6 ms·

GM stops sharing driver data with brokers amid backlash

101 points by quantified 3y ago

quantified 3y ago
Though, that's not really what GM says.
mullingitover 3y ago
It's amazing how defeated we are as citizens and consumers. Ideally we wouldn't hear that GM is just walking this back, but that GM executives who cooked up this scheme were already indicted and facing serious federal prison time. Selling personally identifiable tracking information like this is akin to AT&T selling recordings of all your voice calls to the highest bidder.
- b112 3y ago
  More like, AT&T selling location and tower tracking data, linked to your identity and unique phone info, such as GSM Sim serial numbers and so on, which can be linked to your phone. And even if you use pay-as-you-go SIMs, if you use a credit card once, your real-world ID is linked to the phone. And even selling services like alerts when such providers move out of a geo-located region, a person's domicile, and so on. Of course, that'd never happen... right? I agree that this -- all of this, needs to be defined as criminal activity. That once such laws are passed, boards of directors, and executives face jail time, should they breach such laws. What we'll likely need, in the end, is a mandated CTO position, with responsibilities and duties akin to a CFO.
  - m463 3y ago
    I found it interesting how your cellphone location data is sold with your implied consent. Like if you are looking for roadside assistance.
    - doredi 3y ago
      Part of the issue is how we are conditioned by the ruling class to use benign words like "interesting" when we know more accurate words would convey passion, meaning, and actual anger towards those who want our data.
      - bborud 3y ago
        If you allow there to be a ruling class in a democracy, is it still a democracy?
        JumpCrisscross 3y ago
        > If you allow there to be a ruling class in a democracy, is it still a democracy Yes, democracy is about fracturing the elite and making its membership more porous. Not wand waving it away.
      - m463 3y ago
        I used the word more tongue-in-cheek. Not that I don't agree with your point about ambiguous use of words, or euphemisms to minimize or normalize bad behavior. Words like "telemetry" or "advertising", which nowadays mean "conduct surveillance on someone and keep a detailed dossier"
  - itsoktocry 3y ago
    >What we'll likely need, in the end, is a mandated CTO position, with responsibilities and duties akin to a CFO. Yeah, let's mandate a position where people are calling for your head (literally) when you make a stupid call. Who wants the job? Any takers?
    - fragmede 3y ago
      CISO is a well paid job for exactly that reason.
    - alwa 3y ago
      If you don’t set high expectations and hold decisionmakers accountable to the consequences of their decisions, why would you expect the quality of their decisions to be high rather than merely expedient? It sounds like the pay for that position should be high enough to compensate for the risk, and that the penalty for failure should be consequential enough that only people with the talent, skills, and judgment to be confident in their decisions would take the job. The financial people have skin in the game in the form of this kind of personal legal liability, and that seems to keep the financial shenanigans mainly on the “obscure but within the letter of the law” side of the line no matter what kind of pressure the CEO might bring to bear to cook the books. When security and technical governance are a cost center and compliance is optional (or, at worst, a potential PR threat)—and when privacy has no concrete value but data does—wouldn’t it be bad business not to monetize the data and be quiet about it so as to minimize the PR threat?
- Jensson 3y ago
  GDPR solves exactly this, they are legally not allowed to sell this data in EU without explicit consent from you describing who to sell it to.
  - frankjr 3y ago
    Wouldn't this be covered by some innocent looking paragraph hidden in the middle of the contract when buying the car?
    - xxs 3y ago
      it won't stand in regards to GDPR. GDPR consent has to be freely given (and taken at any time), can't use legal lingo either.
    - bryanrasmussen 3y ago
      legal consent in GDPR needs to be understandable, can not be hidden in any way, and easy to remove. The common lawyer's hack of hiding it in a big long unreadable contract won't cut it, and should lead to fines. Everybody talks crap about the GDPR, but as someone who, while not a lawyer, has worked on technical laws and standardization, I gotta say they really did a great job on not letting any companies have an easy out.
      - xxs 3y ago
        gotta agree, it's a very approachable piece of regulation for a non-lawyer.
    - JumpCrisscross 3y ago
      > innocent looking paragraph hidden in the middle of the contract This is the source of the problem and requires legislation to fix. Starting with clickwrap.
    - ledoge 3y ago
      Facebook tried to pull something similar, and it was eventually ruled illegal: https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag...
- itsoktocry 3y ago
  >but that GM executives who cooked up this scheme were already indicted and facing serious federal prison time. This is not remotely close to having your personal phone calls recorded and sold. Not even close. Guess what? Your terrible driving habits put me and my family at risk, so I'm not up in arms if your insurance company knows about it when you aren't pretending to drive safely in front of a police officer. If you continuously break laws and can't afford insurance, everyone wins (but you). Did GM overstep? Probably. People complained and it's rectified. The idea that you want to throw executives in prison for a long time for this is beyond absurd.
  - deleted 3y ago
    [deleted]
  - fragmede 3y ago
    My insurance company knowing how aggressively I drive, vs someone knowing exactly where I am, is an important distinction to make. Knowing that I'm doing 110 and weaving in and out of traffic and putting you at risk is one thing. knowing that I don't do that and am driving safely but knowing which 7-11 I'm parked out in front of, is not. Jail time for executives is how to incentivize corporations to behave a certain way beyond leveling fines. Look how quickly Craigslist closed their personals ads after FOSTA was passed. I don't agree with FOSTA, and think it does more harm than good, but jail time for executives is not absurd. I don't want people I don't know tracking my exact location, it's as simple as that.
