Cars Are Delivering Tons Of Driving Data To Manufacturers With Minimal Security And Even Less Transparency

from the introducing-the-2015-Lexus-CI dept

Thu, Feb 19th 2015 12:23pm — Tim Cushing

Nothing's driving the acquisition of data faster than, well, driving. As new technology makes its way into vehicles, so does the apparent desire to harvest information about the vehicle itself. Between the outside harvesting (automatic plate readers that gather plate/location data, as well as photos of vehicle occupants) and the "inside" transmissions, there's very little any number of unknown entities won't know about a person's driving habits. And that's not even including what's transmitted and collected by drivers' omnipresent smartphones and their installed apps.

Sen. Edward Markey has expressed some alarm at the amount of data being collected (and distributed) by vehicle manufacturers. His office has produced a report [pdf link] showing that while many manufacturers are involved in collecting data, very few of them seem concerned about the attendant risks. Even worse, many respondents to his office's questionnaire seem to show very little understanding of the underlying technology and most have not made an effort to fully inform customers as to how much is being collected or how it's being distributed.

Drivers of today's connected cars aren't going to like the report's findings.

Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.

While some basic security measures have been implemented, the fact remains that transmitting data always poses a risk. Three of the 14 manufacturers that responded to Markey's questions had actually let their security measures stagnate or decrease from 2013 to 2014, even as the amount of data transmitted rose. Worse, many of the respondents deployed security measures in a "haphazard and inconsistent" fashion, and nearly all respondents seemed unable to fully process the questions posed by Markey's office.

Of the 16 automobile manufacturers that responded to the letter, 13 of them addressed these questions in some way. Chrysler, Mercedes-Benz, and Mazda did not respond to the question at all, and five other manufacturers provided general responses that addressed the question as a whole instead of providing specific responses to the questions’ sub-parts.

[...]

Seven of the manufacturers stated that they use third-party testing to verify their security measures, while 5 stated that they do not and 4 did not respond to this part of the question.

[...]

The manufacturers were also asked about how they secure this type of software delivery [updates/patches]. Each manufacturer responded with descriptions of how they provide such software through authorized dealers with the appropriate tools. Automobile security experts consulted by Senator Markey’s staff said that all of the responses are similar in that they presume a malicious actor could not access or acquire the technologies that mechanics have. They state that software updates for systems should be cryptographically verified by the ECU being updated in order to effectively prevent intrusions.

These four-wheeled tracking devices are collecting and transmitting tons of data, including GPS location, sudden accelerations/decelerations, seatbelt usage, destinations entered into navigation systems, last location parked, distance and time traveled and a variety of information on other driving components. Almost all of this is transmitted back to the manufacturer for their own use.

Nearly 100% of 2014 vehicles record and transmit driving history. Most of these manufacturers could not provide a satisfactory answer as to how they secure this data during transmission and more than half store this information "off-board" at their own data centers. Manufacturers seem to consider "on-board" collections as inherently secure.

In the case of on-board storage, no manufacturer described any security system to protect that data, and several of them noted that no security measure is needed since accessing data would require a hardwire connection.

But that doesn't mean they treat wireless transmissions with much more care.

Regarding security measures to protect data that is wirelessly transmitted outside the vehicle, only 6 responses were received. Of those, 5 provided vague responses naming encryption, passwords, or general IT security practices, and only 1 specifically mentioned that they designed their systems to limit the transfer of personally identifiable information.

Part of this is due to the fact that automakers' security measures are purely voluntariy at this point. But the fact that it would likely take a federal mandate to improve security is disappointing. Not only are manufacturers less than forthcoming about how much data they're collecting, but they're apparently uninterested in providing a minimal level of customer service, i.e., proactively assuring these data transmissions are secure.

As for the data harvesting itself, manufacturers can't seem to find a better justification for this than "improving the customer experience" -- a phrase pretty much synonymous with "selling customers more stuff" or "collecting for collecting's sake." Most manufacturers retain this data for one to ten years, with only one manufacturer offering the option for users to delete their data at any time. But that single nod to customer agency is far outweighed by the general indifference shown by the rest.

Markey's report finds that purchasers may be allowed to "opt out" of certain collections, but this often comes at the expense of certain functions. No manufacturer presents this information up front, preferring to hide it in owner's manuals and terms of service agreements. The default should be "opt-in," with upfront explanations of what, how and why data is collected. But that would lead to a dearth of information, and automakers, like many other private companies, prefer to gather data first and deal with the fallout later.

