> ## Content Index > Fetch the complete content index at: https://www.thekadefrequency.com/llms.txt > Use this file to discover other available public pages before exploring further. # Terms and Conditions: Who Holds the Keys to Europe? - URL: https://www.thekadefrequency.com/terms-and-conditions-pegasus-norway-cars-france-fridges/ - Published: 2026-10-18T08:00:52.000Z - Updated: 2026-10-18T08:00:52.000Z - Description: Norway's soldiers practised defending Oslo in cars that were recording them. They kept driving. There were no other cars. - Author: A. Kade - Tags: captured class, europe, Technology, #featured, #deep-dive, #terms-and-conditions **In one week, a Polish spy tool, a Norwegian rental car and a French supermarket fridge told Europe the same thing. The doors were built in. Someone else held the keys, or left them in the lock.** By A. Kade · Sunday 18 October 2026 --- The soldiers kept driving the cars. That's the detail I can't get past. In mid-September, five thousand members of Norway's Home Guard spent four days rehearsing how to defend Oslo in wartime: the parliament, the government buildings, the airport at Gardermoen. It was the biggest Home Guard exercise of the year. The army needed vehicles, so it rented them, the way any large organisation does, from Hertz. Some of those cars were Deepal electric cars, a brand belonging to the Chinese carmaker Changan. Somewhere during the exercise, the soldiers noticed the cars were recording. According to Lieutenant Fredrik Blanck, who was there and spoke to *Dagens Næringsliv*, the footage showed who got in and out, where the cars went, who they picked up and how long they stayed. It also captured the codes the soldiers typed in to open military gates and doors. Nobody had asked for that function, and nobody had told them it was there. And the unit kept using the cars for the rest of the exercise, because there weren't enough other vehicles ([Norway News](https://norwaynews.com/chinese-owned-rental-cars-recorded-norwegian-military-drill/?ref=thekadefrequency.com); [Militarnyi](https://militarnyi.com/en/news/chinese-cars-in-norway-stored-military-exercise-footage-and-access-codes/?ref=thekadefrequency.com)). Hold that image for a moment: a NATO country's soldiers practising the defence of their capital, in cars that are watching them, because there's no alternative. That is not a story about Norway being careless. It's a picture of where all of Europe is sitting right now. ••• **Three countries, one week** **Poland, Monday 12 October.** The National Prosecutor's Office released findings on Pegasus, the spyware the previous Law and Justice government bought in 2017\. It's the tool that can take everything from a phone: messages, calls, photos, location, contacts. It can switch on the microphone and the camera and record in real time. Experts from Poland's own internal security agency found that the Central Anti-Corruption Bureau (CBA), the agency actually running Pegasus, didn't fully control it. It didn't hold the passwords to some administrative accounts. Some parts of the system stayed under the control of NSO Group, the Israeli company that makes it. The module that infects the phones was under the manufacturer's "exclusive control". The harvested data travelled through servers in several countries, on a network NSO managed and the CBA couldn't oversee ([Notes from Poland](https://notesfrompoland.com/2026/10/12/israeli-producer-had-access-to-data-harvested-by-poland-using-pegasus-spyware-say-prosecutors/?ref=thekadefrequency.com)). The targets were hundreds of people. Among them were opposition politicians and independent prosecutors, the head of Donald Tusk's 2019 election campaign, and Tusk's wife and daughter. A parliamentary committee found the CBA never obtained the required IT security accreditation. The courts that signed off on each operation were never told the tool could take the entire contents of a phone. **Norway, the same week.** The rental cars. **France, Monday 12 October.** Hundreds of supermarkets woke up to find their refrigerators had turned into ovens. Overnight, attackers had taken over the systems that regulate temperature and defrost cycles and triggered a forced, continuous defrost with the setpoint at **50°C**. They didn't smash anything. They switched on a function that was already there. According to Public Sénat, around 300 Intermarché and Netto stores were hit, about 80 Carrefour supermarkets, about 90 U stores, about 30 Monoprix, and some E.Leclerc stores too. Shops threw away their fresh and frozen food. There were fires. The Paris prosecutor's office opened an investigation, and nobody has been named as the attacker. The controllers involved were made by **Danfoss**, a