SoylentNews

"exec" writes:

A recent techdirt article says that

Law Enforcement Has Been Using OnStar, SiriusXM, To Eavesdrop, Track Car Locations For More Than 15 Year

Thomas Fox-Brewster of Forbes is taking a closer look at a decade-plus of in-car surveillance, courtesy of electronics and services manufacturers are installing in as many cars as possible.

Following the news that cops are trying to sweat down an Amazon Echo in hopes of hearing murder-related conversations, it's time to revisit the eavesdropping that's gone on for years prior to today's wealth of in-home recording devices.

One of the more recent examples can be found in a 2014 warrant that allowed New York police to trace a vehicle by demanding the satellite radio and telematics provider SiriusXM provide location information.

In this case, SiriusXM complied by turning on its "stolen vehicle recovery" mode, which allowed law enforcement to track the vehicle for ten days. SiriusXM told Forbes it only does this in response to search warrants and court orders. That may be the case for real-time tracking, but any location information captured and stored by SiriusXM can be had with nothing more than a subpoena, as this info is normally considered a third-party record.

It's not just satellite radio companies allowing cops to engage in surreptitious tracking. OnStar and other in-vehicle services have been used by law enforcement to eavesdrop on personal conversations between drivers and passengers.

In at least two cases, individuals unwittingly had their conversations listened in on by law enforcement. In 2001, OnStar competitor ATX Technologies (which later became part of Agero) was ordered to provide "roving interceptions" of a Mercedes Benz S430V. It initially complied with the order in November of that year to spy on audible communications for 30 days, but when the FBI asked for an extension in December, ATX declined, claiming it was overly burdensome.

The 2001 case didn't end well for law enforcement. It wasn't that the court had an issue with the eavesdropping, but rather that the act of listening in limited the functionality of the in-car tech, which the court found to be overly-burdensome.

[...] Law enforcement may find encryption to be slowing things down in terms of accessing cell phone contents, but everything else -- from in-car electronics to the Internet of Things -- is playing right into their hands.

-- submitted from IRC

Original Submission

upstart writes in with an IRC submission for Runaway1956:

GM to leverage driver data as it jumps back into the insurance business – TechCrunch:

General Motors is launching an insurance service, returning to a business that it abandoned more than a decade ago, but this time more in step with the connected-car era.

The service, called OnStar Insurance, will offer bundled auto, home and renters' insurance, starting this year with GM employees in Arizona. GM's new insurance agency, OnStar Insurance Services, will be the exclusive agent for OnStar Insurance. Homesite Insurance Group, an affiliate of American Family Insurance, will underwrite the program.

The services will be available to the public nationwide by the end of 2022, including people who drive vehicles outside of GM's portfolio of Buick, Cadillac, Chevrolet and GMC branded cars, trucks and SUVs. The aim, however, is to leverage the vast amounts of data captured through its OnStar connected car service, which today has more than 16 million members in the United States.

GM's pitch is that this data can be an asset to drivers and help them cash in on lower insurance rates based on safe driving habits.

"Our goal is really to create greater transparency and greater control for our customers in influencing what they pay for insurance and their total cost of ownership on the vehicles," Russell Page, GM's head of business intelligence said in a recent interview.

The data play is substantial. The company has logged more than 121 million GB of data usage across the Buick, Cadillac, Chevrolet, and GMC brands since the launch of 4G LTE in 2014.

Original Submission

upstart writes:

The regulator is warning OEMs to respect data privacy or it will get mad:

The Federal Trade Commission's Office of Technology has issued a warning to automakers that sell connected cars. Companies that offer such products "do not have the free license to monetize people's information beyond purposes needed to provide their requested product or service," it wrote in a blog post on Tuesday. Just because executives and investors want recurring revenue streams, that does not "outweigh the need for meaningful privacy safeguards," the FTC wrote.

Based on your feedback, connected cars might be one of the least-popular modern inventions among the Ars readership. And who can blame them? Last January, a security researcher revealed that a vehicle identification number was sufficient to access remote services for multiple different makes, and yet more had APIs that were easily hackable.

Later, in 2023, the Mozilla Foundation published an extensive report examining the various automakers' policies regarding the use of data from connected cars; the report concluded that "cars are the worst product category we have ever reviewed for privacy."

Those were rather abstract cases, but earlier this year, we saw a very concrete misuse of connected car data. Writing for The New York Times, Kash Hill learned that owners of connected vehicles made by General Motors had been unwittingly enrolled in OnStar's Smart Driver program and that their driving data had been shared with their insurance company, resulting in soaring insurance premiums.

[...] The FTC says that automakers and other businesses must protect users' data against illegal collection, use, and disclosure. It points to recent enforcement actions against companies in other sectors that have illegally collected or used geolocation data, surreptitiously disclosed sensitive user data, and illegally used sensitive data for automated decisions.

The FTC says the easiest way to comply is to not collect the data in the first place.

Original Submission