37 ms·

Who is collecting data from your car?

201 points by atg_abhishek 4y ago

Pakdef 4y ago
Ford is: https://www.businessinsider.com/ford-exec-gps-2014-1 https://www.businessinsider.com/ford-exec-gps-2014-1 (Ford Exec: 'We Know Everyone Who Breaks The Law' Thanks To Our GPS In Your Car)
- rad_gruchalski 4y ago
  Oh, not only GPS. Ford cars stream data in real-time. BMW cars, for example, only when the car stops. AFAIR, Toyota cars also stream in real-time.
  - Pakdef 4y ago
    We need guides to disable this non-sense...
jbotdev 4y ago
I have a car with Here maps, but it never occurred to me that a side effect of it having a data connection is data collection. I’ve been used to car navigation systems being offline, but it seems newer models like to search online for results, which of course exposes a lot of data to their servers. I wonder if you turned off the “online” search results and routing if it would shut off data collection, or if you’d have to physically cut off the cell connection.
- tunap 4y ago
  If FAANG has taught us nothing else, the option you choose will be expressly ignored if it is not the right choice. Metadata is gold. Full stop.
- JadeNB 4y ago
  > a side effect of … a data connection is data collection. This is a fantastic catchphrase.
i67vw3 4y ago
Year 2022: 'Degoogling' your car. PC/laptops were first, smartphones were done next and now car are too be 'degoogled'. Edit:- 'Smart' TV's were between smartphones and cars.
- mdp2021 4y ago
  No, that is a comparatively minor detail: a car MUST NOT be Internet connected. Before privacy, security. You do not open to security risks when advantages are negligible or even negative (privacy issues make them negative).
  - AlotOfReading 4y ago
    The direction OEMs are going is to try and have their cake and eat it too. Data connection is not optional, so security is achieved through an isolated network interface boxe that talks to the outside and is assumed to be pwned/pwnable. The rest of the architecture is hardened accordingly, with a single internal interface to the rest of the vehicle on a secured bus and attestation/secured computing platform, etc.
    - skummetmaelk 4y ago
      That's great until an unknowing mechanic connects a pwned device to the secure system that infects it and enables it to receive commands from the "assumed pwned" network box.
      - AlotOfReading 4y ago
        They wouldn't have a direct connection regardless, but this is also part of the threat model on every vehicle I've been involved with.
    - shnock 4y ago
      I have layman knowledge of this and do not understand. How does this compare to the level of security described in the GP comment (no connection at all)?
bertil 4y ago
I’m surprised that all this web of data hasn’t led to the most meaningful and significant improvement we still need in the car industry: have people who drive dangerous pay more for their insurance. It takes very little time near a road to notice that some people present an order of magnitude more risk than others, and no one has ever tried to confront them about it — at least successfully. With cars and their drivers killing more than a million people every year, a little constructive feedback would be a major help to avoid so many tragedies.
- mdp2021 4y ago
  Such check has been implemented many years ago by insurance companies through data collection from GPS devices.
  - pessimizer 4y ago
    It's even in the commercials in the US. edit: and the last four entries on the list from tfa.
- otikik 4y ago
  Go after the insurance companies instead. They are highly motivated to pass on the costs to their customers. I don't know exactly what would be an appropriate metric though.
- dahart 4y ago
  At least three of the companies listed in the article offer apps that track your driving and give an insurance discount if you sign up. This could be seen as effectively the same thing; safer drivers paying less is perhaps equivalent to dangerous drivers paying more. Yes it’s voluntary so this isn’t perfect, but I’d speculate there is some presumption that in general safer drivers are the people signing up for the discount. This unfortunately comes in the form of a privacy trace-off, but if having dangerous drivers pay more is the goal, I’m not sure there’s a way to have that without some monitoring. Another way your wish already exists partially is that people who cause accidents have higher insurance rates. This isn’t 100% effective, but some of the people who prove themselves more dangerous really do pay higher insurance already.
thrtythreeforty 4y ago
The simplest solution may be to disconnect the antenna. I would be very impressed if this negatively impacted the actual rolls-down-the-road functionality, since it's always possible that a car is in an area that has no cell service, and it would need to work without an always-on connection. This is unlikely to be in the service manual, though. Are people identifying where the radios in new cars are?
- akomtu 4y ago
  It's almost always the shark fin on the roof that has separate gps and cellular antennas.
  - vitaflo 4y ago
    Yup, and they're very easy to disconnect.
    - akomtu 4y ago
      On some car models you'd have to disassemble half of the car to get there.
  - myself248 4y ago
    Some TCUs have internal antennae too, so in case the coax is severed in a crash, it can still call 911. So, break out the soldering iron.
- AlotOfReading 4y ago
  It's quite possible that the same antenna package providing cellular connection is also providing the antennas for GNSS and radio. It's also not impossible that you'll start to experience odd behaviors and warnings after a month or two, as the software stack expects connectivity eventually.
  - fmntf 4y ago
    Frequencies among radio/gps/cellular/bt are different, you need separate antennas.
WarOnPrivacy 4y ago
The article notes 3rd party data services sprung up because car manufacturers weren't equipped to well-leverage the collected data. If auto financing taught us something, it's that manufacturers are compelled to control every monetization opportunity. I expect car companies will soon give their partners a choice - either sell yourselves to us or get locked out.
- pessimizer 4y ago
  I have it on good authority that it's not a monopoly if more than one company exists on the planet. In the end it will just be Monocorp and Mozilla, surviving on yearly half-billion monobuck® checks from Monocorp.
jancsika 4y ago
Hm, I was looking at 2022 Prius Prime LE and I don't see any evidence they even have a SIM card in them. Also can't imagine that Mitsubishi would be wasting money putting a SIM in a Mirage. Am I wrong? If so, how do I find out short of physically inspecting dozens of vehicles myself to see if they contain a SIM?
- tyingq 4y ago
  Not sure that stops it even. Some company could, for example, cut a deal with oil change places to download/upload the data when you visit.
  - j-bos 4y ago
