New research reveals serious privacy flaws in the data practices of new internet connected cars in Australia. It’s yet another reason why we need urgent reform of privacy laws.
Modern cars are increasingly equipped with internet-enabled features. Your “connected car” might automatically detect an accident and call emergency services, or send a notification if a child is left in the back seat.
But connected cars are also sophisticated surveillance devices. The data they collect can create a highly revealing picture of each driver. If this data is misused, it can result in privacy and security threats.
A report published today analysed the privacy terms from 15 of the most popular new car brands that sell connected cars in Australia.
This analysis uncovered concerning practices. There are enormous obstacles for consumers who want to find and understand the privacy terms. Some brands also make inaccurate claims that certain information is not “personal information”, implying the Privacy Act doesn’t apply to that data.
Some companies are also repurposing personal information for “marketing” or “research”, and sharing data with third parties.
If this data is misusedWhen this data is misused
I like the time they implied it would somehow protect people from sexual assault, but just ended up just revealing how personal the data they have can be
So how can I disconnect my car from the internet?
In general, don’t allow it to connect to wifi. As for specific makes/models that might have their own uplink, look into disconnecting antennas.
Rip out whatever transmitters they put in?
And frustratingly, it’s different in each car. Sometimes it’s in the center console, sometimes it’s behind the infotainment system, and sometimes it’s buried under the dash somewhere. Sometimes you’ll get lucky and it’ll have its own fuse, and other times it’ll cause issues depending on which part you disconnect (SIM vs antenna).
It really sucks.
My cars are not modern enough for that, but I always carry a surveillance device in my pocket to make up for it.
Eh, my phone is reasonably unlikely to spy on me. I use GrapheneOS with location off, no Google Play services most of the time (I have a separate profile for that BS), and the only app with location access is Organic Maps. My carrier could rat on me, but I don’t think Google could.
But I have a smart watch (Pixel 2), but at least it’s WiFi only so it can only rat on me when I get home. So I guess there’s that.
Your carrier HAS ratted on you. Under the incoming US administration, I’ve little doubt they will again.
At least that one has an off button
Oh, does it?
Did you read the article? There were a couple cases were very early Android phones were modified to appear to be off but stayed on. This is fairly common knowledge, but it’s not particularly hard to defeat.
Everything your phone does requires a deterministic amount of power. Spying on people in particular requires even more power than normal because you need to run the power hungry gps in addition to the modem and cpu.
If you turn off the device it should be significantly cooler to the touch, not a degree above ambient. If it’s at 100% charge but a power bank with a read out is showing it still charging, that’s a problem. Is the bootloader image different? You can verify that to some extent. When you turn it back on has it been drawing down the battery anyway? Does it require an unlock password instead of biometrics as it normally would (assuming a particularly sloppy setup)?
This isn’t rocket surgery, in reality nobody is modding everyone’s phone to stay on forever because unless you’re an absolute troglodyte (aka the fucking old school mafia bosses they did this to) it’s going to be painfully obvious your phone is acting weird.
Nowhere near an expert in this, but I know I’ve seen in the past that you could set your phone to turn on at a specific time (which means the RTC at a minimum is still running) - could a determined adversary not find a way to take advantage of that?
Depending on the chipset you can usually set rtc wakeup timers, though that typically implies sleep rather than power off so you’d still have some power draw when the device should be off. Similarly, if you’re trying to log GPS you’ll have to wake up for enough time to get a GPS lock so even at something like a 10 minute logging interval you’d get some noticable power consumption. Much much more if you’re trying to log voice or video.
