8 ms·

Is your connected car spying on you?

40 points by joosters 12y ago

deleted 12y ago
[deleted]
lmedinas 12y ago
There will be an interesting battle in the future for the Car Data. Will be the manufacturer or the services available in the car which will own the data ?
- backlava 12y ago
  I notice the consumer isn't a choice.
- spacefight 12y ago
  The owner of the car is and should stay the owner of the data. He should also be able to decide what and where to put his data, at any time.
  - lmedinas 12y ago
    Do you still believe in Santa Claus ? :) EDIT: The point is: The data from the Car is very valuable for lot's of parties including the Manufacturer and suppliers.
    - spacefight 12y ago
      Do you still believe, that spreading your data withouth any control throughout the world will make you safer in the end? What happens with and in a car is highly private and I wish that to remain as it is.
      - sosborn 12y ago
        I agree with your general sentiment, but what happens with a car is decidedly not private. You are on public roads and more importantly, your driving affects the safety of others.
        spacefight 12y ago
        I fully agree that the safety of my driving affects other. But that doesn't mean, that the future car must be connected nonplusultra at all. I can safely drive as if it was 1999 (or say 1990) and all I leak in data is the visual appearance of my car, the number plate and maybe how many persons are riding in that car. But where I go when and where and how long I stay there etc. etc. is none of the business of any vendor, any navigation company or any other SaaS out there running to enhance the future of driving. As long as we can opt not to choose, it's all fine, but as soon as I can't buy a new car anymore without all beeing connected and monitored (remember the voice feature here on HN about the Samsung Smart TVs leaking your private data like hell?).
      - lmedinas 12y ago
        That's not the point. The point is with connected vehicles you have to share your data if you want the car to drive itself, navigation, services from Google, auto parking etc... There is no way you will own that data.
        spacefight 12y ago
        Why not? Why can't there be a solution where you own and control your data to the full extend? Load an offline map, drive to your location, park done. Car GPS have done this for ages. I can't see why your future self driving car shouldn't be able to do the same. Heck, even if you download a current update of the trafic around you over the air, privacy _could_ be baked right into the product. It's not that we couldn't. It's waaaay more easy just to integrate your favorite cloud based engine, I see the pluses of that, but I also see the big big minuses attached to that.
        maxerickson 12y ago
        Your fatalism is a self fulfilling prophecy. I don't know much about it, but HIPAA seems to be an example of legislation that at least tries to address personal information (in a way that protects the individual...). I guess it is even fairly easy to sketch out a set of rules. Something like no aggregation of data prior to an explicit opt in, a prompt and clear method of turning off the aggregation and a way to obtain any data that is being retained, along with toothy fines for violations.
  - Silhouette 12y ago
    Indeed. One of the more dangerous potential outcomes of all this data recording and telemetry is that everyone winds up with a black box monitoring their driving full-time, which becomes de facto obligatory because you can't get something mandatory such as insurance without it. Then, because there are exactly zero perfect drivers in the world, every driver becomes subject to effectively arbitrary fines and/or increases in their insurance premiums, providing a convenient revenue stream with a captive market for both big businesses and governments. In an ideal world, such monitoring could instead lead to official recognition that no-one is perfect but interventions should be aimed at people with a sustained pattern of risky behaviour or deteriorating driving standards rather than immediately penalising a driver who made a small mistake and was unlucky to be in front of a camera at the time. But sadly I have little faith that anything so constructive would ever actually happen, given the track record of the government, the police, and the insurance industry in my country when it comes to abusing new technologies and outright lying about what they are doing/going to do. :-(
    - backlava 12y ago
      No, you should immediately punish bad driving but the punishments can be much lower.
      - JoeAltmaier 12y ago
        A profit-driven insurance company will of course use every means at their disposal to get out of paying out. That includes using every piece of information that might compromise your claim. Like the telemetry your own card is supposed to be keeping. And further, how on earth can we even know they aren't lying? If the telemetry is kept remotely by some Other profit-driven corporation, and delivered to their buddies at the insurance company.
        kps 12y ago
        Is it not connected, but every new car in the US is already required to have an event data recorder, that in a collision saves at minimum such information as speed, throttle position, whether the brakes were applied, and whether the driver was wearing a seatbelt.
pmoriarty 12y ago
"All the data we collect is anonymous and we only sell anonymised data." But there have been numerous violations of such "anonymised" data that caused the identities of the people ostensibly protected by this anonymization to be revealed. There is ongoing research in to how to make more robust, mathematical guarantees of anonymity in such datasets. Until this research comes to fruition and becomes widely deployed in industry (something that's probably decades away), I would not take much comfort in assurances from industry reps that the data the companies they represent collect or release are "anonymised".
