Privacy First dives into the world of connected cars

This piece in five points:

• All cars rolling off the assembly line these days are connected to the internet. Within a few years, connected cars - also known as smart cars - will be in the majority. Today's connected cars are the prelude to tomorrow's self-driving cars.

• As part of the Internet of Things, connected cars should eventually connect with each other (Vehicle-to-Vehicle, V2V), with infrastructure such as traffic lights (Vehicle-to-Infrastructure, V2I) and everything else with which a connection is desirable or necessary (Vehicle-to-Everything, V2X), including, for example, pedestrians' smartphones or smartwatches (Vehicle-to-Pedestrians, V2P). Among other things, all this should lead to increased road safety, reduced congestion and more efficient routes.

• For now, a connected car is mainly in contact with the car manufacturer, which receives all kinds of data from vehicles. This includes not only technical data, but also personal data. Preference settings, driving behaviour, routes, GPS locations, destinations, times, camera images from inside and outside the car, sensitive information from your phone connected to the on-board computer as well as, for example, health and biometric data can be collected.

• Based on a global analysis of a large number of reports and media articles on connected cars, Privacy First concludes that in some respects very little seems to have changed over the past - plus-minus - ten years. The privacy risks that were warned about around 2012 are still there today - despite the General Data Protection Regulation - while awareness of them hardly seems to have increased.

• In other respects, though, things are changing: in fact, within the car industry, vehicles have long ceased to be seen merely as means of transport with which to travel from A to B. They have become (very large) gadgets that now stunt software as much as horsepower. Precisely because cars are connected to the internet, they are now considered ideally suited to selling all kinds of subscriptions, services and technical features. In turn, car owners are increasingly approached as consumers of information and entertainment.

Not a PC, laptop or tablet but a car is the most powerful and valuable computer many people own. The sophisticated software and electronics that modern cars are equipped with facilitate driving, point the way via navigation and help with parking. Today, a new vehicle is soon equipped with one hundred million lines of programming language.

The use of computers in cars is nothing new. The first automated systems in vehicles appeared as early as 1969. The ability to read the technical state of a vehicle via 'on-board diagnostics' (OBD) was introduced in the 1980s and standardised in the 1990s.

We are now decades on and cars, especially under the skin, bear little resemblance to their predecessors. New ones are often electric and have all kinds of driving assistance systems (Advanced Driver-Assistance Systems), a good number of which have now been withdrawn by the EU for security reasons mandated. Think emergency braking systems, lane-keeping assistance and automatic speed reduction.

Car technology is progressing logically, but there is one development in particular that is radically changing car use and mobility: connection to the internet. All models manufactured now come with a SIM card and are known as 'connected'. The number of 'connected cars' is growing steadily: they will be in the majority in most (Western) countries within a few years. This provides a wealth of new opportunities.

The manufacturers

If it is up to manufacturers and governments vehicles become an integral part of the Internet of Things. Within that developing Internet of Things, an infinite number of objects, devices and systems exchange data with each other. Connected cars are connected to the manufacturer, here and there already to each other (Vehicle-to-Vehicle, V2V) and the infrastructure such as traffic lights (Vehicle-to-Infrastructure, V2I), and eventually, it is envisaged, everything else with which a connection is desirable or necessary (Vehicle-to-Everything, V2X). This could also include pedestrians' smartphones or smartwatches (Vehicle-to-Pedestrians, V2P).

Such forms of communication should turn cities into smart-operating environments (smart cities). Connected cars should additionally provide more road safety, more efficient routes, fewer traffic jams, more economical driving and more trivial things like being able to find a parking space more easily. Comfort, convenience and efficiency reign supreme, but for the motorist, there is also a downside.

Big data generated by modern cars (up to 25Gb per hour) are sent straight back to the manufacturer, albeit sometimes somewhat delayed. Connected cars, also known as smart cars in fact, are first and foremost in contact with what are often referred to as the Original Equipment Manufacturers ('OEMs'). This is done with a view to monitoring performance, (predictable) maintenance, software updates (increasingly over the air) and overall product improvement.

However, it is not just about technical data such as oil level, engine temperature, fuel consumption, and mileage, also personal data (personally identifiable information, PII) are collected. In many cases, this is not so much out of necessity as for commercial reasons. By no means every motorist is aware of this. The phone apps to keep abreast of a car's overall status also appear to collect more personal data than necessary. In doing so, the car has become yet another tool that the privacy of hundreds of millions of people. The imagery is by now somewhat trite, but the latest cars can rightly be called smartphones on wheels.

After all, preference settings, driving behaviour, routes, GPS locations, destinations, times, camera images from inside and outside the car, all kinds of sensitive information from your phone connected to the on-board computer as well as, for example, health and biometric data can all be tracked and collected.