Danish company whose systems are everywhere in French retail. Danfoss says most of the affected units were old products that no longer receive security updates. A French security firm, Synacktiv, says it found the flaw during an audit back in **2023** and reported it to Danfoss. The management pages were reachable from the internet because retailers had set them up that way "for practical reasons." "Even if the password is strong," its expert said, the login "is easily bypassed." He also said his team had found another exposed system about two weeks before the attack. The head of France's national cybersecurity agency, ANSSI, said it was "urgent" to take these systems off the internet ([Public Sénat](https://www.publicsenat.fr/actualites/politique/cyberattaque-contre-des-frigos-connectes-de-supermarches-des-systemes-de-refrigeration-exposes-sur-internet-alertent-des-experts-en-cybersecurite?ref=thekadefrequency.com); [IT-Connect](https://www.it-connect.fr/cyberattaque-supermarches-froid-danfoss/?ref=thekadefrequency.com)). That makes three countries and three kinds of object: a phone, a car and a fridge. Behind them are an Israeli spyware firm, a Chinese carmaker and a Danish refrigeration company. They differ in nationality, purpose and threat, and they share one thing. **Someone else held the keys.** ••• **The door was already there** That's what makes this week different from the usual cyber story. When we picture a hack, we picture a break-in: a stranger in a hoodie forcing a lock. None of these stories really works like that. In Poland, the Polish state bought the tool, installed it and pointed it at Polish citizens. Its maker kept control of key parts of the system as part of the arrangement. That wasn't a breach. It was how the product worked. In Norway, nobody hacked the cars. They did what they were built to do: sense, record and store. A modern car, Norway's National Security Authority warned last year, can contain more than two hundred electronic sensors. Whether any of that footage ever left the vehicles, nobody knows. The recordings were reportedly deleted after the exercise, and it's unclear if they were stored only in the car. Volvo, which owns Hertz Norway and is itself owned by China's Geely, says no data can be shared with Geely "without a legal basis." Read that sentence twice. It doesn't say no data left the car. It says what would have to be true for data to be shared. Under China's national intelligence law, organisations are required to support state intelligence work, so "a legal basis" is not as reassuring as it sounds. In France, the attackers didn't need a new weapon. The fridges had a door built in for remote management. Retailers had left that door facing the internet, on old machines that no longer got security fixes. The flaw that bypassed the lock had been reported three years earlier. Someone did break in, but through a door that had been left open since 2023. Europe keeps preparing for someone to break down the door. This week showed we've been handing out keys. ••• **It isn't new, and that's the worst part** None of this came without warning. In November 2025, Ruter, Oslo's public transport operator, took a brand-new Chinese-made Yutong electric bus into an underground mine, where outside signals couldn't reach it, and tested what the manufacturer could do remotely. The answer: Yutong could reach the bus's control systems for software updates and diagnostics. "In theory," Ruter said, "this could be exploited to affect the bus." The older Dutch-built buses it tested couldn't receive over-the-air updates at all ([SCMP / AP](https://www.scmp.com/news/world/europe/article/3331691/concern-norway-after-test-shows-chinese-made-buses-can-be-disabled-remotely?ref=thekadefrequency.com)). Ruter tightened its requirements. Then the same country's army rented Chinese cars for its biggest exercise of the year. In May 2025, Reuters reported that US officials had found undocumented communication devices inside Chinese-made solar inverters, the boxes that connect solar panels to the grid. Nobody knew exactly what they were for. In the Netherlands, questions went to parliament about whether a "kill switch" could exist inside the equipment that now feeds a large share of Europe's electricity ([Zonnefabriek](https://www.zonnefabriek.nl/en/knowledge-center/new-concerns-about-chinese-inverters-due-to-possible-hacking/?ref=thekadefrequency.com)). Israel's military banned Chinese-made vehicles from its bases in August 2025\. Norway's own Police Security Service said in its 2026 threat assessment that Chinese intelligence activity in the country had expanded. So the warnings came from the bus operator, the grid engineers, the security services and the military of another country. The information was public. The response was a framework agreement worth up to 350 million Norwegian kroner with rental suppliers, and soldiers in watching cars because there weren't enough other ones. ••• **The case for calm, at full strength** The people who'll call this alarmist deserve a fair hearing, because they're right about several things. **Remote access exists for good reasons.