- maxerickson 12y ago
  This post has some threads to pull for people wanting to get a picture of the research: https://freedom-to-tinker.com/blog/randomwalker/no-silver-bullet-de-identification-still-doesnt-work/ https://freedom-to-tinker.com/blog/randomwalker/no-silver-bu... The post takes a negative view on anonymised data, but there are credible comments on both sides of the discussion. (I posted it here a few months ago: https://news.ycombinator.com/item?id=8010061 https://news.ycombinator.com/item?id=8010061 )
- hackuser 12y ago
  > Until this research comes to fruition and becomes widely deployed in industry (something that's probably decades away), I would not take much comfort in assurances from industry reps that the data the companies they represent collect or release are "anonymised". Even if the technology existed I would not rely on it being deployed and used correctly: 1) There is no incentive to do it because there is little penalty if they fail; and 2) IT security in general is completely unreliable; why would this be any different? The only secure data is data that doesn't exist. Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days. If that's important for the security of their government data, which arguably should be open, why isn't it done with my data, which should be private?
  - pmoriarty 12y ago
    " Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days." Or they claim to have deleted it. And maybe, technically speaking, it has been deleted from their servers. But by then, who knows where it's been copied to. By then it might be on systems completely out of their control. I think you hit the nail on the head: "The only secure data is data that doesn't exist." No guarantees or assurances from the corporations or the government can change that.
glathull 12y ago
Huh. From the title I would have guessed this was a Wired article.
bsilvereagle 12y ago
And your car leaks information that can be used to create GUID: http://www.reddit.com/2kj10q/ http://www.reddit.com/2kj10q/
kylec 12y ago
About six months ago I bought a VW with their "CarNet" integration. I am concerned about my car relaying information about where I go and how I drive - at a minimum, I know that it notifies the dealership when I cross over a 10,000 mile boundary because I've received an email reminding me to take it in for service. I've tried to find a way to disable it, but I can't find anything online or in the user manual. I suspect that this story will become more and more common - ordinary people buying cars equipped with such systems that are unaware of the privacy implications.
- maxerickson 12y ago
  The typical solution is to unplug something (on older OnStar systems, the antenna; I guess this has gotten harder as the antenna gets harder to find).
  - hackuser 12y ago
    > The typical solution is to unplug something (on older OnStar systems, the antenna; I guess this has gotten harder as the antenna gets harder to find). Does that void the warranty on your car, or some part of it?
    - maxerickson 12y ago
      I have no idea. Typically in the U.S., such decisions have gone to owners (so they can't require dealer service in the warranty: http://www.consumer.ftc.gov/articles/0138-auto-warranties-routine-maintenance http://www.consumer.ftc.gov/articles/0138-auto-warranties-ro... Complexity has sort of created a situation where you go to the dealer anyway, but they can't deny the warranty just because you obtained proper service elsewhere)
- opendais 12y ago
  Are you 100% sure it wasn't coincidence? I don't have a connected system [e.g. it doesn't report anything because its a certified used car I got for $11k where damn near everything is manual :P] but the dealer was able to guestimate within a few months of when I would hit the mileage amount I'd need to take it in for service.
gambiting 12y ago
I am really worried that insurance companies will push for those tracker devices for everyone. If they simply make insurance policies without the trackers twice as expensive as ones with them, they will quickly become widespread, and this surveillance will become the norm. I hate this and I dread the day when it happens.
- at-fates-hands 12y ago
  You should hold out hope for every company which does this, there will be one acting with your privacy in mind and offer lower rates without the possibility of collecting your data. I think the Snowden revelations have had a huge impact on how people view their privacy now.
dreamweapon 12y ago
The fun part is, in a couple of years it basically won't be possible to drive a car (on a public road, anyway) that isn't "connected." If the legislators don't bring this bold new tomorrow down on us, the insurance companies will do so on their own.
at-fates-hands 12y ago
"At the time, chief executive Harold Goddijn promised his company would prevent the data being used in that way again." This is the crux of the issue. Companies will continue to reap the financial benefits of selling the information and then back off if they get caught. This is a very dangerous game of, "It's easier to ask for forgiveness than for permission"
- c0ur7n3y 12y ago
  A "promise" by a CEO about what his company will or won't do in the future is completely worthless.
Spooky23 12y ago
Tl;dr version: Yes we caan, but we "promise" not to.
kator 12y ago
Sometimes when I rent a car I'll poke around in the navi and sync menus. I often can see where people went in the car before from the nav history and you'd be surprised how many people sync their address book with a rental car!
Istof 12y ago
That reminds me of a Ford exec that said: 'We Know Everyone Who Breaks The Law' Thanks To Our GPS In Your Car Read more: http://www.businessinsider.com/ford-exec-gps-2014-1 http://www.businessinsider.com/ford-exec-gps-2014-1