    This. I went to get an inspection at a Valvoline place and the final part involved plugging their device to the car's computer. They were clear that it had nothing to do with the inspection, just "policy". I didn't push back since it was the last day for inspection, but honestly. Our culture keeps is of isolation and siloed personal lives, except for corporations, they have their fingers in the details of all personal affairs.
    - tyingq 4y ago
      They do need to read the "emissions readiness" in many (all?) US states.
      - j-bos 4y ago
        Of course, but they did that with a sensor. If anything my car computer says it has an emissions issue. But maybe I'm missing something.
        tyingq 4y ago
        "emission readiness" is a specific state of the computer where all of the sensors are reporting "good for an extended period of time". It takes several drive cycles to get into that state. So that you can't, for example, reset the ECU and drive in for an inspection right then. They do also do live tests with a sensor, but the "ECU says car is emissions ready" is an additional requirement. At least in many US states...maybe not yours?
ldayley 4y ago
True to HN form the proposed remedies tend to be technical in nature (though not necessarily wrong). This is another one of those problems best rectified with legal protections, not blog posts about how to disconnect the antennas. At the state level (in the US) it would be manageable to pass laws limiting or banning these practices, and that should be the first response. Of course backing that up with technical workarounds doesn’t hurt, either…
- xanaxagoras 4y ago
  I didn't see a blog post with instructions on how to remove the antennas. Got one? I'd love to do this. I'd love even more to pay a mechanic to do this but I'm not even sure what I'm asking for. I think there are 3 two way radios in my car, Sirius and 2 cellular modems from what I can glean from the user's manual. It's a 6 month old $50k car; asked about it on a subreddit and someone said it would probably void my warranty - fucking awesome. Legal protections would be nice, but I'd like to stop being stalked _immediately_.
  - WaitWaitWha 4y ago
    I will assume removing the radios, or modifying them would indeed void the warranties. On the other hand if the radios were blocked, without direct manipulation (i.e. Faraday cage-ish ideas) if the connectivity fails, is warranty void? An alternative would be to use something Ms Fried built in 2006[0], but more specific. Come to think of it... this might be a small business idea... [0]http://ladyada.net/make/wavebubble/index.html http://ladyada.net/make/wavebubble/index.html
Incipient 4y ago
I'm a bit surprised Android auto didn't crack a mention. Take a guess how much they'd be collecting too!
dahart 4y ago
What is the current legal thinking on the right to privacy while driving, has there been any legal development recently? In a car on public roads, location (for example) isn’t something we have historically had a right to keep private. Companies could, and the government sometimes does, legally track license plates or RFID tags on some roads (esp. state borders, bridges, HOV lanes). So we’ve never had a right to not have our whereabouts known or tracked, but companies and the govt have also never been able to track everyone extremely easily until recently. So there’s legitimate concern that the ease and scale of location tracking mean that we should perhaps establish a right to some privacy, but I’m not sure how that stands up to other people’s rights to see you and identify you when you’re in public. I was just thinking about the famous “Photographer’s rights” pamphlet that has gone around the internet for a while, and people who post YouTube videos of being harassed by police or security guards who claim photos can’t be taken of a building or site when the photographer is standing on public ground. The pamphlet patiently explains that you’re allowed to photograph anything visible from public land. Googling, I see a page at ACLU dedicated to the same idea https://www.aclu.org/issues/free-speech/photographers-rights https://www.aclu.org/issues/free-speech/photographers-rights I’m thinking about the future: imagine people made a stink about cars transmitting this data, and companies deciding instead to install cheap cameras everywhere on all roads. How do the photographer’s rights interact with people’s expectations for privacy? What should we expect, and what expectations are unrealistic and need adjusting? Are there any developments were lawmakers are addressing where the right boundaries are between public rights, private data, and the scale of cheap ubiquitous digital tracking?
- calvinmorrison 4y ago
  this problem is simple to solve, remove license plates. They're pointless anyway.
  - dahart 4y ago
    What do you mean? To the DOT, license plates ensure drivers have had basic training and that the vehicle has been inspected for basic safety and emissions standards. To police, the license plates offer a way to find out who the driver is. You might not see direct benefits today, but there certainly is a point to plates. If you find yourself in an accident that is the other party’s fault, you might understand the benefits to you of their license plate being visible. I hope that doesn’t happen to you, but many people in the past have been glad the offender could be identified.
salawat 4y ago
https://cccis.com/ https://cccis.com/ There's your data aggregator. At least one of em.
- rad_gruchalski 4y ago
  Have a look at Mobileye. Owned by Intel.
codedokode 4y ago
Wouldn't this be illegal under GDPR? A license plate number can be linked to the owner and therefore can be a PII, as well as car serial number or other identifier. Also, this shows that no matter if you pay for the product or not, you become the product for squeezing the data anyway. Also, this could be a national security issue everywhere except US if US government would be able to track the cars all around the world. For example, what if they will track the cars used by defence industry employees or military personnel? Such tracking equipment should be banned for import, but it is more likely that local government will just ask to provide the data to them too.
- AinderS 4y ago
  > Also, this shows that no matter if you pay for the product or not, you become the product for squeezing the data anyway. Because it's not due to money, but power. They have the power to put spy devices in so many cars it becomes (near) impossible to buy one without, and so they do it. A product only respects your rights if you can control it, if you have the power and leverage to change how it works. If you don't, you get user-hostile features whether you like it or not (the Intel Management Engine, and its AMD equivalent, being just two examples).
codedokode 4y ago
Found an interesting part: > Otonomo is one example of the dozens of companies that market their attempts at keeping information anonymous. Otonomo describes its platform as having “privacy and security by design” and notes the use of patented “data blurring” technology to protect user privacy. > It also has an “Otonomo Driver Pledge” page promising drivers the ability to easily grant or revoke access to personal data, This doesn't add up. If they collect only anonymized data, then they won't be able to find that customer's data and do anything with it.
