Forget crowbars – all a hacker needs to break into your car is an iPad, according to a report released on Monday by Senator Edward Markey. What’s more, car companies are doing little to protect you.
Most cars now contain more than 50 separate electronic control units collecting vehicle data and improving performance; nearly all have wireless entry points that could act as a gateway for hackers. Almost all the cars on the market today are therefore vulnerable to “hacking or privacy intrusions”, Markey said.
The Massachusetts senator’s investigation of 50 top car manufacturers including BMW, Chrysler, General Motors and Ford found their treatment and protection of such potentially sensitive technology and information to be “alarmingly inconsistent and incomplete”.
According to Markey, nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions, while most automobile manufacturers are unaware of or unable to report on past hacking incidents.
The senator also said security measures to prevent remote access to vehicle electronics are inconsistent and haphazard across all automobile manufacturers, and manufacturers are collecting large amounts of data on driving history and vehicle performance and distributing it to third parties, giving little information on how the data is used, how it is stored or for how long.
Markey also said customers are often not explicitly made aware of data collection and, when they are, they often cannot opt out without disabling valuable features, such as navigation.
Last November two auto manufacturing trade groups, the Alliance of Automobile Manufacturers and the Association of Global Automakers, released a joint statement setting out voluntary privacy protection principles for the industry. Among the suggestions was a call for automakers to collect information “only as needed for legitimate business purposes”.
Markey said the protections fell short in a number of key areas by not offering explicit assurances of choice and transparency.
“Drivers have come to rely on these new technologies, but unfortunately the automakers haven’t done their part to protect us from cyber-attacks or privacy invasions. Even as we are more connected than ever in our cars and trucks, our technology systems and data security remain largely unprotected,” said Markey, a member of the Senate’s commerce, science and transportation committee.
“We need to work with the industry and cybersecurity experts to establish clear rules of the road to ensure the safety and privacy of 21st-century American drivers.”
The senator’s report follows an investigation by CBS’s 60 Minutes which showed hackers taking control of a car via a laptop. Technologists at the Defense Advanced Research Projects Agency, a government tech lab, were able to remotely control the brakes, acceleration and windscreen wipers of a production US vehicle.