40 points by joosters 12y ago

deleted 12y ago

[deleted]

There will be an interesting battle in the future for the Car Data. Will be the manufacturer or the services available in the car which will own the data ?

backlava 12y ago
I notice the consumer isn't a choice.
spacefight 12y ago
The owner of the car is and should stay the owner of the data. He should also be able to decide what and where to put his data, at any time.
- lmedinas 12y ago
  Do you still believe in Santa Claus ? :) EDIT: The point is: The data from the Car is very valuable for lot's of parties including the Manufacturer and suppliers.
  - spacefight 12y ago
    Do you still believe, that spreading your data withouth any control throughout the world will make you safer in the end? What happens with and in a car is highly private and I wish that to remain as it is.
    - sosborn 12y ago
      I agree with your general sentiment, but what happens with a car is decidedly not private. You are on public roads and more importantly, your driving affects the safety of others.
      - spacefight 12y ago
        I fully agree that the safety of my driving affects other. But that doesn't mean, that the future car must be connected nonplusultra at all. I can safely drive as if it was 1999 (or say 1990) and all I leak in data is the visual appearance of my car, the number plate and maybe how many persons are riding in that car. But where I go when and where and how long I stay there etc. etc. is none of the business of any vendor, any navigation company or any other SaaS out there running to enhance the future of driving. As long as we can opt not to choose, it's all fine, but as soon as I can't buy a new car anymore without all beeing connected and monitored (remember the voice feature here on HN about the Samsung Smart TVs leaking your private data like hell?).
    - lmedinas 12y ago
      That's not the point. The point is with connected vehicles you have to share your data if you want the car to drive itself, navigation, services from Google, auto parking etc... There is no way you will own that data.
      - spacefight 12y ago
        Why not? Why can't there be a solution where you own and control your data to the full extend? Load an offline map, drive to your location, park done. Car GPS have done this for ages. I can't see why your future self driving car shouldn't be able to do the same. Heck, even if you download a current update of the trafic around you over the air, privacy _could_ be baked right into the product. It's not that we couldn't. It's waaaay more easy just to integrate your favorite cloud based engine, I see the pluses of that, but I also see the big big minuses attached to that.
      - maxerickson 12y ago
        Your fatalism is a self fulfilling prophecy. I don't know much about it, but HIPAA seems to be an example of legislation that at least tries to address personal information (in a way that protects the individual...). I guess it is even fairly easy to sketch out a set of rules. Something like no aggregation of data prior to an explicit opt in, a prompt and clear method of turning off the aggregation and a way to obtain any data that is being retained, along with toothy fines for violations.
- Silhouette 12y ago
  Indeed. One of the more dangerous potential outcomes of all this data recording and telemetry is that everyone winds up with a black box monitoring their driving full-time, which becomes de facto obligatory because you can't get something mandatory such as insurance without it. Then, because there are exactly zero perfect drivers in the world, every driver becomes subject to effectively arbitrary fines and/or increases in their insurance premiums, providing a convenient revenue stream with a captive market for both big businesses and governments. In an ideal world, such monitoring could instead lead to official recognition that no-one is perfect but interventions should be aimed at people with a sustained pattern of risky behaviour or deteriorating driving standards rather than immediately penalising a driver who made a small mistake and was unlucky to be in front of a camera at the time. But sadly I have little faith that anything so constructive would ever actually happen, given the track record of the government, the police, and the insurance industry in my country when it comes to abusing new technologies and outright lying about what they are doing/going to do. :-(
  - backlava 12y ago
    No, you should immediately punish bad driving but the punishments can be much lower.
    - JoeAltmaier 12y ago
      A profit-driven insurance company will of course use every means at their disposal to get out of paying out. That includes using every piece of information that might compromise your claim. Like the telemetry your own card is supposed to be keeping. And further, how on earth can we even know they aren't lying? If the telemetry is kept remotely by some Other profit-driven corporation, and delivered to their buddies at the insurance company.
      - kps 12y ago
        Is it not connected, but every new car in the US is already required to have an event data recorder, that in a collision saves at minimum such information as speed, throttle position, whether the brakes were applied, and whether the driver was wearing a seatbelt.

pmoriarty 12y ago

"All the data we collect is anonymous and we only sell anonymised data." But there have been numerous violations of such "anonymised" data that caused the identities of the people ostensibly protected by this anonymization to be revealed. There is ongoing research in to how to make more robust, mathematical guarantees of anonymity in such datasets. Until this research comes to fruition and becomes widely deployed in industry (something that's probably decades away), I would not take much comfort in assurances from industry reps that the data the companies they represent collect or release are "anonymised".