Although it goes unmentioned in Markey's report, there's also the question of how this data is handled when the government comes looking for it. Most of what's collected would presumably fall under the Third Party Doctrine (with drivers "knowingly" turning this information over because of page 173 in the owner's manual, etc.), which means it can be acquired by law enforcement/intelligence agencies with minimal effort/paperwork. There are also other government intrusions that need to be considered as well, like California's desire to tie state-enforced emission standards to driving information already gathered by a number of manufacturers. Not only are manufacturers not guarding against having their collections hijacked by criminals, they seem equally unconcerned about safeguarding this vast amount of data from the government itself.

2015 02 06 MarkeyReport Tracking Hacking CarSecurity 2 (PDF)2015 02 06 MarkeyReport Tracking Hacking CarSecurity 2 (Text)

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cars, data, privacy, smart cars, transparency

34 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Coward, 19 Feb 2015 @ 1:04pm

It's not exactly voluntary. If you want to get a decent price on car insurance, you must install these transmitters to the car's electonics service port (and never remove them -- or get a nasty letter) so you basically give up all privacy to "Big Brother" -- and you can bet that these complete driving logs will be accessible to anyone on demand.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 1:23pm

Re:
What are you talking about? I have two cars covered by insurance and neither have any kind of transmitter installed. I've never been asked to install one by an insurance agent.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 1:26pm

How is this data being collected?
This article makes it sound like car manufacturers are collected data from every driver on a massive scale, but how are they capable of doing that? By my understanding, that would require equipping every car with a cellular antenna and some kind of data plan. To my knowledge, none of my cars are thusly equipped.
[ link to this | view in thread ]
RadioactiveSmurf (profile), 19 Feb 2015 @ 1:27pm

I only know progressive to do this. It's still voluntary but can reduce your car insurance bill. It's not something I would ever choose to do though.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 1:32pm

Re: How is this data being collected?
Just because you don't have a data plan doesn't mean the capacity isn't there. My car came with Sirius Satellite Radio installed, including the antenna on the roof. I never subscribed and thus get no stations. I still get offers from time to time and never do them. But the equipment - and thus capacity - still exists.

So how do I know my car doesn't have a hidden cel antenna? I don't. Unless I want to tear the whole thing apart.
[ link to this | view in thread ]
Kev (profile), 19 Feb 2015 @ 1:34pm

Re: Re:
Geico was one of the main drivers of this. A quick scan of their website doesn't turn up any reference to it now so it may be discontinued. It's use is typically linked to a rate reduction.
[ link to this | view in thread ]
PlagueSD (profile), 19 Feb 2015 @ 1:55pm

Re: How is this data being collected?
Any car that has OnStar or Sync installed has the capability. Just because you don't sign up for the service doesn't mean it's not used.
[ link to this | view in thread ]
ECA (profile), 19 Feb 2015 @ 1:56pm

Questions Questions
1. how do they get the data, Wireless, Wired, Collected over time?
2. HOW do they get a vehicle to GOTO a station to have data gathered? Interesting? that your car has Full Ram, and starts running like CRAP, so you goto a Local dealer to have service..And CHARGED to have it read..
3. UPDATE my cars computer? CHANGE how it runs?? Without My knowledge??
4. wireless UPDATES??? NO NO NO NO NO...
5. wireless Bypass into my OWN net?? Cellphone service?? WHo is paying for this?

Odds are that it collects data, and then causes the care to hiccup, so you have to take it into the shop, then be charged $50+ to read the data to be sent...from That point, they can do alot of things to you.. Ever wonder WHy the service light goes on, every 5000 miles?
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 2:02pm

Re: How is this data being collected?
Every new car in the US has a cell plan that the manufacturer included. Most are never turned on or even known to you, but they allow 2 way communication and even voice to text conversion so it becomes a giant listening device. The care makers can make more money selling this data than the bulk plan rates will ever cost them...
[ link to this | view in thread ]
John Fenderson (profile), 19 Feb 2015 @ 2:02pm

Re: Re: How is this data being collected?
If you don't sign up for those services, the capability is still used. Police have used it for surveillance, and users can still make emergency calls through it.

But what the car manufacturers use isn't always OnStar. They have their own thing going.
[ link to this | view in thread ]
John Fenderson (profile), 19 Feb 2015 @ 2:03pm

Re: Re: How is this data being collected?
"So how do I know my car doesn't have a hidden cel antenna?"

The internet to the rescue here. You can find out whether your particular car comes with this stuff and where the antenna is pretty quickly. As well as instructions for how to disable it.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 2:06pm

Re: Questions Questions
Your service light goes on every 5000 because you have to get an oil change.

