My understanding, based on stuff apparently not in this article, is the concerns are multifold, and to be honestly, I'm not sure all are entirely unfounded, if far-stretched.
One of the concerns (and I think overall the US is taking the threat far too lightly in general) is that meta data that can be collected from these cars. My understanding is part of their design includes sending back telemetry to the manufacturer to track possible failures and the like. This is becoming VERY common in all areas of transit. For example, newer Boeing and Airbus planes can detect pending faults (
"I've just picked up a fault in the AE-35 unit. It is going to go 100 percent failure within 72 hours.") and can forward data to the manufacturer and/or airline that can have the replacement part available upon landing. I believe similar data is now available with modern locomotives.
Now, this doesn't sound very nefarious, but, there's real concerns that a bad actor can use such meta data to track usage patterns and start to develop models based on that. This sounds far-fetched, but reportedly newspapers in the DC area have previously monitored pizza deliveries to the WH to track when people were working late and big news items were soon pending.
This is the simple level. There's also growing evidence that more and more electronic devices built in China may have the ability (and in a few cases may actually be doing) sending back data to destinations we're not aware of and this is hard baked into the device.
Yes, I realize this rises to the level of conspiracy theories, but, I've seen enough various stories out there (and know enough about how some of this works) that I think the US would very quickly find itself in a bad place if a full-fledged cyber-war broke out.
(btw, for those who aren't familiar with it, read up on the
Stuxnet virus. I recall reading about it BEFORE it was activated and antivirus authors were bewildered by who wrote it and why, since it didn't seem to do anything obvious at first.
We live in a new world.
Check out
QuiCR, Quick, Crowdsourced Responses for businesses.