Such information is valuable and therefore sought-after. In a general sense, the more relevant vehicle data, the greater manufacturers' profits can potentially be. Consultancy firm Capgemini darling that the vehicle data market could be worth up to USD 800 billion globally by 2030. In a few years, the data gathered is expected to yield more than regular maintenance. However, it is not just car brands that are preying on vehicle data.

Manufacturers are surrounded by a web of suppliers and companies specialising in software, infotainment, telematics, telecommunications and data processing and analysis. Importers, dealers, secondary market players such as garage owners (the aftermarket), rental companies and insurers, for example, are part of this ecosystem. These parties work together, depend on each other but with conflicting interests sometimes also in competition with each other. Common denominator is that everyone wants to get a piece of the lucrative (personal) data generated by vehicles.

Privacy First launches investigation

Privacy First is keen to understand more about how this ecosystem works and the power relations within it, and to draw more attention to the large-scale data collection by the automotive industry and the privacy issues involved. We will therefore be diving into this complex topic in the coming period.

Through articles and interviews with experts, we aim to explore the topic in more depth from different angles. For example, connected cars involve a lot of technology, there are legal snags to situations that previously did not occur and certain third-party services have evolved along with innovations within the automotive sector.

Consider, for example, insurers that digitally monitor the car in exchange for a discount on the premium. Such riding insurance have been commonplace for years, including in the Netherlands. Most striking example here is ANWB's car insurance. Where one branch of this organisation adopted the principle of my car, my data promoting and urging car owners to take control of their own vehicle data as much as possible, the department dealing with insurance the driving behaviour of motorists with the Safe Driving car insurance closely.

Meanwhile, the traditional roles of manufacturer and car owners are shifting. Indeed, within the car industry, vehicles have long ceased to be seen merely as means of transport with which to travel from A to B. They have become (very big) gadgets that now stunt software as much as horsepower. Precisely because cars are connected to the internet, they are now considered eminently suitable for all kinds of subscriptions, services and technical features with it. In turn, car owners are increasingly approached as consumers of information and entertainment. Some will find it more pleasant than others to be pushed into the role of consumer even after buying a car.

In this respect, by the way, one might ask whether demand leads to supply, or supply leads to demand. Who was in need of an iPhone in 1995? In 2007, would there have been motorists eager for an heated steering wheel Or the ability to conjure up your shopping list on the dashboard?

Connected cars; a hot topic

It is clear from the many links in this article that Privacy First is not entering virgin territory. Connected cars have been in the spotlight for quite some time. Over the past decade, numerous scientists, commercial and fewer commercial research agencies, accounting firms, NGOs, personal data authorities, consumer associations and government agencies articles and reports on the topic have been published at home and abroad. There are campaigns conducted to raise awareness about the privacy dangers of connected cars and, of course, all the developments have also been widely reported in the media.

In the Netherlands, these include Wed (Smart cars are taking over our lives with the data they collect), De Groene Amsterdammer/Investico (The car, a data repository), FD (Torrent of data from motorist to manufacturer and third parties) and the online tech platform Tweakers (The car as data collector) delved into the subject.

The news item Carmakers are collecting data and cashing in - and most drivers have no clue From CBS and the articles Connected Cars Are Just As Revolutionary As Electric Vehicles from Forbes and Who Is Collecting Data from Your Car? from The Markup are just a few salient examples of media coverage from abroad, in this case the US.

Privacy remains child of the bill

With the advent of the General Data Protection Regulation (AVG), motoring consumers are in a bit stronger position. The European Data Protection Board, which grew out of the AVG, has provided specifically in the context of connected vehicles detailed guidelines regarding the processing of personal data. Those guidelines fall in the motorist's favour.

Yet, based on a global analysis of a large amount of reports, media articles, lectures and discussions on connected cars, Privacy First concludes that in some respects very little seems to have changed over the past - plus-minus - ten years. The privacy risks warned about around 2012 are still there today, while awareness of them does not seem to have increased significantly. Moreover, it is still largely up to drivers themselves to ensure that their data is handled carefully.

The elongated privacy statements to which they almost always agree with a thoughtless signature when buying a car are as legal as they are incomprehensible to most people. Given the complexity of such statements, consumers cannot reasonably be expected to understand or even read them either. Let alone that they will be able to compare the statements of different brands.

In addition, the question remains to what extent manufacturers actually offer their customers the option of not being tracked (opt out). And if you can choose to do so at all, to what extent does that affect (negatively) the car's performance? Tesla drivers who don't want to share location data are warned that doing so could result in serious damage to the car. Surely that has all the appearance of a knife-edge tactic.

Yes, there is a lot for motorists to consider. For example, what happens to your data when there are multiple users, such as in a shared or rental car? You do well to delete those at the end of a drive. Owners who use their voiture get rid of, the on-board computer had better be reset to factory settings. If you don't, you may just find that months later you are still have access to a car now owned by someone else.