google234123 3y ago
I’ve had a gm car with onstar- can who can I contact to see if my data was shared. And can I join to class action?
- rockskon 3y ago
  You request your information from LexisNexis at https://consumer.risk.lexisnexis.com/ https://consumer.risk.lexisnexis.com/ to find out.
rf15 3y ago
"We're sorry we got caught" in all its beauty. But I wish other companies, especially telcos, would be a little more bothered by this.
- soco 3y ago
  I wish we developers would be more bothered by this. Because we made it possible by implementing the interfaces and data transfers.
  - loeg 3y ago
    The vast majority of us have never worked for GM or LexisNexis.
    - blitzar 3y ago
      If they gave me the pay, the options, the benefits the "we developers" round here expect these days I would happily harvest anything they asked from their customers.
      - fragmede 3y ago
        Maybe, but project dragonfly didn’t get known to the public because those employees were underpaid.
  - ponector 3y ago
    If your CTO will say: next quarter we will start to record and sell user's data. Will you start working on the implementation or sign the resignation letter?
    - JohnFen 3y ago
      Resignation. That's not even a hard call.
      - 3y ago
Brian_K_White 3y ago
"customer trust is a priority to us" Really? Well then someone is super crazy incompetent. You fired them already right? Whoever decided to do this in the first place, they're shitcanned for doing something so diametrically opposed to the companys priorities right?
- Larrikin 3y ago
  This seems like it will be part of the investigative journalism of the future. Interviewing the people who implemented the gross feature to say who the product managers and VPs were that handed down the ticket.
- frankjr 3y ago
  Reminds me of cookie banners. "Your privacy is important to us!" and then they present you with a dialog that nudges you to consent to sharing your data with hundreds of companies.
- bryanrasmussen 3y ago
  it's a priority, a really low priority but still prioritized.
- JohnFen 3y ago
  Never trust anyone who says "trust me".
reacharavindh 3y ago
This is the same company that knew of a faulty ignition key system and chose to sit on it because it was too expensive to recall right? Seems like their way of business.
- fransje26 3y ago
  I guess Fight Club was not far off the mark.. https://www.youtube.com/watch?v=IA2EBWFCULg https://www.youtube.com/watch?v=IA2EBWFCULg
MobileVet 3y ago
I poked around and found this [1] guide to terminating the OnStar antenna. It’s great because it is non destructive and easily reversible. I ordered the $7 of parts and made the modification yesterday ironically. No more watching [1] https://imgur.com/gallery/n00QKnH https://imgur.com/gallery/n00QKnH
konschubert 3y ago
Independent of the data privacy question, I think it is good to make unsafe drivers pay more for insurance. Safe drivers should not have to subsidise their insurance.
- JumpCrisscross 3y ago
  > it is good to make unsafe drivers pay more for insurance. Safe drivers should not have to subsidise their insurance And you know what, that’s a fair deal. If I had strong privacy protections, e.g. open-source code that homomorphically encrypts my driving data and guarantees it’s being used to update a model and then deleted, I’d sign up. But the offer has to be clear and opt in. And I don’t want to be in a situation where someone borrows my car and I start getting letters about why they visited an abortion clinic in such and such state.
  - Tabular-Iceberg 3y ago
    > I start getting letters about why they visited an abortion clinic in such and such state. Sounds fair enough to me if premiums are going to be tied to driver behavior. Either opt out or don’t lend your car to those procuring abortions.
  - itsoktocry 3y ago
    >And I don’t want to be in a situation where someone borrows my car and I start getting letters about why they visited an abortion clinic in such and such state. How is it any different than someone standing outside the abortion clinic and observing who is parked and who goes in and out of the clinic?
    - JumpCrisscross 3y ago
      > How is it any different than someone standing outside the abortion clinic and observing who is parked and who goes in and out of the clinic? Because that person, presumably a law-enforcement officer, is visible and physically in one place. Also, I am describing a hypothetical where a woman in a state where abortion is banned travels out of state to get the procedure. That’s simply not something one can police with traditional tools.
deleted 3y ago
[deleted]
sebstefan 3y ago
Don't like that such sensitive data would be transiting through private for-profit entities But there should definitely be a reevaluation of our expectations when it comes to licensed vehicles keeping their owners dirty secrets. 1) You are driving on a public road 2) The vehicle requires a permit 3) The road has traffic codes 4) You've decided to forego traffic codes. It's come to be expected that your car wouldn't rat on you because we had technology limitations. Should it be expected still? I don't think so... Maybe fuck the privacy of drivers and maybe cars should be expected to rat about their owners if they are to be allowed on public roads? There can be privacy on vehicles that don't require a license
- quantified 3y ago
  Braking hard to avoid an animal, another car swerving into your path, or a sneaky-short yellow light are not "dirty secrets" or foregoing traffic codes. Accelerating, stopping hard? It totally depends on conditions. We're no more or less safe than we were before monitoring. And this is unagreed-to monitoring, via hidden channels. Let drivers in police states experience this first.
  - sebstefan 3y ago
    It depends on conditions. You can think of various ways to gather more of them as cars get fancier, and other ways to part exceptions from a habit of bad driving to make sure that any case reported to a human isn't a waste of their time. Then for what goes through you've got a system to challenge fines already - something completely mandatory in such a system and which can only be achieved in a powerful democratic state
johnea 3y ago
The headline continues to be overstated. GM didn't announce it was stopping the sale of driver data, only that it would no longer sell to the 2 data brokers implicated in passing the data on to insurance firms: “OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk,” a G.M. spokeswoman, Malorie Lucich, said