- redtexture 4y ago
  > patented “data blurring” This can be looked up. I suspect it is not their own patent though, so not under their own name.
Cupertino95014 4y ago
This is a great article. I've wondered about that myself: Forgetting about the smartphone data, many cars have a Navigation system, which means the car itself knows where you are. Is it being communicated in real time, or does the car at least remember? I actually asked someone who works in car automation this very question, and he said it's really manufacturer-dependent. The car manufacturers are hoping no one digs into this. So let's dig.
- reaperducer 4y ago
  My car has no data connection hardware. The navigation maps are updated by putting a USB stick in the music player and uploading files to the car. The dealer charges about $200 to do it. It's probably possible for someone to do it on their own, but I don't drive enough to bother looking it up.
- spinny 4y ago
  My 2016 BMW 118d has a navigation system and a built-in SIM card. It is used in multiple instances (the listed ones): locating/locking/unlocking your car remotely (all optional), start an emergency call, updating the firmware and talking to a messaging server
  - Cupertino95014 4y ago
    Right, the question is: does all the data about where you've been get used anywhere, with PII attached? Could the police subpoena it?
    - spinny 4y ago
      > PII attached No. its' a second hand buy. maybe if purchased directly > Could the police subpoena it? it's also an import. probably any info is saved in a server somewhere in germany. Possibly yes, but which police ? in which country ?
      - Cupertino95014 4y ago
otikik 4y ago
I really despise the "smartphone on wheels" trend. I got a used Mazda 3 which doesn't have any of that, the new models come hyperconnected, so you can "see the status of your car with an App" (no thanks). Is there a list of cars which don't have remote data collection?
- mackatap 4y ago
  I just got a 2012 Mazda 3 and I love how dumb it is. Bluetooth audio and an aux cable is really all I want.
  - derwiki 4y ago
    I recently switched back to MP3 CDs and am happy not dealing with Bluetooth or a smartphone
    - mackatap 4y ago
      Yeah, I have a bunch of cd's I'm happy to be able to use again. But it's so easy to drag and drop music onto an android phone.
    - LAC-Tech 4y ago
      You can go slightly more high tech and just plug a USB drive into the port. Still no bluetooth or smartphone but you get more than 700 odd megabytes of mp3s.
      - 29083011397778 4y ago
        I've taken it a step further and now just leave a Samsung external SSD plugged in (and out of sight). Better quality flash than a USB stick, and now the limiting factor for library size is the number of tracks the car can handle, instead of storage.
      - figglestar 4y ago
        I asked the sales guy about this when I bought my 2019 Subaru and he was stumped, said no one had ever asked that before. But sure enough, the car could read flash drives similar to MP3 cds.
jareklupinski 4y ago
Followed the Sirius link in the article to their privacy policy: https://www.siriusxmcvs.com/privacy-policy/ https://www.siriusxmcvs.com/privacy-policy/ > Vehicle Data... After your Vehicle’s ignition is turned off, the Vehicle transmits the location of the Vehicle and the time it was turned off. If every car with Sirius installed transmits the time and location when it was switched off to marketers, that would close the loop on all those "I just moved to this place and I'm getting local robocalls to my cell number".
- MSM 4y ago
  >"I just moved to this place and I'm getting local robocalls to my cell number" This is more than likely just a combination of National Change of Address database (which is updated daily, I think, and there seems to be a lot of companies selling it) and some marketing information from one of many services that sell it, almost all of which contain your cell phone.
- pilgrimfff 4y ago
  That's a horrifying policy. Though advertisers don't need Sirius. USPS will sell your change of address data to any one who had your old address https://www.edq.com/glossary/ncoa/ https://www.edq.com/glossary/ncoa/
elf25 4y ago
dwighttk 4y ago
nobody, but it is 22 years old.
- mixmastamyk 4y ago
  License plate scanners find some data.
colordrops 4y ago
Can't wait until there is an EV with good range and no connection to the cloud. Very unlikely, I know.
- LAC-Tech 4y ago
  Are there even modern ICs that don't connect to the cloud?
RyJones 4y ago
If you want to see what Honda collects: https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141ffcc9 https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141f...
byteduck 4y ago
I don't know why I never considered that my car may be collecting data on me. I have a Hyundai, and I just went into my settings to turn off as much of this as possible. I wonder if there's a way to disconnect the antenna or deactivate the cell service since I don't need it...
- tencentshill 4y ago
Brink0004 4y ago
it's weird that they missed Autonomic in this article; they're outright owned by Ford. pretty much every new Ford is sending to Autonomic before you even drive off the lot https://www.crunchbase.com/organization/autonomic https://www.crunchbase.com/organization/autonomic
mertd 4y ago
Everything is "data collection". Someone really needs to qualify the boundaries of what is considered a breach of privacy. Sending location, heading and speed anonymously is perfectly ok by me because in return we all get real time congestion aware routing.
wiz21c 4y ago
If the car sends data back to the mothership, then who pays the phone bill ? Say's it's about an SMS size each time I use a car so maybe 0.02$ a day ? 200 days/year, 10 years => 0.0220020=80$ and they sure have discount, so it's very cheap... IS there a way to know where the chip is ? Is there a way to jam it so it can't send information back ?
- rad_gruchalski 4y ago
  > If the car sends data back to the mothership, then who pays the phone bill You do. The bill is included in the purchase price of the vehicle. The manufacturer sources data SIMs, pays for data ahead of time, and that’s to the cehicle price.
nobody9999 4y ago
