2y ago

US judge rules: if you can't prove damages, car-makers can continue to intercept and record customers' mobile phone activity.

therecord.media Court rules automakers can record and intercept owner text messages

A Seattle-based appellate judge ruled that the practice does not meet the threshold for an illegal privacy violation under state law, handing a big win to automakers Honda, Toyota, Volkswagen and General Motors.

118 comments

auto manufacturers had violated Washington state’s privacy laws by using vehicles’ on-board infotainment systems to record and intercept customers’ private text messages and mobile phone call logs.
But the appellate judge ruled Tuesday that the interception and recording of mobile phone activity did not meet the Washington Privacy Act’s standard
Privacy is a fundamental human right.
Just not in Usa, as it seems. Here it is indeed the law that needs to be fixed.
https://www.humanrightscareers.com/issues/is-privacy-a-human-right/
- To be fair, pretty much every government breaks its own rules, particularly when privacy is involved.
  We have the largest and most invasive world governments in the history of the world thanks to the overwhelming technology that allows such a thing. And even governments that pretend to follow the rules just get their buddies in another country to do their dirty work for them. "I can't spy on you, but England can!"
  
  Yeah and if the government is doing it you know other people have gotten their hands on it and are using it for gains.
- Isn't the EU trying to outlaw end-to-end encryption?
  
  That was France, not the EU

Disappointing result but this seems like something for the legislature to fix. Courts aren't always the solution, sometimes you have to just fix the damn law.
- But that would mean the politicians would have to actually work instead of photo ops and promises!!!!
- This is supposed to be covered by the fourthamendment but that's been meaningless for over 20 years now
  
  Amendment 4 does not apply to the practices of a private company. That's what privacy legislation is intended to protect against. Amendment 4 only applies to spying done by the State.
  
  Just like with the first amendment, it doesn’t apply to private companies. The point is to prevent the government from passing tyrannical laws, it was never meant to district the activity of private citizens.
  
  The "unlawful search and seizure" amendment? Why would that apply here?

America sucks. Seriously. I'm just waiting for another country to bring it to the USA, because it seems inevitable.
People gotta stop putting faith into these ultimately crooked nations.
- Will it be another country though? Seems like the power has shifted and is continuing to shift from the nation state.

I mean ok but the fact that your car is spying on you has to break a thousand big tech nda’s

I wonder how long until we get to jailbreak our cars just so those cock suckers can’t spy on us.
- Technically you already can. I just hope you have extensive programming knowledge because you're going to have to take an axe to the existing code.
  
  May be able to find and remove whatever it's using as a cellphone antenna.

This is why I keep my 2006 toyota in tip top shape. I will drive that car as long as I possibly can.
- I've got a 2007 Kia that I'm planning to drive until I can't fix it anymore
  So far that's proving to be a pretty easy given the cost and availability of parts
- Really considering taking out a loan just to fix an old car instead of buying new.
- I'm taking my 2006 Avalon to 300k miles and beyond!
- What's the difference between never connecting your phone to a brand new high tech car and having no tech in an older car?
  
  New car is still connected and is monitoring your driving habits, whether you wear a seatbelt or not, possibly recording your conversations, and even keeping track of your weight with the sensors in the seats.
- this is why i don't own a car
  
  In my region, where public transport doesn't exist much at all, if you don't drive, you might not eat or work (the lucky few work remotely, but not all).

So ask the judge why car companies want to track judges?

Obvious next question: how’s the privacy policy on 3rd party stereo makers like Pioneer, Kenwood, Alpine, Jensen, etc.?
- Why risk it? Build your own with a raspberry pi and a touchscreen.
  
  This is what I want, but they make it very difficult to build something with parity unless you're willing to sniff CANBUS codes one by one
  
  Got a link to a good project of that type? I've been thinking about this recently.
- Should be better since they usually don't have an uplink capability. But be real careful of any model that has Internet for any reason.