101 points by quantified 3y ago

Though, that's not really what GM says.

It's amazing how defeated we are as citizens and consumers. Ideally we wouldn't hear that GM is just walking this back, but that GM executives who cooked up this scheme were already indicted and facing serious federal prison time. Selling personally identifiable tracking information like this is akin to AT&T selling recordings of all your voice calls to the highest bidder.

b112 3y ago
More like, AT&T selling location and tower tracking data, linked to your identity and unique phone info, such as GSM Sim serial numbers and so on, which can be linked to your phone. And even if you use pay-as-you-go SIMs, if you use a credit card once, your real-world ID is linked to the phone. And even selling services like alerts when such providers move out of a geo-located region, a person's domicile, and so on. Of course, that'd never happen... right? I agree that this -- all of this, needs to be defined as criminal activity. That once such laws are passed, boards of directors, and executives face jail time, should they breach such laws. What we'll likely need, in the end, is a mandated CTO position, with responsibilities and duties akin to a CFO.
- m463 3y ago
  I found it interesting how your cellphone location data is sold with your implied consent. Like if you are looking for roadside assistance.
  - doredi 3y ago
    Part of the issue is how we are conditioned by the ruling class to use benign words like "interesting" when we know more accurate words would convey passion, meaning, and actual anger towards those who want our data.
    - bborud 3y ago
      If you allow there to be a ruling class in a democracy, is it still a democracy?
      - JumpCrisscross 3y ago
        > If you allow there to be a ruling class in a democracy, is it still a democracy Yes, democracy is about fracturing the elite and making its membership more porous. Not wand waving it away.
    - m463 3y ago
      I used the word more tongue-in-cheek. Not that I don't agree with your point about ambiguous use of words, or euphemisms to minimize or normalize bad behavior. Words like "telemetry" or "advertising", which nowadays mean "conduct surveillance on someone and keep a detailed dossier"
- itsoktocry 3y ago
  >What we'll likely need, in the end, is a mandated CTO position, with responsibilities and duties akin to a CFO. Yeah, let's mandate a position where people are calling for your head (literally) when you make a stupid call. Who wants the job? Any takers?
  - fragmede 3y ago
    CISO is a well paid job for exactly that reason.
  - alwa 3y ago
    If you don’t set high expectations and hold decisionmakers accountable to the consequences of their decisions, why would you expect the quality of their decisions to be high rather than merely expedient? It sounds like the pay for that position should be high enough to compensate for the risk, and that the penalty for failure should be consequential enough that only people with the talent, skills, and judgment to be confident in their decisions would take the job. The financial people have skin in the game in the form of this kind of personal legal liability, and that seems to keep the financial shenanigans mainly on the “obscure but within the letter of the law” side of the line no matter what kind of pressure the CEO might bring to bear to cook the books. When security and technical governance are a cost center and compliance is optional (or, at worst, a potential PR threat)—and when privacy has no concrete value but data does—wouldn’t it be bad business not to monetize the data and be quiet about it so as to minimize the PR threat?
Jensson 3y ago
GDPR solves exactly this, they are legally not allowed to sell this data in EU without explicit consent from you describing who to sell it to.
- frankjr 3y ago
  Wouldn't this be covered by some innocent looking paragraph hidden in the middle of the contract when buying the car?
  - xxs 3y ago