There is absolutely no reason to think that they intentionally cause and error so that they can steal data at the service station. First, reliability is important to drivers. Second, that kind of infrastructure is not at all trivial to install and manage.

The data is collected through OnStar or Sync, apparently. These services come with cellular connections.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 2:11pm

Re: Re: How is this data being collected?
I seriously doubt your claim that every new car has a cell plan. That's cost prohibitive. Also, why would they add the expense of a cellular modem to every car even when it doesn't provide a function for the owner? Yeah, that's a highly dubious claim.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 2:21pm

Re: Re: Re: How is this data being collected?
cell phone plans only cost normal people. If you are buying millions of data only plans with older connection standards, you could pay less than $50 a year. Remember many Kindles and other devices come with free cell connection for life, even though you don't pay for that directly. It is all built into the computing system. Look into current car hacking worries to see if your car is vulnerable.
[ link to this | view in thread ]
Anonymous Coward, 19 Feb 2015 @ 2:25pm

Re: Re: Re:
I love Progressive's ads trying to convince people to plug a "good driver" tracking pod into their OBDII ports. Yeah, I'll make sure to do that right before I drive to the police station to get my proactive "good citizen" ankle bracelet.
[ link to this | view in thread ]
John Fenderson (profile), 19 Feb 2015 @ 2:37pm

Re: Questions Questions
1. Wireless, over the cell network
2. They don't need to
3. Yup
4. Yup.
5. The car companies do. The expense to them is very minimal.
[ link to this | view in thread ]
Jack, 19 Feb 2015 @ 3:42pm

Re: How is this data being collected?
Almost all cars being produced today (even the cheap ones) come with built in Wi-Fi. Of course, you have to pay for a data-plan with the manufacturer to use it yourself, but the 4G Modem is always turned on and always transmitting nearly everything about your car. Everything that can be read from the ECU and GPS can be sent to the manufacturer. Also, ECUs have serial numbers that can be tied to the VIN (which is tied to you through the sale of the car, DMV, insurance, etc.) and can also be sent back to the manufacturer.

Every station you play on Pandora (main selling point of 4G in the car), every search in Google, your voice, everywheer you go, how fast you drive, how hard you corner, how hard you slam on the brakes, etc. can be sent to the manufacturer and sold to insurance companies, advertisers, and given away to Law Enforcement.

Now that car seats can record weight as well, they will be able to ID the driver in the car. Welcome to a world where cops won't even need to pull you over to give you a ticket for speeding - they will just send you one in the mail.

Also, a lot of cars have cameras that watch your face so they can beep if you close your eyes or look away and most cars now have voice recognition. They can spy on all that...
[ link to this | view in thread ]
ECA (profile), 19 Feb 2015 @ 3:43pm

Hmmm
reading the article some form s are NOT wireless..
reliability?? not in this generation..After 5 years 1/2 the plastic in the engine are starting to fail.. Many cars you see it in the mileage changes..

And you dont pay for onstar? Sync?

You really think they only do the higher end, more expensive cars??
Im sorry, I HATE electronics in my car. And I believe the engine computer could do better, IF they didnt add restrictions to it..(yes they place restrictions in the programming)
[ link to this | view in thread ]
safekid, 19 Feb 2015 @ 3:55pm

CAN BUS - safety
This data isn't used for anything substantial.....YET. There is an effort to provide all cars with an infrastructure to warn and communicate with one another. This will depend on those who are successful in getting the auto companies to standardize these messages.
[ link to this | view in thread ]
127.0.0.1 (profile), 19 Feb 2015 @ 4:10pm

One way to avoid backdoors: Only buy a coupe
[ link to this | view in thread ]
bubba, 19 Feb 2015 @ 7:39pm

Re: Re: How is this data being collected?
Would you please be so kind as to cite references to your claims?
[ link to this | view in thread ]
Anonymous Coward, 20 Feb 2015 @ 7:40am

Assume they have it
"when the government comes looking for it"

It is almost certain that the government has already compromised the minimal security, and they already have all that data. That is much too deep a treasure trove for them to have ignored.
[ link to this | view in thread ]
Anonymous Coward, 20 Feb 2015 @ 7:41am

Re: Re: Re: How is this data being collected?
http://www.chevrolet.com/culture/article/4g-lte.html

https://media.ford.com/content/fordmedia/fna/us/ en/news/2010/01/07/ford-sync-connects-car-with-internet--new-wifi-receiver--built-i.html

