Connected car privacy: 7 data-leak risks identified by AIVD

© A. Krivonosov

Do not discuss confidential information inside the car, disable automatic Bluetooth and Wi-Fi connections, avoid saving a home address in the built-in navigation system and even consider avoiding wireless charging. These are among the recommendations issued by the Dutch intelligence service AIVD for users of modern connected vehicles. The guidance is aimed primarily at people who handle sensitive information at work, although several measures are useful to ordinary drivers as well.

The warning is not about one particular brand. AIVD identifies seven potentially sensitive areas: microphones, interior and exterior cameras, connected phones and other devices, the infotainment system, GPS, the telematics module and charging infrastructure. The service says attackers could technically try to gain access to a microphone or camera, vehicle location data or information from a connected device. This describes possible attack vectors, not evidence that manufacturers routinely listen to owners.

Infotainment can concentrate especially large amounts of information. According to AIVD, it may contain identifiers of connected devices, contacts, internet traffic, messages and navigation data. People working with sensitive information are advised not to enter home addresses or locations of sensitive facilities, not to hold confidential conversations in the vehicle and not to use cars with exterior cameras when visiting sensitive locations.

A Chinese badge by itself proves nothing. AIVD does not single out China and instead discusses connected vehicles in general. Data collection and transmission support navigation, online services, remote diagnostics and software updates. The key questions are what data are transmitted, who can access them and how well the relevant systems are protected.

For ordinary owners, the simplest measures are also the most practical: disable unnecessary automatic Bluetooth and Wi-Fi connections, avoid storing sensitive addresses in navigation, skip wireless charging when the security context calls for it, and use a USB data blocker if a port is needed only for charging. AIVD recommends that people dealing with state, military or commercial secrets assess the risks of using a vehicle according to the purpose and route of each trip.