Modern vehicles have evolved into intricate digital ecosystems, constantly monitoring and recording a variety of data regarding users' activities. A recent report released by Quebec's Commission on Ethics in Science and Technology sheds light on the numerous risks and challenges associated with these connected vehicles.
Luc Bégin, the president of the commission, emphasized the complexity of today's cars, remarking, “Today’s cars are essentially computers on wheels.” The report, which spans 64 pages, identifies twelve significant privacy risks linked to smart vehicles, including cybersecurity vulnerabilities, location tracking, and potentially unjust insurance practices.
Highlighting the severity of the issue, Bégin referenced a 2023 evaluation from the Mozilla Foundation, which ranked modern vehicles as the worst category of products based on privacy concerns. One alarming aspect discussed in the report is the phenomenon of "safe driver" insurance programs, which offer discounts in exchange for monitoring driving behavior. However, these programs often produce unfair outcomes, as individuals who drive at night or through certain neighborhoods may experience higher insurance rates. This creates a disproportionate burden on low-income workers, and the lack of transparency in how clients are scored prevents them from disputing potentially punitive assessments.
The report also underscores concerns regarding data storage practices. Data collected by vehicles is often processed and stored on external cloud servers managed by third-party providers, raising security questions around these data transfer and storage points. Each stage represents a plausible target for hackers, compounded by a notable deficiency in the transparency regarding data protection measures, which could even pose risks to national security. A significant security failure in 2024, where an unsecured Amazon Web Services (AWS) cloud database exposed sensitive information of approximately 800,000 Volkswagen electric vehicles for months, serves as a stark example of these vulnerabilities.
Location data, when mishandled or accessed by malicious entities, can also have serious implications, particularly in cases of domestic abuse. The report outlines how abusers can exploit car location apps to covertly monitor and control their partners. Alarmingly, the report found that consumer awareness of these risks is low, with only around 7 percent of consumers taking the time to read the lengthy and convoluted terms and conditions regarding data usage.
Bégin remarked on the current lack of clarity surrounding user consent, questioning whether individuals truly comprehend what they are agreeing to and the potential consequences thereof. The report concludes that the traditional model of individual consent is “fundamentally broken” within the connected vehicle framework. Furthermore, it raises ethical concerns as cameras in connected cars often capture footage of bystanders and passengers who are unaware of being filmed.
Moreover, location data from connected vehicles has even been utilized in criminal proceedings, as demonstrated in a recent case in Upstate New York where vehicle data played a crucial role in the conviction of Luciano Frattolin for the murder of his daughter. Bégin pointed out the duality of such data usage, recognizing it as both a potential public benefit and a risk of excessive surveillance, thus situating the discourse around connected vehicles within a complex ethical framework.
In light of these findings, the report advocates for increased government oversight, improvements to data storage systems, and continuous monitoring of international developments to reassess and update existing protocols. While acknowledging the inherent benefits of smart vehicles—such as real-time alerts for road accidents and diagnostics for mechanical failures—Bégin stressed the importance of consumer awareness regarding the associated risks. Given that many individuals neglect to read terms and conditions, it is vital that they are informed to make educated decisions regarding their vehicle’s data privacy.
