Security recall: The risk of Chinese electric vehicles in Europe

At last September’s German auto fair, the new Chinese electric vehicles on display impressed the crowds. Their quality was respectable, even for German car snobs, with the models coming across as playful and fun, yet functional. Importantly, these new cars are cheap in comparison to Tesla or their European counterparts, such as Renault and BMW, with comparable vehicles coming in at 20 per cent more expensive. The names are yet to be widely known, but the array assembled by BYD, Nio, or Dongfeng was a sign that imports would shoot up. The fact that BYD – instead of Volkswagen, as previously – is announced as the main sponsor and mobility partner of this year’s European men’s football championship, hosted in Germany, is a striking symbol of changes to come.

The economic challenge to European competitors is real, but equally crucial are the fundamentally new risks associated with this new generation of cars: these are among the most deeply integrated forms of consumer electronics that exist. Chinese brands are leading the way – and pose serious security issues which the European Union and member state governments must quickly address.

This time is different

One could argue that Europeans should be grateful for nicely subsidised Chinese cars, which could allow Europe to transition to low-carbon mobility faster and cheaper; that they should embrace newcomers in an old market; and that German automakers should pay the price for clinging onto combustion engine-fuelled dreams of eternal engineering superiority. Some observers compare their arrival with the rise of Japanese and Korean manufacturers in the 1970s and note that competition was not the worst thing that happened to the industry.

These are valid points, but they overlook the speed of the Chinese models’ roll-out, the scale of the challenge once European drivers adopt them in large numbers, and the ultimate geopolitical implications of Chinese electric vehicles’ presence on the roads of Europe.

These are not just cars, and indeed modern cars are not intended to be. They are supposed to be platforms for mobility that engage in a constant flow of communication, entertainment, and data sharing. To varying degrees of sophistication, new cars today are already collecting data to train artificial intelligence for automated driving. Inside the vehicle, driver and passenger behaviour is monitored; outside, sensors track and trace the surroundings to teach software to, for example, distinguish between a plastic bag blowing on to the street and a child dashing out between parked vehicles. The future of cars will be electric, autonomous, and highly networked.

Who controls these data flows and software updates is a far from trivial question, the answers to which encroach on matters of national security, cybersecurity, and individual privacy. For these reasons, policymakers have to treat these new vehicles differently from cars as we once knew them. It is concerning that they are yet to fully do so.

5G redux and the question of trust

The European Commission has made a start with its announcement that it is looking into “the cybersecurity aspects of connected and automated vehicles – including Electric Vehicles” as a matter of priority. It is planning a risk assessment of these electric vehicles as part of this effort. Some China watchers and parliamentarians in Europe have also begun to raise similar questions. But a broader debate is still lacking, one that would encompass consumer protection issues, the risk of targeted surveillance, and the possibilities of large-scale espionage through car microphones, cameras, and sensors.

As they contemplate the problem, EU policymakers and member state governments – which retain competencies over security matters – should recall their experience of deciding whether Chinese vendors should be part of the 5G rollout. Underpinning that dilemma was the challenge of authoritarian state capitalism embedding itself deeply into the backbone of communication infrastructure in Western markets. Eventually, European decision-makers concluded that trust – or their lack of it in the Chinese offering – should be a determining factor. While previously, such issues had been absent or overlooked, the trust question has become a key feature for the relationship between China and Europe.

The challenge with electric vehicles falls squarely within this realm: any connected product that is subject to software updates from the vendor can be hard to control. It is likely impossible to introduce regulation that fully addresses the risks that arise from this relationship. Its success would ultimately depend on European authorities’ capacity to verify companies’ adherence to the rules. In the case of 5G, the conclusion in many EU member states as well as in the United States, the United Kingdom, Australia, and Japan was that the presence of Chinese vendors in network infrastructure was not beneficial enough to warrant the risk that it posed. These states went on to impose limits and bans on Chinese companies’ role. Yet, the decisions around 5G should not really have been that tricky (even if some member states, Germany included, are still struggling to implement them): no public backlash was likely to come from choosing European companies with a similar, if not higher-quality, product over Chinese ones in a sector mostly invisible to individual consumers. Experience from other member states now also shows that excluding Chinese providers did not push up prices for consumers or delay the rollout in the countries that imposed such limits.