As leaky as a basket

Not yet addressed but of great importance is cybersecurity. After all, there is no privacy without security. And any privacy policy is only as strong as the security system behind it. Here, too, a worrying constant can be discerned over the years: time and again, it comes to light that car manufacturers (and sometimes related parties) do not have the security of their cars in order.

This picture was spectacularly confirmed last week when US researchers showed that the security of both 'normal' and luxury cars (from Kia's to Ferraris) is grossly inadequate. Not only do car owners' personal accounts appear to be viewable, editable and even replaceable, the overall controls of various models can be hacked and thus taken over in numerous ways. Including by starting the engine or just turning it off. In short, both the privacy and physical safety of drivers and passengers are at risk.

It is the latest example in a extensive list of benign (white hat) car hacks. Back in 2010 - the early days of connected cars - scientists were already showing what is in this area possible. In 2015, a journalist from Wired report of how two men armed with a laptop took over his Jeep while he was driving alone on the highway. It became the most talked about (pre-arranged) computer hacking of a car to date.

Researchers at TU Delft and two people from the police warn in a joint article that a fundamental gap exists between automotive safety and security. The investments made by the car industry in safety [such as crash tests] are in sharp contrast to the investments in security of confidentiality, integrity and availability of information flows in the car. People add all kinds of comforts, but do not invest enough in securing those comforts, nor in securing the car's internet connection.''

As far as we know, criminals or others with malicious intentions have so far hardly exploited these vulnerabilities in vehicles. This is striking. But the more digital technology is exploited, the more there is to hack, and that is not necessarily reassuring. Meanwhile, cars now rolling off the assembly line must comply with cybersecurity requirements to be approved. It will be interesting in the coming time to see if security is actually beefed up as a result.

It may also prompt manufacturers to deal with another persistent security problem that can affect car owners. Keyless entry', the system that allows cars to be remotely unlocked without the use of keys, also turns out to be as leaky as a sieve in many cases. For somewhat shrewd thieves, this system is on many cars a breeze to crack, according to repeated research by ADAC, the German ANWB. And once open, a car is so stolen.

From connected to self-driving

We cannot avoid it, so finally we take a brief look at that other radical development within the car industry. After all, today's connected cars are not the end station, but the prelude to tomorrow's self-driving cars. Self-driving cars and connected cars are often mentioned in the same breath and cannot be separated. At least, where today's connected cars are only partially self-driving, the fully self-driving cars of the future will by definition be connected to the internet. Without the internet, they will not move from their seats.

A distinction is made between six levels of self-sufficiency of cars:

• Level 0 - No automation: Steering completely in driver's hands.
• Level 1 - Hands on/shared control: Onboard systems like cruise control, traction control.
• Level 2 - Hands off (From this level onwards, there is talk of connected cars): eCall (April 2018), cameras that help with parking, navigation, lane assist and many other forms of infotainment. 
• Level 3 - Eyes off: Car drives largely independently, driver can relinquish control for some time.
• Level 4 - Mind off: Car can independently drive from A to B, but this autonomy still has geographical limitations and the driver can take over the steering.
• Level 5 - Steering wheel optional: The car is completely self-contained; a driver is no longer needed.

Most (relatively) new cars have applications belonging to level 2. Some brands are limping towards level 3, including Nissan, Volvo and Tesla. Some Mercedes-Benz models are already equipped with level 3 systems. With level 4 cars, for some time now tests carried out on public roads. Yet all in all, the development of self-driving cars is progressing a lot less prosperous than initially predicted by Tesla boss Elon Musk and others. The latter had thought his cars would be driving around fully autonomous on public roads by 2017. That this is still not the case years later has made Tesla drivers decide to take a insurance claim submit.

There is one company - not a car manufacturer - that is making significant inroads in this area. The American Comma.ai wants to accelerate the development of autonomous cars. With the purchase of Comma 3 (hardware) and installation of OpenPilot (open source software), owners of more than 200 different models from many different car brands are able to take control of their car for an extended period of time. The software is continuously improved using artificial intelligence, machine learning and technical input from users.

This system works remarkably well, but the RDW - the government agency that operates vehicles in the Netherlands approves and issues driving licences and license plates - does not allow use of OpenPilot without prior approval. Incidentally, specific legislation on self-driving cars is still almost universally lacking, further complicating their introduction.

However interesting, the ability of cars to operate autonomously is not in itself most relevant to Privacy First because it does not involve the privacy of motorists. Rather, driverless cars are associated with a variety of ethical issues.

We mainly stick to the issues raised by connected cars. We will publish about those on a dedicated page of our website, which will be completely revamped very soon. Keep an eye on privacyfirst.co.uk!