In this article, we learn about a new study that reveals the most devices that obtain our personal information, and we do not know it.
Which device do you use on a daily basis that is the most active device in collecting your personal information for analysis and resale?
Have you ever wondered which device is the most active in collecting and analyzing your personal information for resale? The answer is your car, according to a study conducted by the Mozilla Foundation.
The research revealed that smartwatches, smart speakers, surveillance cameras, and other devices are not the primary data collectors for Mozilla. Rather, it's modern cars that handle your personal information most actively.
This study showed that most car brands inappropriately collect personal information with a lack of transparency in how these data are used. There is also poor data transmission and storage practices. Moreover, it's unclear whether data encryption techniques are in place.
What's worse is that 19 out of 25 car brands officially claim they have the right to resell the data they collect. Most car owners have almost no option to opt out of data collection and transmission. Only two brands, Renault and Dacia, provide the option to delete collected personal data, although they don't make this clear to users.
These are serious violations of privacy rights deeply buried in the licensing agreements that car buyers usually agree to without reading. This includes consent from car owners to share their sexual preferences and genetic information, disclosure of information based on unofficial law enforcement requests, and other data with mysterious names.
For example, the owner's consent to share their sexual preferences and genetic information (Nissan), disclosure of information based on informal requests from law enforcement agencies (Hyundai), and collection of data on stress levels, all in addition to 160 other data categories with deliberately obscure names, such as demographic information, images, payment information, geographic location, etc.
The worst brand ever in the rating was Tesla, which, in addition to all data collection points, received a special mark: "Untrustworthy artificial intelligence", as this car collects footage of you and your family inside and outside your car, as a report revealed that between 2019 and 2022, a group of Tesla employees privately shared via an internal messaging system highly private videos and images recorded by customers' car cameras, as well as images of accidents and anger incidents on the roads. According to Reuters interviews with nine former employees of the company.
How do cars collect personal info?
Modern cars are equipped with various sensors, ranging from engine and chassis sensors that measure things like engine temperature, steering wheel angle, and tire pressure, to more intriguing sensors such as external and internal cameras, microphones, and steering wheel presence sensors. All of these are connected to a central computer in the car, which receives information from these sensors.
In addition, all modern cars come with Global Positioning System (GPS) units, cellular connectivity, Bluetooth, and Wi-Fi.
In many countries, the law mandates the use of cellular communication and GPS systems for automatic emergency assistance in the event of an accident. However, car manufacturers also use these technologies for the benefit of the driver and the car itself.
Using this technology, the driver can plan routes on the car's display, diagnose any faults remotely, and even remotely start the car. Moreover, the bridge between "sensors, cameras, the car's computer, and cellular network" creates a steady stream of information, such as where you are going, where you will stop and when, how much you are turning the steering wheel and accelerating, whether you are wearing your seatbelt, and more.
Furthermore, more information can be gathered from the driver's smartphone when connected to the car's onboard system for making calls, listening to music, navigation, and more. If the driver's smartphone is equipped with a mobile app from the car manufacturer to control car functions, data can be collected even when the driver is not in the car.
On the other hand, information about passengers can be collected through cameras, microphones, Wi-Fi connections, and Bluetooth functionalities. These features make it easy to track individuals who regularly travel in the car with the driver, including when and where they get in and out, what smartphones they are using, and more.
Why do car manufacturers need this information?
The answer is quite clear: to earn more money. Aside from data analysis to enhance product and service quality, this data can be resold to external entities, and the car's features can be adapted to maximize profits for the manufacturer.
For instance, insurance companies purchase information about a specific driver's driving habits to accurately predict the likelihood of accidents and adjust insurance costs. In 2020, 62% of cars were equipped with integrated information systems directly from the factory, and this number is expected to rise to 91% by 2025.
Marketing companies also utilize this data to target advertisements based on the owner's income, social status, and lifestyle.
However, even without reselling personal data, there are many other less savory scenarios for income generation, such as enabling or disabling additional car features through subscriptions. Some attempts, like BMW's failed endeavor with heated seats or selling expensive cars via credit with the option of remotely disabling the vehicle in case of payment failure, have been made.
What's also wrong with collecting data while providing powerful benefits?
Even if you think there's nothing wrong with advertising, and there's nothing interesting they can know about you, consider the additional risks you and your car are exposed to because of the technologies described earlier, including:
1- Data Breaches:
Car manufacturers collect your information and store it without adequate protection. For example, Toyota acknowledged last May that data from the past 10 years, gathered from millions of vehicles supporting cloud services, had been leaked.
Data breaches have also occurred involving 3.3 million customers at Audi, and other companies have also experienced data breaches and cyberattacks. If this personal data falls into the hands of real criminals and not just marketers, it could lead to a disaster.
2- Theft:
In 2014, experts at Kaspersky Lab discovered the potential for car theft through cloud-based functions. Since 2015, it has become evident that remote car theft is not a fantasy but a harsh reality.
Car thefts in recent years have often exploited the remote relay of signals from key fobs. However, the TikTok challenge that gained popularity last year among teenagers stealing Kia and Hyundai cars did not rely on the car's smart features. All it required from the thief was to insert a USB drive.
3- Monitoring by Others:
When you don't own the car yourself, but it belongs to a family member or employer, the owner can track the car's location, set geographical boundaries for its use, establish speed limits and permitted driving times, and even control the volume of the audio system. Many brands like Volkswagen and BMW offer these features.
How can you mitigate these risks?
Given the scale of the problem, there are no simple solutions. However, Kaspersky experts offer some options to reduce these risks, including:
1. Walk or ride a bicycle.
2. Consider buying an older model car, as most vehicles made before 2012 have very limited data collection and transfer capabilities.
3. Purchase a car with minimal smart sensor features or without a communication unit. Some manufacturers offer versions of the same car with limited capabilities, but this requires careful reading of the user manual. The absence of a dedicated communication unit (GSM/3G/4G) in the car is a reliable sign of its limited capabilities. Note that many cars come with smart features even in their basic versions.
4. Don't install your car's mobile app on your phone. While starting your car or preheating it from your smartphone is convenient, is it necessary to pay for these conveniences with deep personal information and additional expenses?
5. Avoid connecting your car to your phone via Bluetooth or Wi-Fi. Of course, this way, you'll lose some functions, but at least your car won't send information to the manufacturer through your phone, and it won't download contact numbers and other personal data. You can find a middle ground by creating a Bluetooth connection only for your car's audio system, allowing you to play music from your phone through the car's speakers without transferring any other data.
An additional recommendation, though not excluding the above, is Mozilla's proposal to encourage car manufacturers to change their business models and stop profiting from spying on customers by signing a collective petition.