    it won't stand in regards to GDPR. GDPR consent has to be freely given (and taken at any time), can't use legal lingo either.
  - bryanrasmussen 3y ago
    legal consent in GDPR needs to be understandable, can not be hidden in any way, and easy to remove. The common lawyer's hack of hiding it in a big long unreadable contract won't cut it, and should lead to fines. Everybody talks crap about the GDPR, but as someone who, while not a lawyer, has worked on technical laws and standardization, I gotta say they really did a great job on not letting any companies have an easy out.
    - xxs 3y ago
      gotta agree, it's a very approachable piece of regulation for a non-lawyer.
  - JumpCrisscross 3y ago
    > innocent looking paragraph hidden in the middle of the contract This is the source of the problem and requires legislation to fix. Starting with clickwrap.
  - ledoge 3y ago
    Facebook tried to pull something similar, and it was eventually ruled illegal: https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag...
itsoktocry 3y ago
>but that GM executives who cooked up this scheme were already indicted and facing serious federal prison time. This is not remotely close to having your personal phone calls recorded and sold. Not even close. Guess what? Your terrible driving habits put me and my family at risk, so I'm not up in arms if your insurance company knows about it when you aren't pretending to drive safely in front of a police officer. If you continuously break laws and can't afford insurance, everyone wins (but you). Did GM overstep? Probably. People complained and it's rectified. The idea that you want to throw executives in prison for a long time for this is beyond absurd.
- deleted 3y ago
  [deleted]
- fragmede 3y ago
  My insurance company knowing how aggressively I drive, vs someone knowing exactly where I am, is an important distinction to make. Knowing that I'm doing 110 and weaving in and out of traffic and putting you at risk is one thing. knowing that I don't do that and am driving safely but knowing which 7-11 I'm parked out in front of, is not. Jail time for executives is how to incentivize corporations to behave a certain way beyond leveling fines. Look how quickly Craigslist closed their personals ads after FOSTA was passed. I don't agree with FOSTA, and think it does more harm than good, but jail time for executives is not absurd. I don't want people I don't know tracking my exact location, it's as simple as that.

google234123 3y ago

I’ve had a gm car with onstar- can who can I contact to see if my data was shared. And can I join to class action?

rockskon 3y ago
You request your information from LexisNexis at https://consumer.risk.lexisnexis.com/ https://consumer.risk.lexisnexis.com/ to find out.

rf15 3y ago

"We're sorry we got caught" in all its beauty. But I wish other companies, especially telcos, would be a little more bothered by this.

soco 3y ago
I wish we developers would be more bothered by this. Because we made it possible by implementing the interfaces and data transfers.
- loeg 3y ago
  The vast majority of us have never worked for GM or LexisNexis.
  - blitzar 3y ago
    If they gave me the pay, the options, the benefits the "we developers" round here expect these days I would happily harvest anything they asked from their customers.
    - fragmede 3y ago
      Maybe, but project dragonfly didn’t get known to the public because those employees were underpaid.
- ponector 3y ago
  If your CTO will say: next quarter we will start to record and sell user's data. Will you start working on the implementation or sign the resignation letter?
  - JohnFen 3y ago
    Resignation. That's not even a hard call.
    - 3y ago

Brian_K_White 3y ago

"customer trust is a priority to us" Really? Well then someone is super crazy incompetent. You fired them already right? Whoever decided to do this in the first place, they're shitcanned for doing something so diametrically opposed to the companys priorities right?