In contrast, the nature of electric vehicles means this next question is going to be much more difficult – the price and availability factors are highly sensitive, the climate argument will feel compelling to policymakers and consumers alike, and the quality of Chinese cars is not only on a par with their competitors, but often exceeds it. To start to address this, the European Union and member states need to buy time for decision-makers to think – and to plan what rules to introduce.

Regulate before they arrive

Should European public servants be allowed to drive Chinese electric vehicles? What about members of parliament, judges, the police, or emergency doctors? Should these cars be allowed to drive anywhere in Europe? Ought they to be curtailed near military installations, NATO bases, or other critical infrastructure? (The Chinese government, acutely aware of the security risks posed, already applies similar restrictions to Teslas.) How many electric vehicles would theoretically be needed per square kilometre for Chinese agencies to assemble a full intelligence picture in the future? Is data upload to be allowed to happen in real time or only with a time delay? How can regulation distinguish between features that enable the car to communicate with the producer for the security of the vehicle’s operations and the transmission of other data? Policymakers need to ask these questions now, and not once European consumers have already bought the cars – it will then be too late to regulate.

For the time being, Chinese electric vehicles still play a more marginal role in the overall European car market. But this is changing fast. With 5G, time was less of a factor, as those responsible for installing the kit were operators such as Deutsche Telekom, Telefonica, and Vodafone – a limited number of players for governments to interact with. But cars are bought by individual citizens, companies, rental agencies, and communities. To allow for maximum consumer protection and full transparency, the EU and member state governments should ensure regulation is in place across the entire single market as soon as possible.

At the member state level, decision-makers need to find the right balance between mitigating uncontrollable security risks and maintaining European openness to electric vehicles from non-EU countries to help decarbonise the transport sector. Enhanced competition in the European market between European and non-European (but non-Chinese) manufacturers will be key to driving down prices and widening consumer choice.

To begin with, the European Commission and member state governments can slow the wave of Chinese electric vehicles arriving in Europe by immediately revising technical requirements, and drawing up enhanced transparency rules on data storage and transfer. This could potentially take place through stronger enforcement of the General Data Protection Regulation in cases of unlawful processing, excessive collection, and questions of anonymity and the security of personal data.

Next, and just as in the case of 5G, policymakers should oblige manufacturers to prove that Chinese state authorities are not able to interfere in data processing, instead of asking European regulators to prove that malign behaviour has taken place.

For its part, the European Commission, after consulting with the EU’s cybersecurity agency and Network and Information Systems Cooperation Group, should move forward quickly with its planned risk assessment. At the same time, it should take steps to make it easier for trusted vendors to sell their electric vehicles in Europe and create incentives for European manufacturers to produce within the EU. Shoring up European car companies’ viability will not only enhance their economic competitiveness, it will also boost the long-term availability of non-Chinese market players in a fierce global market. Other sectors have shown that the presence of Chinese companies does not enhance, but ultimately eliminates, competition, creating dependencies that exacerbate the security problem.

The dual threat that Chinese electric vehicles pose to Europe’s competitiveness and security may be what is finally needed for a real debate about trust and industrial capacity as the EU works to digitalise and decarbonise its economy under conditions of system rivalry. A mere anti-subsidy probe is not going to solve the issue. Europeans will fundamentally have to work out whether they trust Chinese companies to drive the digital and green transition. And if they do not, they need to decide what to do about it – and fast.

The author would like to thank Adam Harrison for his patience in editing this commentary and Byford Tsang for the pithy title suggestion.