The Connected Car as a Surveillance Platform

Researchers at Northeastern University, working with Consumer Reports (CR), ran a broad study of just how closely modern cars watch their owners. The conclusion is blunt: your car keeps you under constant surveillance, and the data it gathers is used against you.

What they looked at

To gauge the scale of the collection, the authors waded through thousands of pages of end-user agreements and privacy policies and put questions to fifteen automakers: BMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota, and Volkswagen. They also reviewed corporate, regulatory, and legal filings from the data brokers of the "insurtech" industry — the firms that help insurers set their rates. Privacy experts the researchers spoke with have, at industry conferences and in market reports, called an individual's driving data the "new oil."

Consent you didn't know you gave

Formally, some manufacturers obtain your "permission" to collect driving data. But, the report notes, you may grant it without realizing. After buying a new car, the first time you switch on the infotainment system — and again in the paired mobile app — you are shown a series of consent forms, privacy policies among them. Most people simply accept the terms without reading.

Where the data goes

The list of recipients is long. Insurers and lenders take part in "telematics data exchanges" that compile driving records on millions of people. Thousands of brokers build personalized risk scores. Companies sell infotainment systems and Wi-Fi hotspots. Even local and state government agencies working on planning, traffic, and road safety are in the chain.

An old truth with a new twist

Bruce Schneier closes with the familiar line: "If you're not the customer, then you're the product." The sentiment, he notes, is older than you'd think. And in an age of internet-connected everything it comes with a bitter amendment: now you're the product even when you are the customer.

Source: Schneier on Security