maxerickson 12y ago
This post has some threads to pull for people wanting to get a picture of the research: https://freedom-to-tinker.com/blog/randomwalker/no-silver-bullet-de-identification-still-doesnt-work/ https://freedom-to-tinker.com/blog/randomwalker/no-silver-bu... The post takes a negative view on anonymised data, but there are credible comments on both sides of the discussion. (I posted it here a few months ago: https://news.ycombinator.com/item?id=8010061 https://news.ycombinator.com/item?id=8010061 )
hackuser 12y ago
> Until this research comes to fruition and becomes widely deployed in industry (something that's probably decades away), I would not take much comfort in assurances from industry reps that the data the companies they represent collect or release are "anonymised". Even if the technology existed I would not rely on it being deployed and used correctly: 1) There is no incentive to do it because there is little penalty if they fail; and 2) IT security in general is completely unreliable; why would this be any different? The only secure data is data that doesn't exist. Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days. If that's important for the security of their government data, which arguably should be open, why isn't it done with my data, which should be private?
- pmoriarty 12y ago
  " Already there are government agencies that automatically delete internal communication (e.g., emails) within 30 days." Or they claim to have deleted it. And maybe, technically speaking, it has been deleted from their servers. But by then, who knows where it's been copied to. By then it might be on systems completely out of their control. I think you hit the nail on the head: "The only secure data is data that doesn't exist." No guarantees or assurances from the corporations or the government can change that.

glathull 12y ago

Huh. From the title I would have guessed this was a Wired article.

bsilvereagle 12y ago

And your car leaks information that can be used to create GUID: http://www.reddit.com/2kj10q/ http://www.reddit.com/2kj10q/

kylec 12y ago

About six months ago I bought a VW with their "CarNet" integration. I am concerned about my car relaying information about where I go and how I drive - at a minimum, I know that it notifies the dealership when I cross over a 10,000 mile boundary because I've received an email reminding me to take it in for service. I've tried to find a way to disable it, but I can't find anything online or in the user manual. I suspect that this story will become more and more common - ordinary people buying cars equipped with such systems that are unaware of the privacy implications.

maxerickson 12y ago
The typical solution is to unplug something (on older OnStar systems, the antenna; I guess this has gotten harder as the antenna gets harder to find).
- hackuser 12y ago
  > The typical solution is to unplug something (on older OnStar systems, the antenna; I guess this has gotten harder as the antenna gets harder to find). Does that void the warranty on your car, or some part of it?
  - maxerickson 12y ago
    I have no idea. Typically in the U.S., such decisions have gone to owners (so they can't require dealer service in the warranty: http://www.consumer.ftc.gov/articles/0138-auto-warranties-routine-maintenance http://www.consumer.ftc.gov/articles/0138-auto-warranties-ro... Complexity has sort of created a situation where you go to the dealer anyway, but they can't deny the warranty just because you obtained proper service elsewhere)
opendais 12y ago
Are you 100% sure it wasn't coincidence? I don't have a connected system [e.g. it doesn't report anything because its a certified used car I got for $11k where damn near everything is manual :P] but the dealer was able to guestimate within a few months of when I would hit the mileage amount I'd need to take it in for service.

gambiting 12y ago

I am really worried that insurance companies will push for those tracker devices for everyone. If they simply make insurance policies without the trackers twice as expensive as ones with them, they will quickly become widespread, and this surveillance will become the norm. I hate this and I dread the day when it happens.

at-fates-hands 12y ago
You should hold out hope for every company which does this, there will be one acting with your privacy in mind and offer lower rates without the possibility of collecting your data. I think the Snowden revelations have had a huge impact on how people view their privacy now.

dreamweapon 12y ago

The fun part is, in a couple of years it basically won't be possible to drive a car (on a public road, anyway) that isn't "connected." If the legislators don't bring this bold new tomorrow down on us, the insurance companies will do so on their own.

at-fates-hands 12y ago

"At the time, chief executive Harold Goddijn promised his company would prevent the data being used in that way again." This is the crux of the issue. Companies will continue to reap the financial benefits of selling the information and then back off if they get caught. This is a very dangerous game of, "It's easier to ask for forgiveness than for permission"

c0ur7n3y 12y ago
A "promise" by a CEO about what his company will or won't do in the future is completely worthless.

Spooky23 12y ago

Tl;dr version: Yes we caan, but we "promise" not to.

kator 12y ago

Sometimes when I rent a car I'll poke around in the navi and sync menus. I often can see where people went in the car before from the nav history and you'd be surprised how many people sync their address book with a rental car!

Istof 12y ago

That reminds me of a Ford exec that said: 'We Know Everyone Who Breaks The Law' Thanks To Our GPS In Your Car Read more: http://www.businessinsider.com/ford-exec-gps-2014-1 http://www.businessinsider.com/ford-exec-gps-2014-1