I'm a little confused by the discussion here. Please forgive me if I've missed something obvious. Much of the discussion seems to be around the government (usually, but not limited to, police) monitoring the location and operation of a vehicle on public roads. While I'm not a huge fan of government surveillance, registering a vehicle (and obtaining a driver's license) and monitoring the performance of that vehicle (and its driver(s)) are governmental functions purporting to ensure the safe operation of a vehicle. Corporate entities, like auto manufacturers, dealers and "tech" companies have no such responsibility, nor do they have any role in (except in abiding by the law/regulation -- e.g., emissions standards). So, unless there is some sort of government mandate to collect such information, corporate entities have no reason (other than their own profit) to collect location, velocity and/or in-vehicle activities. IMNSHO, that they do so should be much more concerning than red light or speed cameras, being followed for a few miles by the police, or as is popular where street parking is a thing, checking registration/inspection expiry. Just as one (or should be) is horrified by the levels of tracking by corporate entities on IOT devices, "smart" TVs, dishwashers(?!?), etc., etc., etc., why are folks focusing on the government here? They aren't gathering the boatloads of information being collected by the corporate entities (and if the government starts buying such data, they should be smacked down hard!) that are invading/destroying what little privacy we might have. As such, I don't get why the focus is on the government rather than on the folks actually gathering all this data.
- devoutsalsa 4y ago
  You might change your mind when the government starts tracking the fact that you drove to an abortion clinic.
  - nobody9999 4y ago
    >You might change your mind when the government starts tracking the fact that you drove to an abortion clinic. Where might the government get such data? They certainly aren't gathering it themselves. Rather, it will come from the corporate entities that are already gathering such data. What's more, I can organize my neighbors to vote out folks who want to spy on me. I can't do that (well, I guess if I had a few trillion dollars to buy majority stakes in various corporations, although that wouldn't work with Facebook[0] though) with the corporations that are already spying on me. Just so I understand your position, you appear to believe that bad things a government might do with the help of corporations that are already doing those bad things is what we should be concerned about rather than what those same corporations are already doing. Is that your argument? I just want to make sure I understand, as I'd like to have a discussion and not create straw men. Thanks! [0] https://www.businessinsider.com/mark-zuckerberg-control-facebook-whistleblower-key-man-risk-2021-10?op=1 https://www.businessinsider.com/mark-zuckerberg-control-face...
xfitm3 4y ago
I installed a dummy load instead the cellular antenna in my vehicle. In theory it should not be able to connect back to my automaker's virtual mobile network.
nimbius 4y ago
I'm a diesel mechanic by trade. for anyone curious to disable your cars data collection the OnStar systems easiest. under your passenger dash is a black metal box, usually documented. unplugging the harness and removing it, you can open it to expose a baseboard and a riser. the baseboard is for things like infotainment usually but the riser is your cellular modem. pull it and you'll get a warning light on the dash, but no more data collection. older cars will have a Sim in the riser you can pull if thats less invasive to you. note: OnStar is also disabled and will not dial 911/999 on collision.
- vitaflo 4y ago
  This is the correct answer. Found this out when I was doing a ham radio antenna install on my car. The shark fin for the XM radio antenna (that I never use) sits on top of a hole in the roof, and a nice hole in the roof is a the perfect spot for a ham radio antenna, so I removed the shark fin. After disconnecting it I noticed it also disconnected OnStar, GPS, etc. It's all integrated into that fin. Once disconnected, the car isn't going to be able to send anything even if it tried. Only question is if your car is gonna bitch at you because it's disconnected (mine doesn't).
- eyelidlessness 4y ago
  Will it dial 0118 999 881 999 119 7253?
  - hun3 4y ago
    For context: The IT Crowd - Series 1 - Episode 2: New emergency number https://www.youtube.com/watch?v=HWc3WY3fuZU https://www.youtube.com/watch?v=HWc3WY3fuZU
- nilespotter 4y ago
- nichos 4y ago
  This really should be a setting in the head unit. Sadly even if it was there, I doubt I would trust it to fully disconnect.
cameldrv 4y ago
What happens if you disconnect the cellular antenna from your car?
- vitaflo 4y ago
  Suppose it depends on your car. Mine did nothing when I removed it. Of course you may lose access to some things you want, like XM Radio, OnStar, GPS, etc (usually all these are integrated into the same board in the shark fin on top of the car).
teeray 4y ago
This doesn’t end until data is seen by companies as a liability rather than as an asset.
fma 4y ago
I'm surprised Tesla isn't on the list? Do they still collect data to feed their self-driving car initiative?
pabs3 4y ago
I wonder if there will ever be any electric cars that let you install alternative operating systems.
kelnos 4y ago
This month I just got a new car to replace my 18-year-old Honda, which was, as you'd expect for a 2004 model year car, not connected to the internet at all. The new car sometimes feels more complicated than my smartphone, and data collection was one of my first worries. Of course there's an app that comes along with it, and while the information and remote functionality it provides is interesting, having done without this stuff for the first 25 years of my driving life, I feel like I can easily do without it. Another poster talks about removing the cellular modem to ensure the car can't phone home, and I'm seriously considering doing it. Though I imagine when I bring it in for service, the techs will want to reconnect it. I'm even afraid that they'll claim they can't service my car without doing. In addition to that, I do want to receive OTA updates to the car's software. I'm curious to know if it's possible to opt out of all data collection (perhaps aided by the CCPA, as I live in California), without modifying the car's hardware. Sure, in that case I am then relying on trust (trust that is so far unearned), but I'm curious nonetheless. The thing that worries me most is location tracking, followed by the possibility that my driving "style" could be sold to my insurance company. I've filled out the CCPA opt-out form from my car's manufacturer (though that's about sale of information, not collection), but I'm sure that's woefully insufficient to actually protect my privacy.
throw03172019 4y ago
So is this how my car insurance agency called me to tell me I am driving more miles so they want to raise my rates?
Animats 4y ago
Do cars with police packages have data collection?
exabrial 4y ago
Unplugged the sim module in my gmc. Never thought about it since.
sam-s 4y ago
The Institute for Justice (https://ij.org/ https://ij.org/) has a podcast (https://ij.org/podcasts/short-circuit/ https://ij.org/podcasts/short-circuit/) were they regularly discuss these kinds of issues. It is hard to summarize the situations briefly, but, essentially, the government can do whatever they want and the courts hardly ever slap them on the hands. (IJ also _fights_ these issues in court pro bono - they are a law firm! - so supporting them looks like a good idea. disclosure: I am not affiliated with them in any form, just a podcast listener and a very minor donor)