** It's why your car gets a safety fix overnight without a trip to the garage, and why a supermarket chain can adjust a thousand fridges without sending a thousand technicians. It's also why a hospital's equipment gets a security patch the week a vulnerability is found, not six months later. A world with no remote access would be slower, more expensive and, in many ways, *less* secure. **Nothing is proven about intent.** The Norwegian footage may never have left the cars. NSO had *technical* access to Polish data, and the prosecutors explicitly did not establish that it took material from specific operations. The French attack has no named culprit. Anyone who tells you "China stole Norway's defence secrets" or "Israel read Tusk's daughter's messages" is claiming more than the evidence shows. **This isn't simply about foreigners.** The Pegasus targets were chosen by Poland's *own* government. The fridge controllers came from a company in Denmark, inside the EU. Buying European doesn't make you safe, and banning Chinese products doesn't patch an old Danish fridge controller left facing the internet. **And Europe can't just stop.** We don't make most of the batteries, inverters, chips or cheap electric cars we're buying. Ripping them out would cost a fortune and slow the energy transition. All of that is true, and none of it answers the question. ••• **Who holds the keys** Here's the question this week puts to every government in Europe, and to every one of us with a phone in our pocket: **When you buy something, do you own it, or do you just get to use it while someone else keeps the keys?** For most of history that was a stupid question. When you bought a car, the car was yours. A fridge was a box that kept things cold. A state that bought a surveillance tool controlled it, for better or worse. That isn't true any more. The things we buy now arrive with a door built in for the maker, the contractor, the "service provider", the update server in a country we've never seen. They come with terms and conditions nobody reads, and the most important clause, *who else can get in*, usually isn't written down at all. The question isn't whether a product is Chinese, Israeli or Danish. It is: 1. **Who can reach it after you've bought it?** 2. **Were you told?** 3. **Can you switch that access off and still use the thing?** In Poland, the answers were: the maker; not fully, the courts weren't told what it could do; and no, parts of it never belonged to Poland. In Norway, nobody yet knows who could reach the cars. The soldiers weren't told, and they kept driving because there was no other car. In France, the answer was anyone who found the page. The stores weren't told the old units had stopped getting fixes, or didn't act on it. The door could have been closed, ANSSI says, by taking the systems off the internet, and nobody closed it in three years. Three times in one week, the answers were *someone else*, *no* and *no*. ••• **Sovereignty with a software licence** For thirty years, Europe has argued about sovereignty as if it were a matter of borders and budgets. Who controls migration, who sets interest rates, who can veto what in Brussels. Whole elections have been won and lost on the word. Meanwhile [sovereignty has been quietly leaving through a different exit](https://www.thekadefrequency.com/the-ratchet-how-every-crisis-becomes-permanent-cost/): [the fine print of procurement contracts](https://www.thekadefrequency.com/solidairement-casseurs-payeurs-loi-lyceens/), the maintenance port and the update server. A country that can't say who has access to the phones of its opposition leaders isn't fully sovereign, whatever its constitution says. Nor is one that rents watching cars for its army because it has no others. And when someone can heat ten thousand fridges to 50°C from a keyboard, food security turns out to be a lot more fragile than anyone thought. Europe does have tools. The EU's Cyber Resilience Act, adopted in 2024, will require manufacturers of connected products to meet security requirements and report actively exploited vulnerabilities. Its reporting obligations began this autumn, and the full rules apply from December 2027\. It will also require security updates for a product's expected lifetime, which goes straight to France's problem of old fridges nobody was patching. It's a start. But it is mostly about *defects*, about products that are badly made or abandoned. Poland and Norway were about products that worked exactly as designed, with the door open for the people who designed them. So here is what a serious answer would look like. It wouldn't be a panic or a ban list. It would be a rule as plain as a seatbelt law: **Anything bought by a European state for security, infrastructure or public services must state, in writing, who can reach it remotely, from where, and how to switch it off. And it must still work when that access is switched off.