In Canada, at least for now, Big Brother isn’t watching every move you make. We all know that our smartphones are collecting location and other data, but with password protection and a little tweaking, most of us feel safe using our devices.
But what about the super computer in your garage? Behind the wheel, it’s nothing but you, the open road — and your car quietly recording your every move.
Did you know that modern vehicles don’t just have one computer? There are multiple, interconnected brains that can generate up to 25 gigabytes of data per hour from sensors all over the car. In fact, electronics are responsible for 40 percent of a new car’s total cost, according to a Deloitte analysis. That’s up from 18 percent in 2000.
In the 2021 model year, most new cars sold in Canada will come with built-in Internet connections (this independent cellular service is often included free or sold as an add-on), including 100 percent of Fords, GMs and BMWs and all but one model of Toyota and Volkswagen.
Cars are becoming smartphones on wheels, sending and receiving data from apps, insurance firms and pretty much wherever their makers want. Some brands even reserve the right to use the data to track you down if you don’t pay your bills.
When you buy a car, you probably assume the data you produce is owned by you — or at least is controlled by you. But many automakers do not. They act like how and where we drive, also known as telematics, isn’t personal information.
“I hear a lot of analogies of cars being smartphones on wheels. But that’s vastly reductive,” said Andrea Amico, founder of Privacy4Cars, which makes a free app that helps people delete their data from automobiles and makes its money by offering the service to rental companies and dealerships. “If you think about the amount of sensors in a car, the smartphone is a toy. A car has GPS, an accelerometer, a camera. A car will know how much you weigh. Most people don’t realize this is happening.”
In recent years, law enforcement investigators have also come to realize that automobiles — particularly newer models — can be treasure troves of digital evidence.
Their onboard computers generate and store data that can be used to reconstruct where a vehicle has been and what its passengers were doing. They reveal everything from location, speed and acceleration to when doors were opened and closed, whether texts and calls were made while the cellphone was plugged into the infotainment system, as well as voice commands and web histories.
But that boon for forensic investigators creates fear for privacy activists, who warn that the lack of information security baked into vehicles’ computers poses a risk to consumers and who call for safeguards to be put in place.
Law enforcement agencies have been focusing their investigative efforts on two main information sources: the telematics system — which is like the “black box” — and the infotainment system. The telematics system stores a vehicle’s turn-by-turn navigation, speed, acceleration and deceleration information, as well as more granular clues, such as when and where the lights were switched on, the doors were opened, seat belts were put on and airbags were deployed.
The infotainment system records recent destinations, call logs, contact lists, text messages, emails, pictures, videos, web histories, voice commands and social media feeds. It can also keep track of the phones that have been connected to the vehicle via USB cable or Bluetooth, as well as all the apps installed on the device.
Together, the data allows investigators to reconstruct a vehicle’s journey and paint a picture of driver and passenger behavior. In a criminal case, the sequence of doors opening and seat belts being inserted could help show that a suspect had an accomplice.
“I’m sure everyone is aware of how much forensic data is on the smartphone,” said Lam Nguyen, director of the Defense Cyber Crime Center, a federal forensic laboratory and training center. “What people don’t realize is a lot of that is being transmitted to a car just because you register the phone with the car.”
But compared with the security on smartphones, the security on the systems is much flimsier, digital forensic and privacy experts say. Drivers typically don’t have to unlock a vehicle’s infotainment system with a passcode or a fingerprint, as they do with smartphones. That means that, with a warrant, law enforcement officials can sometimes extract incriminating text messages, calls or files from an automobile far more easily than they could from a suspect’s cellphone.
It’s not just the criminals among us who should be concerned.
As automobiles become more automated, with self-parking and other “smart” features, they need more sophisticated sensors and computers, which means autos of the future will collect even more data, digital forensic and privacy experts say. Several technology companies and automakers, such as Volvo and Bosch, have developed driver-facing cameras to detect whether the driver is paying attention to the road. While the features are designed for safety, they could also be a rich source of potential evidence: video from inside the car.
“We are moving in a direction where more sensors and cameras will be required inside the car for driver or occupant monitoring and on the outside for automated vehicles,” said Chelsey Colbert, policy counsel at the Future of Privacy Forum, a data privacy think tank. “Car manufacturers need to focus on privacy by design.”
What’s the worry? Industry insiders say that many automakers haven’t totally figured out what to do with the growing amounts of driving data we generate. But that’s hardly stopping them from collecting it.
Until automakers put even a fraction of the effort they put into TV commercials into giving us control over our data, I’d be wary about using in-vehicle apps or signing up for additional data services. At least smartphone apps like Google Maps let you turn off and delete location history.
If you’re buying a new vehicle, tell the dealer you want to know about connected services — and how to turn them off. Few offer an Internet “kill switch,” but they may at least allow you turn off location tracking.