Imagine you're talking to a friend about
something sensitive. But there are too many people around who might be listening, so you
decide to go somewhere more private. Somewhere quiet, where the conversation can stay just
between the two of you. You go to your car. Unfortunately you made a grave mistake,
Yeah, no, that's the last place I would advise people to go and take a
private conversation nowadays. According to Andrea Amico, founder of the website
Privacy4Cars, cars aren't private places at all. Car privacy is something I've wanted to
dive into on this channel for a long time. Every year our cars are getting smarter
and they're more connected than ever. They capture a whole lot of information about you. We all hear people say that
modern cars are spying on us, but most of us have no idea the real extent of it. So I chatted to a bunch of
experts like Andrea, Woody, a digital tracking expert and former instructor
for a vehicle forensic company, and Sam, a famous car hacker who does awesome
research into their vulnerabilities. And what I learnt from them about car privacy was so insane that my one intended video on
the subject exploded into a full series. In the series we examine how
easy it is to hack modern cars, and how strangers can even get real time
access to things like your car cameras. We explore the trackers in cars
that you had no idea existed, like the radio signals beaconed out by your tires, that can be used to track you even if you're
doing 70 miles per hour down the freeway. We dive into the perverse incentives
that drive companies to collect as much data about you as possible, and look
at the history of when this all started: spoiler alert, it's been going on
far longer than you ever imagined. And don't even get me started on used cars:
We look at how the previous owner of your car might still have access to all your car’s
remote features, tracking tools, and cameras. And we explain how to wipe your own
information and location history from your car before you sell it.
These are the kinds of things we investigate as we dive under the
hood of car privacy in this series. So let's get started in this first
episode by uncovering the kinds of data siphoned from your car
every time you hit the road. Your car knows where you’re going, it knows when you’re going. It
knows your kind of driving habits. In short, the modern car has
become a privacy nightmare. Cars collect a lot of data, uh,
and I don't know that consumers really understand how much data
is being collected by vehicles. The new trend in automotive, is to talk
about the software defined vehicles, which essentially means
turning cars into smartphones. In what ways are cars like smartphones? Well
first, they both act as tracking devices, emitting all kinds of radio signals that
can be used to pinpoint your location. Your car is a cell phone, your
car is a wireless hotspot, your car is a wifi receiver and your car
is a Bluetooth transmitter and receiver. But there are other important similarities
too. Just as we often think of our phones as singular entities that send off data to
Google and Apple. We regard cars the same way, sending off our data to Mazda, or Toyota. But with our phones, data sharing doesn’t
stop with the device manufacturer. Because we then go ahead and install a
hundred different apps on it, and each of these apps also sends
our data to countless companies. It turns out that cars
actually work in a similar way. Cars are platforms where a lot of
other services are bolted on top. Most consumers don't realize that when
they're driving, there's, uh, hundreds of companies literally, that are collecting
data from that vehicle and profiling you, Some information might be going to manufacture
something to be staying locally on the car, some may be going to your insurance company. Some may be going to a technology
that you've opted in to use Exactly what information is being collected and
where it’s going is pretty hard to figure out, varying by the make and model of the car.
However, one thing we know for sure about basically all modern cars: data is
being harvested by the trunk load. The easiest way to figure out what
exactly your car is tracking and has like access to is to just open the app . Sam Curry has spent a lot of
time examining these car apps where you do things like check the engine
status, and check your vehicle’s cameras. If you ever wanted to see
where your car's at or like, start your car or unlock your car,
you can now do that with your phone. While these apps don’t tell us the entire story, they do give us some insight
into the data collection. The actual data that gets logged by the car,
that includes video feeds, microphone feeds, the actual like GPS location, like over
time is a hundred percent being logged. Your car has these systems built in that'll
actually log every interaction with the vehicle. So whether or not you unlock the
car, turn the engine on, air conditioning, starting an engine, finding a vehicle's location. These are generally marketed as really
convenient features for consumers. Being able to control and like locate your vehicle
via, like your phone is like a really cool thing. But it’s also important to remember
this fundamental principle: If the app is free, you are the product. By just like, using the apps, you're
kind of just giving that data to that company. They'll probably, you
know, hold it in perpetuity. And often, we're not just handing our
data to those companies; we're granting them carte blanche to share our sensitive
information with countless third parties. Yet, despite this data free for all, there's a
surprising lack of pushback from consumers. It’s likely because many are unaware of the true
extent of car surveillance. Even when they hear about 'data collection', the term 'data' is
so vague that it hardly sparks a reaction. So let's be more specific. When we say “data",
we’re talking about things like camera footage. Every time you drive home, every time you drive
to a certain location and do certain things, those are being recorded and transmitted. If I wanna view like my live
footage right now from my car, I click that button, and then it
gets remotely streamed in my device, The camera footage doesn’t go
directly from your car to your app, it’s beamed through some company’s server. And because no car companies are end-to-end
encrypting your footage right now, they have access to it, as does anyone
who gets access to their servers. You're essentially like, allowing these third parties to monitor that and like
stave that data like indefinitely, Audio recordings are another
piece of sensitive data that you might not realize others get access to. Microphones are extremely common in cars.
