As vehicles get smarter, tracking tools can benefit—or harm

When some people hit the road to flee an unsafe relationship, they don’t realize their escape vehicle could actually be reporting their whereabouts.

An investigation by The New York Times recently detailed how vehicle-connected smartphone apps can grant abusive partners access to a victim’s movements. Now, FCC Chair Jessica Rosenworcel is seeking answers.

As the Times reported Dec. 31, one woman realized her estranged husband was tracking her through a Mercedes smartphone app that showed up on her vehicle’s dashboard. She couldn’t cut off his access manually, and because the vehicle’s loan and title bore her husband’s name, the automaker said it couldn’t restrict his digital access to the car’s systems either, according to the report.

Rosenworcel wrote to automakers, including Ford, General Motors, and Mercedes-Benz, on Jan. 11, asking them to detail the pre-installed connected elements of these “smartphones on wheels” and what they do to ensure that users retain control of their data and privacy. Due to the level of connectivity built into modern vehicles, Rosenworcel suggested the automakers could have compliance obligations under the Safe Connections Act, which helps domestic-violence victims leave phone plans that they share with an abuser.

She posed similar questions to major wireless providers, asking AT&T, T-Mobile, and Verizon to detail the level of mobile integration they enable in vehicles.

A false sense of security in the driver’s seat isn’t uncommon, Crystal Justice, the National Domestic Abuse Hotline’s chief external affairs officer, told Tech Brew. One of the first steps toward eradicating technology abuse is better consumer education, she said.

“What we’ve heard commonly from survivors is they simply did not know. They did not find out until way after the fact that something was being used to track them, to listen to them, to know their location at all times,” according to Justice. “If we let people know on the front end that these things are happening, that these things are activated, it puts the power back in people’s hands to change that.”

Scott McCormick, president of the Connected Vehicle Trade Association, told Tech Brew in an email that wirelessly integrated cars “offer significant conveniences but also present unique vulnerabilities” that can be addressed through “thoughtful design, stringent security measures, and collaboration with stakeholders.”

“Transparency and guidance”

Some features that could potentially be exploited include GPS and location services, stored information such as frequently visited locations, remote locks and starting capabilities enabled by smartphone apps, and hands-free calling and messaging, he said. McCormick suggested there’s room for improvement in making virtual permissions more customizable.

“Auto manufacturers and wireless providers can develop systems that allow users to have more granular control over what data is shared and with whom. For instance, options to disable geolocation services or regulate access to in-car communication tools,” he wrote.

McCormick said that “robust authorization mechanisms” are also important to ensure that only the people who are supposed to access a car’s systems actually can do so, including “the ability to completely reset the system’s access controls.”

Rosenworcel’s letters also hint at another step toward shoring up connected vehicle vulnerabilities: Encouraging conversations on the corporate level about how product design could impact at-risk consumers.

“We’re not talking about the needs of domestic-violence survivors and their experiences. And it is absolutely critical in nearly every facet of life and commerce,” Justice said.

She suggested that companies include subject-matter experts in the development process to help understand how survivors might interact with their product, platform, or device. It’s also important to offer consumers “transparency and guidance” on safely using the product once it’s on the market, she said.