201 points by atg_abhishek 4y ago

Ford is: https://www.businessinsider.com/ford-exec-gps-2014-1 https://www.businessinsider.com/ford-exec-gps-2014-1 (Ford Exec: 'We Know Everyone Who Breaks The Law' Thanks To Our GPS In Your Car)

rad_gruchalski 4y ago
Oh, not only GPS. Ford cars stream data in real-time. BMW cars, for example, only when the car stops. AFAIR, Toyota cars also stream in real-time.
- Pakdef 4y ago
  We need guides to disable this non-sense...

jbotdev 4y ago

I have a car with Here maps, but it never occurred to me that a side effect of it having a data connection is data collection. I’ve been used to car navigation systems being offline, but it seems newer models like to search online for results, which of course exposes a lot of data to their servers. I wonder if you turned off the “online” search results and routing if it would shut off data collection, or if you’d have to physically cut off the cell connection.

tunap 4y ago
If FAANG has taught us nothing else, the option you choose will be expressly ignored if it is not the right choice. Metadata is gold. Full stop.
JadeNB 4y ago
> a side effect of … a data connection is data collection. This is a fantastic catchphrase.

i67vw3 4y ago

Year 2022: 'Degoogling' your car. PC/laptops were first, smartphones were done next and now car are too be 'degoogled'. Edit:- 'Smart' TV's were between smartphones and cars.

mdp2021 4y ago
No, that is a comparatively minor detail: a car MUST NOT be Internet connected. Before privacy, security. You do not open to security risks when advantages are negligible or even negative (privacy issues make them negative).
- AlotOfReading 4y ago
  The direction OEMs are going is to try and have their cake and eat it too. Data connection is not optional, so security is achieved through an isolated network interface boxe that talks to the outside and is assumed to be pwned/pwnable. The rest of the architecture is hardened accordingly, with a single internal interface to the rest of the vehicle on a secured bus and attestation/secured computing platform, etc.
  - skummetmaelk 4y ago
    That's great until an unknowing mechanic connects a pwned device to the secure system that infects it and enables it to receive commands from the "assumed pwned" network box.
    - AlotOfReading 4y ago
      They wouldn't have a direct connection regardless, but this is also part of the threat model on every vehicle I've been involved with.
  - shnock 4y ago
    I have layman knowledge of this and do not understand. How does this compare to the level of security described in the GP comment (no connection at all)?

bertil 4y ago

I’m surprised that all this web of data hasn’t led to the most meaningful and significant improvement we still need in the car industry: have people who drive dangerous pay more for their insurance. It takes very little time near a road to notice that some people present an order of magnitude more risk than others, and no one has ever tried to confront them about it — at least successfully. With cars and their drivers killing more than a million people every year, a little constructive feedback would be a major help to avoid so many tragedies.

mdp2021 4y ago
Such check has been implemented many years ago by insurance companies through data collection from GPS devices.
- pessimizer 4y ago
  It's even in the commercials in the US. edit: and the last four entries on the list from tfa.
otikik 4y ago
Go after the insurance companies instead. They are highly motivated to pass on the costs to their customers. I don't know exactly what would be an appropriate metric though.
dahart 4y ago
At least three of the companies listed in the article offer apps that track your driving and give an insurance discount if you sign up. This could be seen as effectively the same thing; safer drivers paying less is perhaps equivalent to dangerous drivers paying more. Yes it’s voluntary so this isn’t perfect, but I’d speculate there is some presumption that in general safer drivers are the people signing up for the discount. This unfortunately comes in the form of a privacy trace-off, but if having dangerous drivers pay more is the goal, I’m not sure there’s a way to have that without some monitoring. Another way your wish already exists partially is that people who cause accidents have higher insurance rates. This isn’t 100% effective, but some of the people who prove themselves more dangerous really do pay higher insurance already.

thrtythreeforty 4y ago

The simplest solution may be to disconnect the antenna. I would be very impressed if this negatively impacted the actual rolls-down-the-road functionality, since it's always possible that a car is in an area that has no cell service, and it would need to work without an always-on connection. This is unlikely to be in the service manual, though. Are people identifying where the radios in new cars are?

akomtu 4y ago
It's almost always the shark fin on the roof that has separate gps and cellular antennas.
- vitaflo 4y ago
  Yup, and they're very easy to disconnect.
  - akomtu 4y ago
    On some car models you'd have to disassemble half of the car to get there.
- myself248 4y ago
  Some TCUs have internal antennae too, so in case the coax is severed in a crash, it can still call 911. So, break out the soldering iron.
AlotOfReading 4y ago
It's quite possible that the same antenna package providing cellular connection is also providing the antennas for GNSS and radio. It's also not impossible that you'll start to experience odd behaviors and warnings after a month or two, as the software stack expects connectivity eventually.
- fmntf 4y ago
  Frequencies among radio/gps/cellular/bt are different, you need separate antennas.

WarOnPrivacy 4y ago

The article notes 3rd party data services sprung up because car manufacturers weren't equipped to well-leverage the collected data. If auto financing taught us something, it's that manufacturers are compelled to control every monetization opportunity. I expect car companies will soon give their partners a choice - either sell yourselves to us or get locked out.

pessimizer 4y ago
I have it on good authority that it's not a monopoly if more than one company exists on the planet. In the end it will just be Monocorp and Mozilla, surviving on yearly half-billion monobuck® checks from Monocorp.

jancsika 4y ago

Hm, I was looking at 2022 Prius Prime LE and I don't see any evidence they even have a SIM card in them. Also can't imagine that Mitsubishi would be wasting money putting a SIM in a Mirage. Am I wrong? If so, how do I find out short of physically inspecting dozens of vehicles myself to see if they contain a SIM?