just because, to operate hands free, as you can imagine, any car with
Bluetooth has a microphone in it. There are all kinds of uses for these microphones. Some cars offer Active Noise Cancellation, where
microphones monitor cabin noise and try to cancel it out. Some have microphones that amplify
the driver's voice to rear passengers via the car's speakers. There are built in emergency
response systems integrated with microphones, Cabin Monitoring that includes microphones, and sometimes also cameras, to check on
the well being of passengers. Cars these days even have their own inbuilt versions
of things like Hey Google, Siri, and Alexa. Voice assistance started
to be put inside vehicles. This can be problematic. Have you ever
been chatting in your living room, and you say something like "let's go
see a movie", and suddenly you hear… "Sorry I’m having trouble
understanding right now"
That voice assistant has been sitting
there listening to everything you say. Technically they shouldn’t start recording
until they hear the magic “wake” word, but they're always being falsely triggered,
recording when they shouldn’t be. You're talking about something else, it
just automatically starts to record it. This false triggering also occurs
with the voice assistants in your car, only it happens far more often. Your recordings are collected
actually accidentally a lot more in vehicles than inside your home. Because it's a noisy environment. There's
vibration, there's noise from the street et cetera. So there's a lot of much
more false positives in vehicles. Who gets access to all these
recordings that are made? They go to third parties, sometimes
they share them outside of the company, or they're leaked, or they're breached. These recordings might be
accessed by governments too. If you get involved in like a legal thing,
you could probably like retrieve those conversations like two months later,
um, via subpoena by the government, Location data is another really sensitive
piece of data that we're leaking constantly A lot of these vehicles like, will actually
log the very specific exact location. Certain cars will have a more active tracking
where that data is being very specific about which street you're on, how fast you're
going, where you're taking turns and stuff. You might think it’s only cars
equipped with integrated map apps that have location tracking capabilities.
But hidden in nearly every modern car, regardless of the presence of a map app,
is another device, silently monitoring you. The really like core piece of like the vehicle
tracking stuff is like the SIM card itself, That’s right, your car almost
surely has a SIM card in it. We weren't joking when we said that modern
cars were like smartphones on wheels. They all have a SIM card that
goes through a service like AT&T And these pinpoint your location
because in order to operate, SIM cards need to constantly ping nearby
cell towers to signal their presence. You can do like the multiple ping backs using multiple cell towers to
find the specific location. And this location data is now available
to multiple different entities. AT&T can locate your vehicle because you know, it has to have the ping back
for the different cell towers. After it gets routed through AT&T it
then goes off to like a third party, like the actual companies that provide the
tracking. Throughout the entire process, there's like these different companies
that are just getting access to your data. You might be tempted to remove the SIM card
from your car. However, in many modern vehicles, it provides essential functionality, enabling
data transmission, real time traffic updates, remote diagnostics, and over
the air software updates. They can also be essential for emergency
services, infotainment systems, and all kinds of other internet based services
that are built into vehicles these days. So the SIM isn't just a location tracking
tool; it's fundamental to the transmission of all kinds of data from your car
to companies that collect and use it. Another kind of data that's
being collected from your car, that may seem abstract but is just as sensitive as
location, cameras, and microphones, is Telematics. The word “telematics”, it basically describes
like, the infrastructure that supports remotely talking to a vehicle. So if I have my like
smartphone, and I click a button and that fires off a request to my car, that's essentially
considered like a telematics like infrastructure, Telematics capture a wealth of personal
details. As well as when and where you drive, they reveal how you drive, offering
insights into habits, routes, and schedules. If I arrived at a location at 2:42 and I
plugged my keys in and turned the car on, that's gonna trigger an event that's gonna be
sucked up by the server,. Then in the future, if someone wants to kind of like query
that data, they can get access to that, Such data, in the wrong hands, can be
used to predict behaviors or exploit vehicle vulnerabilities, making it as
sensitive as any direct personal data. Then there's sensor information. Sensors now, they collect, you know,