Larrikin 3y ago
This seems like it will be part of the investigative journalism of the future. Interviewing the people who implemented the gross feature to say who the product managers and VPs were that handed down the ticket.
frankjr 3y ago
Reminds me of cookie banners. "Your privacy is important to us!" and then they present you with a dialog that nudges you to consent to sharing your data with hundreds of companies.
bryanrasmussen 3y ago
it's a priority, a really low priority but still prioritized.
JohnFen 3y ago
Never trust anyone who says "trust me".

reacharavindh 3y ago

This is the same company that knew of a faulty ignition key system and chose to sit on it because it was too expensive to recall right? Seems like their way of business.

fransje26 3y ago
I guess Fight Club was not far off the mark.. https://www.youtube.com/watch?v=IA2EBWFCULg https://www.youtube.com/watch?v=IA2EBWFCULg

MobileVet 3y ago

I poked around and found this [1] guide to terminating the OnStar antenna. It’s great because it is non destructive and easily reversible. I ordered the $7 of parts and made the modification yesterday ironically. No more watching [1] https://imgur.com/gallery/n00QKnH https://imgur.com/gallery/n00QKnH

konschubert 3y ago

Independent of the data privacy question, I think it is good to make unsafe drivers pay more for insurance. Safe drivers should not have to subsidise their insurance.

JumpCrisscross 3y ago
> it is good to make unsafe drivers pay more for insurance. Safe drivers should not have to subsidise their insurance And you know what, that’s a fair deal. If I had strong privacy protections, e.g. open-source code that homomorphically encrypts my driving data and guarantees it’s being used to update a model and then deleted, I’d sign up. But the offer has to be clear and opt in. And I don’t want to be in a situation where someone borrows my car and I start getting letters about why they visited an abortion clinic in such and such state.
- Tabular-Iceberg 3y ago
  > I start getting letters about why they visited an abortion clinic in such and such state. Sounds fair enough to me if premiums are going to be tied to driver behavior. Either opt out or don’t lend your car to those procuring abortions.
- itsoktocry 3y ago
  >And I don’t want to be in a situation where someone borrows my car and I start getting letters about why they visited an abortion clinic in such and such state. How is it any different than someone standing outside the abortion clinic and observing who is parked and who goes in and out of the clinic?
  - JumpCrisscross 3y ago
    > How is it any different than someone standing outside the abortion clinic and observing who is parked and who goes in and out of the clinic? Because that person, presumably a law-enforcement officer, is visible and physically in one place. Also, I am describing a hypothetical where a woman in a state where abortion is banned travels out of state to get the procedure. That’s simply not something one can police with traditional tools.

deleted 3y ago

[deleted]

sebstefan 3y ago

Don't like that such sensitive data would be transiting through private for-profit entities But there should definitely be a reevaluation of our expectations when it comes to licensed vehicles keeping their owners dirty secrets. 1) You are driving on a public road 2) The vehicle requires a permit 3) The road has traffic codes 4) You've decided to forego traffic codes. It's come to be expected that your car wouldn't rat on you because we had technology limitations. Should it be expected still? I don't think so... Maybe fuck the privacy of drivers and maybe cars should be expected to rat about their owners if they are to be allowed on public roads? There can be privacy on vehicles that don't require a license

quantified 3y ago
Braking hard to avoid an animal, another car swerving into your path, or a sneaky-short yellow light are not "dirty secrets" or foregoing traffic codes. Accelerating, stopping hard? It totally depends on conditions. We're no more or less safe than we were before monitoring. And this is unagreed-to monitoring, via hidden channels. Let drivers in police states experience this first.
- sebstefan 3y ago
  It depends on conditions. You can think of various ways to gather more of them as cars get fancier, and other ways to part exceptions from a habit of bad driving to make sure that any case reported to a human isn't a waste of their time. Then for what goes through you've got a system to challenge fines already - something completely mandatory in such a system and which can only be achieved in a powerful democratic state

johnea 3y ago

The headline continues to be overstated. GM didn't announce it was stopping the sale of driver data, only that it would no longer sell to the 2 data brokers implicated in passing the data on to insurance firms: “OnStar Smart Driver customer data is no longer being shared with LexisNexis or Verisk,” a G.M. spokeswoman, Malorie Lucich, said