tyingq 4y ago
Not sure that stops it even. Some company could, for example, cut a deal with oil change places to download/upload the data when you visit.
- j-bos 4y ago
  This. I went to get an inspection at a Valvoline place and the final part involved plugging their device to the car's computer. They were clear that it had nothing to do with the inspection, just "policy". I didn't push back since it was the last day for inspection, but honestly. Our culture keeps is of isolation and siloed personal lives, except for corporations, they have their fingers in the details of all personal affairs.
  - tyingq 4y ago
    They do need to read the "emissions readiness" in many (all?) US states.
    - j-bos 4y ago
      Of course, but they did that with a sensor. If anything my car computer says it has an emissions issue. But maybe I'm missing something.
      - tyingq 4y ago
        "emission readiness" is a specific state of the computer where all of the sensors are reporting "good for an extended period of time". It takes several drive cycles to get into that state. So that you can't, for example, reset the ECU and drive in for an inspection right then. They do also do live tests with a sensor, but the "ECU says car is emissions ready" is an additional requirement. At least in many US states...maybe not yours?

ldayley 4y ago

True to HN form the proposed remedies tend to be technical in nature (though not necessarily wrong). This is another one of those problems best rectified with legal protections, not blog posts about how to disconnect the antennas. At the state level (in the US) it would be manageable to pass laws limiting or banning these practices, and that should be the first response. Of course backing that up with technical workarounds doesn’t hurt, either…

xanaxagoras 4y ago
I didn't see a blog post with instructions on how to remove the antennas. Got one? I'd love to do this. I'd love even more to pay a mechanic to do this but I'm not even sure what I'm asking for. I think there are 3 two way radios in my car, Sirius and 2 cellular modems from what I can glean from the user's manual. It's a 6 month old $50k car; asked about it on a subreddit and someone said it would probably void my warranty - fucking awesome. Legal protections would be nice, but I'd like to stop being stalked _immediately_.
- WaitWaitWha 4y ago
  I will assume removing the radios, or modifying them would indeed void the warranties. On the other hand if the radios were blocked, without direct manipulation (i.e. Faraday cage-ish ideas) if the connectivity fails, is warranty void? An alternative would be to use something Ms Fried built in 2006[0], but more specific. Come to think of it... this might be a small business idea... [0]http://ladyada.net/make/wavebubble/index.html http://ladyada.net/make/wavebubble/index.html

Incipient 4y ago

I'm a bit surprised Android auto didn't crack a mention. Take a guess how much they'd be collecting too!

dahart 4y ago

What is the current legal thinking on the right to privacy while driving, has there been any legal development recently? In a car on public roads, location (for example) isn’t something we have historically had a right to keep private. Companies could, and the government sometimes does, legally track license plates or RFID tags on some roads (esp. state borders, bridges, HOV lanes). So we’ve never had a right to not have our whereabouts known or tracked, but companies and the govt have also never been able to track everyone extremely easily until recently. So there’s legitimate concern that the ease and scale of location tracking mean that we should perhaps establish a right to some privacy, but I’m not sure how that stands up to other people’s rights to see you and identify you when you’re in public. I was just thinking about the famous “Photographer’s rights” pamphlet that has gone around the internet for a while, and people who post YouTube videos of being harassed by police or security guards who claim photos can’t be taken of a building or site when the photographer is standing on public ground. The pamphlet patiently explains that you’re allowed to photograph anything visible from public land. Googling, I see a page at ACLU dedicated to the same idea https://www.aclu.org/issues/free-speech/photographers-rights https://www.aclu.org/issues/free-speech/photographers-rights I’m thinking about the future: imagine people made a stink about cars transmitting this data, and companies deciding instead to install cheap cameras everywhere on all roads. How do the photographer’s rights interact with people’s expectations for privacy? What should we expect, and what expectations are unrealistic and need adjusting? Are there any developments were lawmakers are addressing where the right boundaries are between public rights, private data, and the scale of cheap ubiquitous digital tracking?

calvinmorrison 4y ago
this problem is simple to solve, remove license plates. They're pointless anyway.
- dahart 4y ago
  What do you mean? To the DOT, license plates ensure drivers have had basic training and that the vehicle has been inspected for basic safety and emissions standards. To police, the license plates offer a way to find out who the driver is. You might not see direct benefits today, but there certainly is a point to plates. If you find yourself in an accident that is the other party’s fault, you might understand the benefits to you of their license plate being visible. I hope that doesn’t happen to you, but many people in the past have been glad the offender could be identified.

salawat 4y ago

https://cccis.com/ https://cccis.com/ There's your data aggregator. At least one of em.

rad_gruchalski 4y ago
Have a look at Mobileye. Owned by Intel.

codedokode 4y ago

Wouldn't this be illegal under GDPR? A license plate number can be linked to the owner and therefore can be a PII, as well as car serial number or other identifier. Also, this shows that no matter if you pay for the product or not, you become the product for squeezing the data anyway. Also, this could be a national security issue everywhere except US if US government would be able to track the cars all around the world. For example, what if they will track the cars used by defence industry employees or military personnel? Such tracking equipment should be banned for import, but it is more likely that local government will just ask to provide the data to them too.

AinderS 4y ago
> Also, this shows that no matter if you pay for the product or not, you become the product for squeezing the data anyway. Because it's not due to money, but power. They have the power to put spy devices in so many cars it becomes (near) impossible to buy one without, and so they do it. A product only respects your rights if you can control it, if you have the power and leverage to change how it works. If you don't, you get user-hostile features whether you like it or not (the Intel Management Engine, and its AMD equivalent, being just two examples).

codedokode 4y ago

Found an interesting part: > Otonomo is one example of the dozens of companies that market their attempts at keeping information anonymous. Otonomo describes its platform as having “privacy and security by design” and notes the use of patented “data blurring” technology to protect user privacy. > It also has an “Otonomo Driver Pledge” page promising drivers the ability to easily grant or revoke access to personal data, This doesn't add up. If they collect only anonymized data, then they won't be able to find that customer's data and do anything with it.

redtexture 4y ago
> patented “data blurring” This can be looked up. I suspect it is not their own patent though, so not under their own name.