Well.. fuck. More reason to not buy newer cars. At least you Americans are lucky. You can drive a dinosaur if it met with regulations. You technically don't have to buy new cars.. ever.
- The scary thing? Define "new". This judgment is from a lawsuit in 2014. So any car made in at least the last 9 years is doing this. Maybe newer cars are doing even worse things.
  
  Yep.
  https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
  https://foundation.mozilla.org/en/blog/privacy-nightmare-on-wheels-every-car-brand-reviewed-by-mozilla-including-ford-volkswagen-and-toyota-flunks-privacy-test/

Setting aside questions of legality, it seems kind of like it wouldn't encourage someone to purchase their cars.
- Not a problem! Jack used car prices up to new cars, prevent public infrastructure and provide benefits for cars, all car manufacturers have similar privacy policies. Combine all three and you have customers that need a car to live, might as well get a new one if decade old ones are the same price or have no stock, and suddenly there isn't much choice.
- That only helps when there's viable alternatives. Since pretty much all auto manufacturers do something like this it's not really a distinguishing feature.
  And even if it was: how much worse/more expensive would a car need to be for you to not pick it over one that reads your text messages. And then ask the same question not for "you", but for the average consumer. Then be sad ...
- Yeah but the vast majority of car buyers won’t know about this or care. We’re all privacy advocates here but everyone and their mother is on Facebook or Instagram and is happily giving away all their information already anyway.
  We’re all up in arms about this here in this thread, located in a self-selecting micro-community of people centered around a shared interest in the control of our data. If you called your mother and told her about this would it stop her from buying a new car in the future?
  
  Correct, the vast majority of people don't care.

Well I am still so happy that I decided specifically to get a newish car that doesn't have a touchscreen or any of this nonsense.
- What model did you buy? It is rare to see one these days that doesn't have all this nonsense.
  
  2015 Buick encore. I did remove the fuse for the OnStar satellite nonsense though.

Wait, how are CARS intercepting mobile activities?
- When you connect to Bluetooth, it asks your phone to share call, contact and SMS information.
  Think like the old horrible headunit text implementation, the ability to scan your contact list from the car, and see your recent calls.
  
  When you comment to Bluetooth, it asks your phone to share call, contact and SMS information.
  So they are intercepting your calls and messages with your permission? I don't see the problem. If you don't want them to do that, click "deny" when your phone asks if you want to share them with the car.
- Mozilla tested a bunch. Try a search on the platform and see.
- Through android auto and apple car play would be my guess, but i don't know.
  
  There’s no way Apple lets the automaker access app data from your phone. Apps on the phone can’t even see data from other apps on the phone.
  There are two ways I can think of for the infotainment to get the messages. The first is by OCR-ing the CarPlay screen, which is shady as hell. The second is a feature like this one where the car has Bluetooth notification integration.

It can't be illegal because you agree to allow them when you purchase the new vehicle. It's all there in the T&C and PP, which no one ever reads. Don't like it? Don't buy new cars. I won't.
- So if I buy a used car they can’t do all that right?
  Right?
  
  Same privacy policy authorizing them to harvest your data, but older cars have a more limited capability to collect data compared to newer cars filled with sensors, cameras, and phone integrations. Plus older cellular networks are defunct for older vehicles so they can't just exfil it without you helping or bringing it in to physically access it.
- Illegal terms in T&C are still illegal regardless of whether you agreed to them or not in the US.
- You can get a car, just don't connect your phone to it.

Just gotta get someone to hack their system. Then it'll be easy to prove damages

Yet another item on my list of why I'll never buy a modern car.

Thank goodness for Signal
- If you connect your phone to the car, can it spy on your Signal messages? I mean, they have to decrypt on your end for you to see them, right? Or has Signal taken specific steps to stop this?
  
  At least with my headunit (2015 Toyota). It cannot read the signal messages. Additionally, I remove contact and text permission from Bluetooth to be especially sure.

I recently found a video talkkng about privacy. One of the topic was that privacy does not ring any bell in people's mind. Contrary to intimacy. Maybe we should all replace privacy by intimacy so we can tell what is really implied to non software people
- Good point. Messages sent, images taken, and 'things happen' in cars.

118 comments