Rental Cars Used by Norwegian Army Recorded Soldiers, Reports Say
Dashcams in Chinese-made rental cars used by Norway's military reportedly filmed soldiers during an Oslo exercise, raising security questions.
According to TechRadar, dashcams inside rental cars used by the Norwegian army during an exercise in Oslo recorded video without the knowledge of the people using the vehicles. The clips reportedly show soldiers getting in and out of the cars, their movements and locations, and gate codes they typed while facing the camera.
TechRadar's report says the military found the footage and deleted it. Reports cited in the coverage describe the vehicles as Chinese-made, though the details of the make, model, and how the cars were sourced have not been fully set out in the material available to us.
Despite discovering the recordings, the military kept using the rented vehicles for the rest of the exercise. According to the report, the reason was a shortage of alternative cars, which left few options for personnel during the drill.
The account is based on reports and has not, from the information available, been independently confirmed in full. Key questions about what was stored, where, and who could access it remain unanswered in the coverage.
Background
Modern vehicles are increasingly computers on wheels. Many carry cameras, microphones, GPS receivers, cellular modems and software that can be updated remotely. Dashcams, which are often installed by owners to record driving, can also store footage on local memory cards or sync it to cloud services. Those features are useful for insurance claims and accident evidence, but they also mean a vehicle can capture far more than its driver intends.
Governments have grown concerned about this in recent years. Officials in several countries have questioned whether connected vehicles made by foreign manufacturers could collect sensitive data, and some have restricted such equipment in sensitive settings. Analysts often point out that the risk does not depend only on a manufacturer's intentions. Software flaws, weak access controls, default settings that upload data, and third-party components can all expose information.
Militaries face a particular version of this problem. Routine activity in and around vehicles, such as entering a motor pool, moving between sites or typing access codes, can reveal patterns that adversaries value. Security guidance typically asks personnel to keep devices and vehicles separated from sensitive work and to vet equipment before it enters restricted areas.
Rental and fleet vehicles add another layer. Organizations often lease cars quickly during exercises, and the procurement process may focus on cost and availability rather than a full review of onboard electronics. Those gaps can be hard to see until someone inspects the cars, which is one reason security teams treat vehicles as potential sensors rather than simple transport.
Why it matters
The story touches several concerns at once. The first is operational security. If footage captured soldiers' movements and access codes, the exposure is not just a privacy issue for individuals but a risk to the exercise itself and to the places where it took place. Gate codes are the kind of information that should never leave a controlled environment.
The second concern is supply chain trust. Procurement decisions that rely on availability can leave gaps that are difficult to assess after the fact. Even if the recordings were deleted, the question of what else the vehicles collected, transmitted or retained remains open, and it is not something a deletion alone can settle.
The third is public confidence. Citizens expect that armed forces will protect information about their personnel and operations. Revelations of this kind, even when the military responds quickly, can prompt uncomfortable questions about how decisions were made and whether lessons will be applied to future exercises.
The story also reflects a wider shift in how technology enters government. Connected devices are cheap, common and convenient, and they are often designed for consumers rather than for security-sensitive users. The gap between those two environments is where problems tend to appear.
What to watch
Watch for any official statement that clarifies what was recorded, whether footage left the vehicles, and whether any data was transmitted to outside servers. Details about how the cars were sourced, and whether the same models are used elsewhere in the armed forces, would also be important.
Look for guidance changes. Norway and its allies may review rules for rental vehicles, dashcams and connected equipment near military activity. Any new restrictions on electronics in exercises would signal how seriously the issue is being treated.
Finally, watch for independent technical analysis. An examination of the vehicles' hardware and software would help separate what the recordings show from what they might imply, and would clarify whether the risk was an isolated configuration issue or something broader.
Viewpoints
Commentary from our columns: three angles on this story.
The Skeptic open questions and weak points
The headline is striking, but a careful reader should ask what is actually established. The reports say dashcams recorded soldiers and that footage was found and deleted. What remains unclear is how the recording was configured, whether anything left the vehicle, and whether the cars were the source of the risk or simply one of many possible ones. A dashcam that saves video to a card is very different from a car that streams to a remote server, and the coverage does not yet tell us which applies. It is also worth noticing that the story rests on reports rather than a full official account. Good questions deserve patience before anyone draws firm conclusions about where the failure happened or who is responsible. The most useful next step is a clear, verified explanation of the device settings and data paths. Until then, the lesson is less about one country or one brand and more about the need to test assumptions. Security is built on evidence, and right now the evidence is still thin in the places that matter most.
The Rulebook privacy, safety and regulation
Whenever recording devices end up inside sensitive settings, the rules have to catch up with the hardware. Vehicles used for exercises should be checked for cameras, microphones and network connections before they enter restricted areas, and rental contracts should make clear who controls what the car records. Personnel also need straightforward guidance: know what is installed, avoid entering codes near unknown devices, and report anything unusual. Privacy law matters too. Even where footage is deleted, questions about retention, access and the handling of personal images deserve clear answers. Governments should not rely on individual soldiers to spot every surveillance risk. Procedures, audits and written standards are what make security repeatable. The response to this episode should be measured rather than theatrical, but it should result in written rules that apply to every future rental, loan or borrowed vehicle used near sensitive operations. Good policy turns a surprise into a checklist, and a checklist is far more useful than an apology.
The Builder the engineer's view
From an engineering point of view, the interesting question is how a dashcam ends up recording with no one aware of it. Many devices start recording on power-up, store footage on removable media, and may include features that upload clips or sync to an app. Any of those defaults can be harmless in a family car and problematic in a military setting. The fix is not just to remove one product. It is to inspect what a device does: map its inputs, storage and network traffic, and test it in a controlled environment before it is trusted near sensitive work. Teams can also use network isolation, disable unneeded features, and keep vehicles out of areas where codes are entered. Hardware checks matter as much as software reviews. The lesson for builders is that every connected component is a potential sensor, and threat models should treat it that way from the start. Good engineering here is boring: inventory, configuration, testing and a plan for what happens when something unexpected is found.