Cupertino95014 4y ago

This is a great article. I've wondered about that myself: Forgetting about the smartphone data, many cars have a Navigation system, which means the car itself knows where you are. Is it being communicated in real time, or does the car at least remember? I actually asked someone who works in car automation this very question, and he said it's really manufacturer-dependent. The car manufacturers are hoping no one digs into this. So let's dig.

reaperducer 4y ago
My car has no data connection hardware. The navigation maps are updated by putting a USB stick in the music player and uploading files to the car. The dealer charges about $200 to do it. It's probably possible for someone to do it on their own, but I don't drive enough to bother looking it up.
spinny 4y ago
My 2016 BMW 118d has a navigation system and a built-in SIM card. It is used in multiple instances (the listed ones): locating/locking/unlocking your car remotely (all optional), start an emergency call, updating the firmware and talking to a messaging server
- Cupertino95014 4y ago
  Right, the question is: does all the data about where you've been get used anywhere, with PII attached? Could the police subpoena it?
  - spinny 4y ago
    > PII attached No. its' a second hand buy. maybe if purchased directly > Could the police subpoena it? it's also an import. probably any info is saved in a server somewhere in germany. Possibly yes, but which police ? in which country ?
    - Cupertino95014 4y ago

otikik 4y ago

I really despise the "smartphone on wheels" trend. I got a used Mazda 3 which doesn't have any of that, the new models come hyperconnected, so you can "see the status of your car with an App" (no thanks). Is there a list of cars which don't have remote data collection?

mackatap 4y ago
I just got a 2012 Mazda 3 and I love how dumb it is. Bluetooth audio and an aux cable is really all I want.
- derwiki 4y ago
  I recently switched back to MP3 CDs and am happy not dealing with Bluetooth or a smartphone
  - mackatap 4y ago
    Yeah, I have a bunch of cd's I'm happy to be able to use again. But it's so easy to drag and drop music onto an android phone.
  - LAC-Tech 4y ago
    You can go slightly more high tech and just plug a USB drive into the port. Still no bluetooth or smartphone but you get more than 700 odd megabytes of mp3s.
    - 29083011397778 4y ago
      I've taken it a step further and now just leave a Samsung external SSD plugged in (and out of sight). Better quality flash than a USB stick, and now the limiting factor for library size is the number of tracks the car can handle, instead of storage.
    - figglestar 4y ago
      I asked the sales guy about this when I bought my 2019 Subaru and he was stumped, said no one had ever asked that before. But sure enough, the car could read flash drives similar to MP3 cds.

jareklupinski 4y ago

Followed the Sirius link in the article to their privacy policy: https://www.siriusxmcvs.com/privacy-policy/ https://www.siriusxmcvs.com/privacy-policy/ > Vehicle Data... After your Vehicle’s ignition is turned off, the Vehicle transmits the location of the Vehicle and the time it was turned off. If every car with Sirius installed transmits the time and location when it was switched off to marketers, that would close the loop on all those "I just moved to this place and I'm getting local robocalls to my cell number".

MSM 4y ago
>"I just moved to this place and I'm getting local robocalls to my cell number" This is more than likely just a combination of National Change of Address database (which is updated daily, I think, and there seems to be a lot of companies selling it) and some marketing information from one of many services that sell it, almost all of which contain your cell phone.
pilgrimfff 4y ago
That's a horrifying policy. Though advertisers don't need Sirius. USPS will sell your change of address data to any one who had your old address https://www.edq.com/glossary/ncoa/ https://www.edq.com/glossary/ncoa/

elf25 4y ago

dwighttk 4y ago

nobody, but it is 22 years old.

mixmastamyk 4y ago
License plate scanners find some data.

colordrops 4y ago

Can't wait until there is an EV with good range and no connection to the cloud. Very unlikely, I know.

LAC-Tech 4y ago
Are there even modern ICs that don't connect to the cloud?

RyJones 4y ago

If you want to see what Honda collects: https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141ffcc9 https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141f...

byteduck 4y ago

I don't know why I never considered that my car may be collecting data on me. I have a Hyundai, and I just went into my settings to turn off as much of this as possible. I wonder if there's a way to disconnect the antenna or deactivate the cell service since I don't need it...

tencentshill 4y ago

Brink0004 4y ago

it's weird that they missed Autonomic in this article; they're outright owned by Ford. pretty much every new Ford is sending to Autonomic before you even drive off the lot https://www.crunchbase.com/organization/autonomic https://www.crunchbase.com/organization/autonomic

mertd 4y ago

Everything is "data collection". Someone really needs to qualify the boundaries of what is considered a breach of privacy. Sending location, heading and speed anonymously is perfectly ok by me because in return we all get real time congestion aware routing.

wiz21c 4y ago

If the car sends data back to the mothership, then who pays the phone bill ? Say's it's about an SMS size each time I use a car so maybe 0.02$ a day ? 200 days/year, 10 years => 0.0220020=80$ and they sure have discount, so it's very cheap... IS there a way to know where the chip is ? Is there a way to jam it so it can't send information back ?

rad_gruchalski 4y ago
> If the car sends data back to the mothership, then who pays the phone bill You do. The bill is included in the purchase price of the vehicle. The manufacturer sources data SIMs, pays for data ahead of time, and that’s to the cehicle price.

