential public services and infrastructure.

Defence Minister Tore Onshuus Sandvik told the Storting, Norway’s parliament, on September 28 that the rental agreement had been based on a risk assessment prepared by the military’s security department and the Norwegian Defence Materiel Agency. The ownership structure was known, and the agreement included requirements intended to protect sensitive information.

Following DN’s report, Himanshu Gulati of the Progress Party asked whether security measures had prevented the cars from capturing military information. Mahmoud Farahmand of the Conservative Party requested details of the vulnerabilities identified and the precautions taken before the vehicles were rented. He also asked where else the defence sector had used Chinese-made cars. Both parliamentary questions were awaiting the defence minister’s response on October 10.