your biometrics. They deeply profile you. Every time you sit in a car, it
takes your weight, for instance. Nowadays cars track whether
you're looking at the road. Some newer technology try to infer what
are your emotions as you drive through AI. And if you have ever connected
your phone to a vehicle, you've essentially unlocked an additional
Pandora's box of data collection. These things that we carry in our pocket
and then we connect it to, to cars, Cause you wanna, you know, listen to your music
or you sync over Bluetooth 'cause you wanna take a hands free call. And when you do that, the car
essentially downloads a mini clone of your phone. Wait, what? My car has ingested a bunch
of data from my phone? What kind of data? It used to be just, you know, your contacts
and it became your text messages with the actual text messages. Nowadays, it’s what apps are
running on your phone, social media information, what photos you take and what files
you've downloaded, and so on and so forth. Holy moly, I hadn’t realized that modern
cars were actively harvesting all of this stuff from my phone. I consider
my phone a very private device, and now I’m just sharing all that information
with the car every time I connect it? You shouldn't be plugging into public
USBs anywhere in the world, period. Ok, well my car isn’t a PUBLIC USB, it’s my personal car. Does it really matter
if I share this information with my car? Yes. Because remember, this data isn’t staying in
your car. it’s shared with countless entities. You might want to seriously reconsider connecting
your phone to your car in the future unless you want your photos, files, contacts,
and messages to be potentially harvested. And It’s not just the car sucking
up data from the phone either. Your phone might actually be
sucking up data from your car too! Let's suppose that you are plugging
your phone and you use Android auto, well, Google now is getting data from
you, not just from the phone. It is actually collecting data from the car and
sending it through the phone back to Google. The modern day data exchange that goes
on behind closed doors with modern cars is shocking and egregious, and people
largely don’t know what’s happening. There's an entire explosion
of data collection in cars. The worst part of it is that we have no idea
who will get access to this data. Car companies, ad companies, hackers through
data breaches, and of course Massive data brokers that collect data from
all sorts of manufacturers, and they sell it, Even governments get this data. Regardless of
whether you feel you live in a safe country with a good government NOW, regimes
come and go, but this data is forever. Do you really want your voice
recordings, location history, and camera footage to be available for anyone
to pick over at any time in the future? Your data is like a hundred percent
being like, collected, monitored, and then governments can kind
of ask for that information If that data is accessible and they have a
legal means to go about like getting that data, they're absolutely gonna take that data. Videos
from your car, all these telematics events for, you know, doors opening, engine starting and the
actual location is like being sucked up and can now be like subpoenaed by the government or
like potentially like a malicious attacker. This data is a liability, and car companies
have a giant target sign painted on their backs. But consumers are ultimately
the ones who will be hurt. In an upcoming video we're going to show
you how you can opt out of some of this collection and better protect yourself. But for
now, we really need to get a conversation going around car privacy, and increase awareness.
In recent years general privacy awareness has already started to pick up steam as people
wake up to data collection in the digital age. This conversation, uh, about like, data
collection, it's been like an ongoing conversation for like, operating systems, for consumer devices
for like everything for the last like 10 years. But applying this conversation to cars hasn’t
quite dawned on most people yet, because consumers are still largely in the dark about it all.
As more consumers become more aware of like, all the data in which like, vehicles are
collecting, I think more consumers are gonna want out and they're gonna say that they're
not really comfortable sharing this data. So it’s vital we let them know. As we continue
in this car privacy series you’ll come to understand why it’s so important we push back
against the normalization of these practices, and we’ll teach you helpful tips that
you can use to start to protect yourself. NBTV is funded by community donations. If you’d
like to support our free educational content, please visit NBTV.media/support. And take a look
at our book “beginner’s introduction to privacy” that also supports our channel. And liking sharing
and commenting really helps us to reach more people. Thank you so much for watching through
to the end where you get to see this dance!
