The Norwegian Home Guard soldiers were bored. They started poking through the menus in their rental cars during Exercise Hovedstad and found that the machines had been keeping a diary.
The stored video showed soldiers climbing in and out of the cars and where they drove. It revealed whom they collected and how long they stayed. The footage also showed troops entering codes at military gates and doors. Some of those gates also required keycards, small comfort to any security officer watching his door codes play back on a dashboard.
The first confirmed threat was never Beijing. It was the next renter.
The recordings were deleted after the exercise. Nobody has publicly established whether rental fleets wipe these systems between customers, or what happens when the renter is a tourist who never thinks to check.
Were the soldiers merely the first people curious enough to look?
There is no public evidence that the recordings went to China, and whether the footage ever left the vehicles is unknown. The confirmed reporting is ugly enough without dressing speculation in a trench coat.
The Car Had Been Taking Notes
About 5,000 Home Guard soldiers took part in Exercise Hovedstad from September 14 through 18 around Oslo and Akershus. The mission included securing Oslo’s Gardermoen airport during a wartime scenario and protecting allied reception, the machinery required to receive reinforcements when the horizon gets crowded.
Lt. Fredrik Blanck, who participated in the exercise, told
Dagens Næringsliv that the stored video revealed the soldiers’ movements and pickups. At least two vehicles were Deepals, a brand made by Chinese automaker Changan.
The exact models and recording configurations were not disclosed. A
Deepal S07 manual shows how the system can work: once enabled, its built-in digital video recorder saves exterior-camera footage for playback through the central screen.
The cars came through Hertz Norway, a franchise operated by First Rent A Car Norway. First Rent A Car Norway’s ownership chain ends with China’s Zhejiang Geely Holding Group, which also owns Volvo Cars.
Changan and Geely are separate companies.
Volvo Cars denies that Chinese ownership creates a security risk and says data cannot be shared with Geely without a legal basis. None of it changes what the soldiers discovered inside the cars, waiting behind the glass like a stack of surveillance photographs left on the passenger seat.
A modern rental car is an intelligence-gathering platform wearing cupholders. Before anyone drives it to a gate, somebody needs to know what it records and how to shut the recording down.
Safeguards on Paper, Footage on the Screen
Norway’s military signed the framework rental agreement in 2024. It runs from June 2024 through May 2028 and carries a ceiling of 350 million Norwegian kroner. First Rent A Car Norway is the primary supplier. Call it a procurement story with cameras attached.
In a written answer to parliament, dated September 28, 2026, Defense Minister Tore O. Sandvik said procurement and security officials had assessed the agreement. They knew the ownership structure and judged it irrelevant to how the vehicles would be used. Sandvik said the contract contained protections for data handling. He also said restrictions on sensor-equipped vehicles could be imposed in sensitive areas.
Ten days later, the footage story broke.
The safeguards sat in the contract while rented cameras rolled through a military exercise recording the people the paper was supposed to protect, a bureaucratic scarecrow guarding the field with its pockets full of compliance language as the crows carried away the gate codes.
In September 2024,
reporting on Chinese vehicles at Norwegian bases found no restrictions on their presence, including at Ørland, home to Norway’s F-35s. Two years passed between the warning and the discovery.
Before the incident became public, military spokesman Brage Steinson Wiik-Hansen said in September that Norway maintained no general ban on vehicles made by manufacturers from particular countries. After the story broke, Sandvik acknowledged a real vulnerability and said there was every reason to take precautions.
The ownership chart was the easy part of the question. The operational problems concern default recording settings and fleet-reset procedures. A clause promising careful data handling offers little comfort when soldiers can pull up sensitive footage from the dashboard.
The Law Stays Home
President Donald Trump told the Detroit Economic Club in January that Chinese automakers building American plants and hiring American workers would be “great,” according to
Automotive News. “Let China come in,” he said, a position he repeated during a September 11 interview.
The Commerce Department has already drawn a harder line.
Its connected-vehicle rule bars Chinese- or Russian-controlled manufacturers from selling connected vehicles in the United States beginning with model year 2027, including vehicles assembled here. Covered software prohibitions begin with model year 2027. Hardware restrictions start with model year 2030, or January 1, 2029, for units without a model year. The rule covers passenger vehicles under 10,001 pounds.
Washington’s wall stops at the water’s edge.
The Marine Corps prepositions equipment in Norway. Exercise Hovedstad trained the protection of allied reception, and Americans are among the allies Norway expects to receive. Yet an American service member landing overseas rents what the local counter offers, signs the glowing tablet and drives into a surveillance architecture Washington spent years fencing out at home, because the law stayed behind with the baggage carousel while the mission climbed into the car.
The American taxpayer pays for the wall at home and for the deployments beyond it.
The Motor Pool Came Up Short
The troops kept driving the cars, including onto military property, because the unit lacked enough transportation. No commander loves that decision.
The commander could park the suspect vehicles and strand troops, or keep using them while accepting a risk nobody had properly measured. Procurement had already placed the keys in his hand.
The next reporting questions practically kick the door down. Officials have not said whether the exposed codes were changed or whether vehicle logs were preserved before deletion. Fleet-reset procedures remain undisclosed, and external transmission remains unproven.
Norway’s soldiers found the footage because boredom sent them wandering through a dashboard menu. Had nobody deleted it, the next renter would not have needed a cyber team or Beijing on speed dial.
The keys and a curious finger would have done the job.
