Staying Safe and Secure in the Age of the Connected Car

Today‘s cars are becoming more like smartphones on wheels. Embedded with sophisticated sensors, computers and wireless connections, modern vehicles are increasingly "connected"—both to the internet and other vehicles. This connectivity enables a range of cutting-edge features that can make driving safer, easier and more enjoyable. However, it also introduces new digital threats that every car owner needs to understand.

As a cybersecurity expert focused on protecting data in the cloud era, I‘ve seen firsthand how connectivity always comes with risks. And with connected cars collecting huge volumes of personal data, often with minimal security and transparency, those risks have never been higher. Here‘s what you need to know to stay safe and protect your privacy behind the wheel.

What is a connected car?

A connected car is equipped with internet access and wireless local area network (LAN), allowing it to share data with other devices both inside and outside the vehicle. This could include your smartphone, other cars on the road, or servers managed by the automaker.

Using an array of embedded sensors and computers, connected cars can collect a staggering amount of data, such as:

• Location, routes and destinations
• Speed and driving habits
• Biometric data like heart rate and eye movements
• Surroundings and road conditions
• Cabin preferences like temperature and seat position
• Personal communications from connected devices
• Infotainment system usage

Automakers use this data to power features like real-time navigation, remote diagnostics and predictive maintenance. Additionally, user data is extremely valuable for marketing and product development. A recent McKinsey report estimates that connected car data could be a $450-750 billion market by 2030.

The benefits of driving connected

There‘s no denying that all this data collection enables some incredibly useful features. Some of the top benefits of connected cars include:

1. Enhanced safety and driver assistance. Connected cars can communicate with other vehicles and infrastructure in real-time to provide warnings and prevent collisions. Driver monitoring systems can detect distraction or drowsiness. And emergency call services can automatically contact first responders in the event of a crash.

2. Optimized navigation and routing. With access to real-time traffic, construction and road condition data, connected cars can automatically optimize routes to avoid congestion, hazards and road closures. This saves time and reduces stress on the road.

3. Personalized comfort and convenience. By learning your preferences over time, connected cars can automatically adjust settings like cabin temperature, seat position, lighting and music to your liking. Cars will even be able to complete transactions on your behalf, like paying for parking or tolls.

4. Proactive maintenance. Predictive analytics allows connected cars to identify maintenance issues before they cause a breakdown. The car can alert you when it‘s time for service and even schedule an appointment at your preferred local dealer.

5. Expanded mobility services. Connected cars are essential for enabling mobility services like car sharing, e-hailing and subscription-based models. These services provide flexibility for people who may not need or want to own a car.

Cybersecurity risks to be aware of

While automakers are investing heavily in securing connected cars, the risks of a breach are very real. And the impacts could be far more severe than a typical cyberattack. In 2015, security researchers demonstrated they could remotely hijack a Jeep‘s braking and steering via its infotainment system, leading to a mass recall of 1.4 million vehicles.

Most hacks will likely be motivated by stealing personal data and digital identity rather than commandeering cars. But the possibilities are frightening:

• Remotely unlocking cars, starting engines, or controlling functions
• Stealing sensitive personal and financial info via car apps
• Tracking your real-time location and movements
• Accessing in-cabin cameras and microphones
• Holding access to the vehicle for ransom
• Sabotaging safety systems or causing intentional collisions

The risk is compounded by the fact that cars have much longer lifecycles than computers and smartphones. The average vehicle on US roads is nearly 12 years old—an eternity in IT security terms. Unlike your iPhone, your connected car may go years without critical security updates.

While carmakers are getting better at "baking in" security from the design phase, the industry has a long way to go. Vulnerabilities are rampant and new ones are discovered all the time. Security researchers found serious flaws in 58 of 85 new vehicle models tested in 2019. Many models still lack basic protections like data encryption and authentication.

Protecting your privacy on the road

Connected car data is extremely attractive to advertisers, insurers and other third parties looking to profit from your personal information. And there are few regulations governing how this data can be collected, shared and monetized.

Most automakers‘ privacy policies give them broad latitude to use connected car data for purposes like targeted advertising, market research, product development and "other business purposes." This data is often shared with unnamed "partners" and "service providers" without any way for consumers to opt out.

Additionally, connected cars present a new avenue for government and law enforcement to access our private data. In 2017, US Customs and Border Protection agents began using vehicle forensic kits to extract data from the internal hard drives of cars seized at the border. This data could include location history, contact lists and other sensitive information. And it can be accessed without a warrant or consent from the owner.

As cars collect more and more personal data, comprehensive federal privacy legislation is urgently needed to limit collection and require consumer consent. The SPY Car Act, introduced in 2017, is a good start. It would require automakers to implement baseline security standards and be more transparent about data collection. But the bill has languished in the Senate for over two years.

How to protect yourself and your data

Until we have stronger regulations, it‘s up to individual consumers to proactively manage their vehicle data. Here are some steps you can take:

1. Understand your car‘s data practices. Before buying a connected car or enabling any services, carefully review the privacy policy to see what data is collected and how it‘s used. Look for settings that let you opt out of data sharing for marketing or other purposes.

2. Be selective about permissions. When setting up connected services, avoid giving blanket permissions. Only enable access to the specific data needed for core functionality. Avoid linking sensitive info like financial accounts.

3. Use an anonymous profile. Consider setting up car services under an alternate name, email and payment method to avoid directly linking vehicle data to your identity.

4. Keep software and apps updated. Enable automatic updates for your vehicle‘s operating system and any first-party apps to ensure you always have the latest security patches. Avoid using third-party apps unless absolutely necessary.

5. Clear your data. Before selling, trading in or returning a leased vehicle, delete your profiles, reset the infotainment system and have any mobile apps unlinked from the vehicle.

6. Support privacy-friendly brands. Make privacy a priority in your vehicle purchase decisions. Look for automakers that are transparent about data practices and offer you control over your information.

7. Advocate for your rights. Contact your representatives in Congress and express your support for comprehensive federal privacy legislation covering connected cars. It‘s one of the most impactful ways to drive change in the automotive industry.

The road ahead

Like it or not, data collection and connectivity are becoming standard features in modern vehicles. And while there are undeniable benefits, consumers shouldn‘t have to sacrifice their safety and privacy to access them.

As cars evolve into data-guzzling, internet-connected devices, it‘s critical that cybersecurity and privacy protection keep pace. Automakers must implement rigorous security standards, minimize data collection, and empower consumers with transparency and control. At the same time, we need clear regulations to prohibit abusive data practices and hold the automotive industry accountable.

As a cybersecurity expert, my advice is to enjoy the cutting-edge features of your connected car—but don‘t let your guard down. Be proactive about managing vehicle data the same way you would sensitive info on your computer or smartphone. Together, we can leverage the power of connected car technology while keeping our personal data safe in the cloud.