Israeli Military Dumps Chinese Cars
Major Security Risk But Does it Solve the Problem?
Israel is dumping Chinese vehicles it bought for its senior officers and their families, a perk to support career retention in military service. Up to 700 vehicles, most of them manufactured by China’s Chery Automobile Co. Ltd., will be replaced by early 2026.
The Chery cars from China are seen as a significant security risk. Attempts by Israel’s cyber experts to mitigate the vehicle’s vulnerabilities were unsuccessful.
The Israeli decision did not come out of the blue. Scrapping 700 modern cars at a cost of roughly $17 million is not something you do without cause. It is likely that Israel found some of its defense locations compromised and gathered enough intelligence to blame it on the Chery cars.
The Israeli ban follows a ban currently implemented in the United States. At the present time, Chery cars are not sold in the United States. There are no Chinese-branded passenger cars or trucks currently for sale in the United States, though several models built in China are sold here, such as the Lincoln Nautilus and Buick Envision. However, multiple Chinese automakers, including BYD, Nio, and Xpeng, are expected to enter the U.S., focusing on EVs and Hybrids.
All these vehicles will have connectivity back to Chinese-located servers and data aggregators.
The Chery models were purchased by the Israeli army starting in 2022. Most of them are Tiggo 8 Pro commercial vehicles. Such cars are priced around $25,000 in the Middle East, but fleet purchases likely reduce the cost significantly. It is also possible the purchases were tied to trade offsets.
The Tiggo 8 is a modern, advanced technology vehicle with all the bells and whistles one would expect in an SUV-style vehicle. The model was selected because it can seat up to seven passengers. It has all the connectivity that drivers and passengers expect today, including GPS, WIFI, 4G connectivity, Apple and Android support and other convenience electronic features including multiple USB ports, including USB-C, and wireless phone charging.
Some Tiggo 8 models include Advanced Driver Assistance Systems (ADAS). Available features include adaptive cruise control, blind spot detection, and lane-keeping assist and a Surround view camera, a 360-degree camera system often included for improved situational awareness.
There isn’t any information on the features in the Tiggo 8 Pro models bought by Israel’s military.
Modern vehicles can be tracked and pose security risks through several mechanisms including the Global Positioning Systems (GPS) and Telematics. Most modern cars and trucks have built-in GPS receivers and telematics control units (VCS) that transmit location, driving behavior, and vehicle health data. Vehicles that connect to mobile apps or cloud services rely on Application Programming Interfaces (APIs) such as the Chery add to the risk profile. Flaws in these APIs, often managed by third parties, have been found to allow unauthorized access to Personally Identifiable Information (PII) of the owner and real-time and historical location data.
The ability to track the movement of registered vehicles of senior military officers can provide real time information to servers located in China and elsewhere. This means that Chinese intelligence could potentially track army mobilizations and operations, and gain insight into classified locations and installations. The presence of high definition 360 degree cameras on these vehicles, might also reveal information about military exercises, new weapons, and other details (for example locating missile defense installations and command centers).
It is noteworthy that Ukrainian military intelligence has used cell phone tracking to locate some of their enemies in the occupied territories and in Russia itself.
The same vulnerability applies to non-Chinese vehicles, since virtually none of them offers any solid cybersecurity features (such as encryption) to protect data flows. If GM or Stellantis or Hyundai or Toyota (for example) are sending back constant flows of data to their company servers, any or all of them could be hacked by both friendly and hostile intelligence services. One can add that the presence of smartphones inside vehicles provides a separate pathway for hackers, who can track locations, share imagery (including “selfies”) and information on families and business connections and their locations in near real time. This suggests that banning Chinese vehicles removes an easy access capability for a hostile intelligence service, but does not foreclose other hacking opportunities.
At present the only way to protect against unauthorized data risks is by jamming GPS, WIFI and other services. Using jammers may be practical around some military installations, but jammers run the risk of turning everything off. The military, like civilian operations, increasingly rely on public networks (such as cell phone providers), and current-day jammers would close “friendly” services down with potential security risk devices. In today’s military operations commercial networks are increasingly used for data transfers and unclassified communications, and many drone systems depend on local cellular services for their operations.
What is needed but missing today are security safeguards for vehicles and cellular communications. The threat to national security is clear and compelling, and just cleaning out Chinese cars is not enough.
Hey Stephen, How is Prokrovsk holding these days?Last time you mentioned there was barely any progress....
It's really quite humorous. What security-minded country would buy foreign-made, data-equipped cars for its military personnel? But then, how are you going to avoid that vulnerability if your country doesn't manufacture the vehicles - and every electronic component in it - on its own soil? Perhaps we'll see security services revert to steam-driven motorcars.
The same technological capabilities that security services use to spy on their own citizens turns out to be a window into their own operations. There's poetic justice in that.