** That's not protectionism, and it doesn't care where the factory is. It applies to the Chinese car, the Israeli spyware and the Danish fridge equally. It just insists that when Europe buys something, Europe gets the keys. ••• **The passenger seat** I keep coming back to Lieutenant Blanck and his unit. They weren't careless. They noticed. They reported it. And then they kept driving, because the exercise had to go on and the cars were what they had. They did their job inside a system that hadn't given them any other choice. That's most of us. We know the phone listens and the car records. We've read about the fridges, the buses and the inverters. We keep using them anyway, because there's no other phone, no other car and no other way to run a supermarket chain in 2026. That isn't a personal failing. It's a political one. Individuals can't negotiate the terms and conditions of the world; governments can. They can write procurement rules, demand the keys and refuse to buy the door. This week, three European governments found out what it costs when they don't. We spent years preparing for tanks at the border. The spy was in the passenger seat, and we signed the rental agreement. ••• [***A. Kade***](https://www.thekadefrequency.com/about/) *writes* [***The Kade Frequency***](https://www.thekadefrequency.com/)*, an investigative publication on institutional power, financial capture, and the long project of making democracy something real.* *No sponsors. No filters. No propaganda.* ••• *Sources and references* - Notes from Poland, ["Israeli producer had access to data harvested by Poland using Pegasus spyware, say prosecutors"](https://notesfrompoland.com/2026/10/12/israeli-producer-had-access-to-data-harvested-by-poland-using-pegasus-spyware-say-prosecutors/?ref=thekadefrequency.com), 12 October 2026 - Norway News, ["Chinese-owned rental cars recorded Norwegian military drill" ](https://norwaynews.com/chinese-owned-rental-cars-recorded-norwegian-military-drill/?ref=thekadefrequency.com)(citing *Dagens Næringsliv* and VG) - Militarnyi, ["Chinese Cars in Norway Stored Military Exercise Footage and Access Codes"](https://militarnyi.com/en/news/chinese-cars-in-norway-stored-military-exercise-footage-and-access-codes/?ref=thekadefrequency.com), 12 October 2026 - Public Sénat, ["Cyberattaque contre des frigos connectés de supermarchés : des systèmes de réfrigération exposés sur internet, alertent des experts en cybersécurité"](https://www.publicsenat.fr/actualites/politique/cyberattaque-contre-des-frigos-connectes-de-supermarches-des-systemes-de-refrigeration-exposes-sur-internet-alertent-des-experts-en-cybersecurite?ref=thekadefrequency.com) - [IT-Connect,](https://www.it-connect.fr/cyberattaque-supermarches-froid-danfoss/?ref=thekadefrequency.com) on the Danfoss controllers - Aston Institut, ["Cyberattaque contre les frigos des supermarchés du 12 octobre 2026"](https://www.aston-institut.com/cyberattaque-frigos-supermarches-12-octobre-2026/?ref=thekadefrequency.com) (citing AFP and BFMTV) - Boursorama / Reuters,[ "Des réfrigérateurs de centaines de supermarchés déréglés par une cyberattaque"](https://www.boursorama.com/actualite-economique/actualites/france-des-refrigerateurs-de-centaines-de-supermarches-deregles-par-une-cyberattaque-aa227efdd150921f52bf52fc945408a0?ref=thekadefrequency.com), 12 October 2026 - SCMP / Associated Press, ["Concern in Norway after test shows Chinese-made buses can be disabled remotely"](https://www.scmp.com/news/world/europe/article/3331691/concern-norway-after-test-shows-chinese-made-buses-can-be-disabled-remotely?ref=thekadefrequency.com), 6 November 2025 - [Zonnefabriek](https://www.zonnefabriek.nl/en/knowledge-center/new-concerns-about-chinese-inverters-due-to-possible-hacking/?ref=thekadefrequency.com), on Reuters' May 2025 report of undocumented communication devices in Chinese inverters By the same author ### Two books in restrained literary nonfiction A. Kade's companion volumes, a meditation on thinking and character, and a meditation on love, real and imagined. [View the books →](https://www.thekadefrequency.com/books/)