That's the 2 big American companies - Chevy promises a full 4g LTE in their entire lineup within the next couple years and already has almost every 2015 car...
[ link to this | view in thread ]
Anonymous Coward, 20 Feb 2015 @ 7:48am

Re: Re: Re: How is this data being collected?
GM and Jag with Eye and Head Tracking cameras:
http://www.dailymail.co.uk/sciencetech/article-2740588/Your-car-watching-GM-roll-eye-trackin g-technology-knows-not-paying-attention-road.html
http://www.technologyreview.com/news/533801/jaguar- demos-a-car-that-keeps-an-eye-on-its-driver/
[ link to this | view in thread ]
Dan G Difino, 20 Feb 2015 @ 9:55am

Re:
Maybe the folks over at Tesla will give us all for a price what a lot of us are hoping for, a Tesla Revolution Model. The day I need autonomous vehiclular control technology to park my car or apply breaks for me or automatically slow down my pace while bells are buzzing and that obnozious computer drone voice is warning me, "This vehicle is travelling too fast" or, "Watch out for the pelican on the right" or some nosy search engine selling my driving data to more advertising bums will be.. let's see.. N E V E R !
[ link to this | view in thread ]
Dan G Difino, 20 Feb 2015 @ 10:01am

Re: Re:
OR AS IF, how about the new Tesla Revolt!! I'll take one in trade for either name, what do you say? Just, please, kindly keep it Tesla!
[ link to this | view in thread ]
Dan G Difino, 20 Feb 2015 @ 10:20am

Re: Re:
That would be asking you to waive your protection under the U.S. Constitution's 4th Amendment. Tell them to go [F#c&] themselves!
[ link to this | view in thread ]
Dan G Difino, 20 Feb 2015 @ 10:42am

Re: Re: How is this data being collected?
Two people have rammed me from behind while they were texting. One even hit my vehicle while it was parked legally on the side of the street. I want to sue the entire texting industry for creating a bunch of idiots driving recklessly everywhere while texting. Are you hearing me? Can I get a witness?
[ link to this | view in thread ]
Andyj, 21 Feb 2015 @ 7:18am

Like all this "data collection" Its all memory and no brains.

I have a Nissan Leaf (UK). The always on connectivity is merely 2G. I doubt detailed travel records are kept, only the maps I`ve sent to car. Most of these functions are two way, I can remotely put the heating on or tell it to charge. In response it lets me know what its up to.

However, setting the car to read out RSS used to return speed and location back to that server, it was highlighted almost immediately so they took it off.

Can see the eco/distances/number of trips used on the car but sadly not routes.

I have a third party apps that grabs the CANBUS data. Its better than the cars instrumentation.

There is a lot of interest in hacking cars and I`m not surprised after new German made cars have raced off and sent some politically unwanted people to their sudden and early deaths.
[ link to this | view in thread ]
Anonymous Coward, 21 Feb 2015 @ 10:27am

I'm waiting for laws requiring cars to have all these tracking features built into them. Just like cellphones are required to have E911 tracking features. All in the name of safety and security, of course.

I've already witnessed first hand E911 GPS pings being sent to my cellphone and my GPS icon flashing. Despite the fact I had GPS option disabled in the phone's settings. I'm certain similar backdoor over-ride commands will be built into cars too.
[ link to this | view in thread ]
Anonymous Coward, 21 Feb 2015 @ 1:15pm

Re: Re: Re: How is this data being collected?
For what it's worth, I drive a 2008 Prius T Spirit. I am regularly shocked whenever using the built in SATNAV, a voice pipes up and informs me that 4 miles down the road there's "congested traffic". The Prius could only know this IF it had a means of receiving this data over the air. I also know that the Prius records what the driver does and stores the information for maintenance engineers to analyse if need be. And that's a 2008 vehicle!
[ link to this | view in thread ]
Anonymous Coward, 23 Feb 2015 @ 4:22am

Re:
If you're that concerned about E911, just get a tablet. They're not required to have a backdoored cell radio. If you want access to the cell network there are a number of options for a wi-fi hotspot many of which do not require ID to purchase.
[ link to this | view in thread ]
Nathanael, 23 Feb 2015 @ 10:25am

This is another reason to take the train and the bus. Although you can theoretically be tracked, it isn't worth the bother involved -- the agencies are perennially cash-strapped and cannot and will not waster their money on it.
[ link to this | view in thread ]
car garage (profile), 8 May 2020 @ 1:03pm

Car Donation
Many people donating a car to get tax benefit so, many charity organizations offering a <A href="https://freecarshelp.com/government-car-assistance/">free car</a>
[ link to this | view in thread ]