Self-driving cars are connected cars, but most cars are connected to the internet in some way already, even if none of them are capable of real autonomy. These vehicles are loaded with sensors, too. The Future of Privacy Foundation put out a new infographic that illustrates the many ways a car can watch you while it watches the road.
At a day-long summit in Washington Wednesday organized by trade and highway safety regulators, a variety of important questions were raised about consumer privacy as cars become more complex, add sensors and share more data. Here’s a few:
Could someone be fingerprinted by their driving?
With senstive enough instruments, it becomes easy to identify people by behavior, such as how they type or how they walk. “How you drive reveals a lot about who you are,” Joseph Jerome of the Center for Democracy and Technology said. There are a thousand tiny subtleties in the way a person drives: how often they touch the brake, how hard, how much they play with the wheel, how wide they take turns and how far from a stop sign they start to decelerate. Will cars log enough of those data points and share enough in the cloud that a person could actually be identified even if they were driving someone else’s car?
Do driving systems need to be on the same system as entertainment systems?
It will probably be necessary for people to log-in to services in order to, for example, stream Spotify in their car. No one doubts drivers will want to do this, but is it necessary for such services to be on the same system as the one that sends road condition data and tire pressure back to the car manufacturer? It’s easy for a non-engineer to imagine that those systems could be completely distinct, but there might be reasons why they can’t be.
Will consumers be able to see the data that accumulates about them (and correct it)?
Jerome said, “I think there’s really tough questions about the Fair Credit Reporting Act applies.” The legislation is meant to give consumers access to information about their history so they can see it and correct it. What if mistakes accumulate as all this data piles up? Will there be ways for consumers to take action? Will there be tools to help them make sense of the piles of data in there?
Does the fleet of connected vehicles really become that much less safe if some cars opt out of sharing safety data to the cloud?
Jerome’s organization argues that there should be a way for consumers to opt out of all connected systems. After all, there will be unconnected cars on the road for many more years, so why should it matter if some new cars opt to be disconnected? CDT worries that safety concerns will be used as a means to justify collecting data that will really be used by marketers and insurers.
Former National Highway Traffic Safety Administation chief, David Strickland (now with the law firm Venable), strongly disagreed. He believes that connected car safety features will be so good that it would be socially irresponsible to let drivers turn such features off on cars that came equipped with them.
What new business models will be created by third-party control of vehicles?
“The idea that somebody might be able to take control of a car while you’re driving was almost impossible to conceive” in the days before the internet, Marc Rotenberg of the Electronic Privacy Information Center said. Since cars started to connect, though, they have seen new applications that have nothing to do with car manufacturers. Auto lenders, for example, will require a system that can remotely disable cars for owners that fall behind on their payment. Auto lenders partnering with Uber in New York City reportedly used such a system, according to a new story from Quartz.
What happens when different people use the same car (such as when a car gets sold)?
What happens when a car changes owners, or even when rental cars switch between users? Andrew Koblenz of the National Automobile Dealers Association said that consumers are asking a bunch of tough questions on the lots about privacy, and car salesman want good answers. This includes used car salesmen. Koblenz would love an easy way to reset any car’s software to factory fresh state.
How many connected cars will be enough to start attracting attackers?
“We have connected cars on our network that have been running around for 10 years,” Syeed Zaeem of Aeris Communications said. One of the reasons they haven’t seen more spyware, ransomware and other attacks on the system is because there just aren’t enough targets to make it attractive. That will change, but when?
What does it mean for a consumer to give consent to their data going to the manufacturer and third parties?
Most automakers that sell cars in the U.S. have agreed together on a set of privacy principles (only published as a PDF, which is telling). They officially shared these with the Federal Trade Commission, so the agency actually has enforcement authority over the principles. One of those principles, consumers have to consent to data collection, but what that actually means is a bit muddled. Does a user “consent” by buying the car and driving it off the lot? Can they retract consent? Is there any sort of granularity to consent?
Jerome said that CDT reviewed many automakers privacy policies, and they look like the same giant mass of legalese users confront when they click “accept” while onboarding a new app. If consumers are intimidated into consenting by a wall of formidable text, is that really consent at all?