nobody9999 4y ago

I'm a little confused by the discussion here. Please forgive me if I've missed something obvious. Much of the discussion seems to be around the government (usually, but not limited to, police) monitoring the location and operation of a vehicle on public roads. While I'm not a huge fan of government surveillance, registering a vehicle (and obtaining a driver's license) and monitoring the performance of that vehicle (and its driver(s)) are governmental functions purporting to ensure the safe operation of a vehicle. Corporate entities, like auto manufacturers, dealers and "tech" companies have no such responsibility, nor do they have any role in (except in abiding by the law/regulation -- e.g., emissions standards). So, unless there is some sort of government mandate to collect such information, corporate entities have no reason (other than their own profit) to collect location, velocity and/or in-vehicle activities. IMNSHO, that they do so should be much more concerning than red light or speed cameras, being followed for a few miles by the police, or as is popular where street parking is a thing, checking registration/inspection expiry. Just as one (or should be) is horrified by the levels of tracking by corporate entities on IOT devices, "smart" TVs, dishwashers(?!?), etc., etc., etc., why are folks focusing on the government here? They aren't gathering the boatloads of information being collected by the corporate entities (and if the government starts buying such data, they should be smacked down hard!) that are invading/destroying what little privacy we might have. As such, I don't get why the focus is on the government rather than on the folks actually gathering all this data.

devoutsalsa 4y ago
You might change your mind when the government starts tracking the fact that you drove to an abortion clinic.
- nobody9999 4y ago
  >You might change your mind when the government starts tracking the fact that you drove to an abortion clinic. Where might the government get such data? They certainly aren't gathering it themselves. Rather, it will come from the corporate entities that are already gathering such data. What's more, I can organize my neighbors to vote out folks who want to spy on me. I can't do that (well, I guess if I had a few trillion dollars to buy majority stakes in various corporations, although that wouldn't work with Facebook[0] though) with the corporations that are already spying on me. Just so I understand your position, you appear to believe that bad things a government might do with the help of corporations that are already doing those bad things is what we should be concerned about rather than what those same corporations are already doing. Is that your argument? I just want to make sure I understand, as I'd like to have a discussion and not create straw men. Thanks! [0] https://www.businessinsider.com/mark-zuckerberg-control-facebook-whistleblower-key-man-risk-2021-10?op=1 https://www.businessinsider.com/mark-zuckerberg-control-face...

xfitm3 4y ago

I installed a dummy load instead the cellular antenna in my vehicle. In theory it should not be able to connect back to my automaker's virtual mobile network.

nimbius 4y ago

I'm a diesel mechanic by trade. for anyone curious to disable your cars data collection the OnStar systems easiest. under your passenger dash is a black metal box, usually documented. unplugging the harness and removing it, you can open it to expose a baseboard and a riser. the baseboard is for things like infotainment usually but the riser is your cellular modem. pull it and you'll get a warning light on the dash, but no more data collection. older cars will have a Sim in the riser you can pull if thats less invasive to you. note: OnStar is also disabled and will not dial 911/999 on collision.

vitaflo 4y ago
This is the correct answer. Found this out when I was doing a ham radio antenna install on my car. The shark fin for the XM radio antenna (that I never use) sits on top of a hole in the roof, and a nice hole in the roof is a the perfect spot for a ham radio antenna, so I removed the shark fin. After disconnecting it I noticed it also disconnected OnStar, GPS, etc. It's all integrated into that fin. Once disconnected, the car isn't going to be able to send anything even if it tried. Only question is if your car is gonna bitch at you because it's disconnected (mine doesn't).
eyelidlessness 4y ago
Will it dial 0118 999 881 999 119 7253?
- hun3 4y ago
  For context: The IT Crowd - Series 1 - Episode 2: New emergency number https://www.youtube.com/watch?v=HWc3WY3fuZU https://www.youtube.com/watch?v=HWc3WY3fuZU
nilespotter 4y ago
nichos 4y ago
This really should be a setting in the head unit. Sadly even if it was there, I doubt I would trust it to fully disconnect.

cameldrv 4y ago

What happens if you disconnect the cellular antenna from your car?

vitaflo 4y ago
Suppose it depends on your car. Mine did nothing when I removed it. Of course you may lose access to some things you want, like XM Radio, OnStar, GPS, etc (usually all these are integrated into the same board in the shark fin on top of the car).

teeray 4y ago

This doesn’t end until data is seen by companies as a liability rather than as an asset.

fma 4y ago

I'm surprised Tesla isn't on the list? Do they still collect data to feed their self-driving car initiative?

pabs3 4y ago

I wonder if there will ever be any electric cars that let you install alternative operating systems.

kelnos 4y ago

This month I just got a new car to replace my 18-year-old Honda, which was, as you'd expect for a 2004 model year car, not connected to the internet at all. The new car sometimes feels more complicated than my smartphone, and data collection was one of my first worries. Of course there's an app that comes along with it, and while the information and remote functionality it provides is interesting, having done without this stuff for the first 25 years of my driving life, I feel like I can easily do without it. Another poster talks about removing the cellular modem to ensure the car can't phone home, and I'm seriously considering doing it. Though I imagine when I bring it in for service, the techs will want to reconnect it. I'm even afraid that they'll claim they can't service my car without doing. In addition to that, I do want to receive OTA updates to the car's software. I'm curious to know if it's possible to opt out of all data collection (perhaps aided by the CCPA, as I live in California), without modifying the car's hardware. Sure, in that case I am then relying on trust (trust that is so far unearned), but I'm curious nonetheless. The thing that worries me most is location tracking, followed by the possibility that my driving "style" could be sold to my insurance company. I've filled out the CCPA opt-out form from my car's manufacturer (though that's about sale of information, not collection), but I'm sure that's woefully insufficient to actually protect my privacy.

throw03172019 4y ago

So is this how my car insurance agency called me to tell me I am driving more miles so they want to raise my rates?

Animats 4y ago

Do cars with police packages have data collection?

exabrial 4y ago

Unplugged the sim module in my gmc. Never thought about it since.

sam-s 4y ago

The Institute for Justice (https://ij.org/ https://ij.org/) has a podcast (https://ij.org/podcasts/short-circuit/ https://ij.org/podcasts/short-circuit/) were they regularly discuss these kinds of issues. It is hard to summarize the situations briefly, but, essentially, the government can do whatever they want and the courts hardly ever slap them on the hands. (IJ also _fights_ these issues in court pro bono - they are a law firm! - so supporting them looks like a good idea. disclosure: I am not affiliated with them in any form, just a podcast listener and a very minor donor)