Australia’s intelligence agency has warned politicians and public servants not to discuss sensitive or classified matters inside vehicles, including any vehicle that may be connected to the internet. ASIO Deputy Director-General Lisa Alonso Love told senate estimates that the advice applies to all cars, not just connected ones, but said connected vehicles can pose extra data-collection risks. Classified conversations, she said, should take place only in properly secured locations and not while travelling.
The warning comes as seven Chinese electric vehicle models were added to the taxpayer-funded fleet available to federal politicians, bringing the share of such vehicles under the parliamentarian vehicle scheme to about 30 percent. However, the issue is broader than electric vehicles or cars made in China. Any connected vehicle can present privacy and national security concerns because many modern cars continuously collect and transmit large amounts of data.
According to the Australian Signals Directorate, a connected vehicle is any car linked to the internet, whether through an embedded SIM card or a paired smartphone. Most major vehicles sold in Australia with connected services gather data from drivers and passengers and send it to manufacturers. Industry research cited in the report indicates that the proportion of internet-connected cars on the road has been rising rapidly and is expected to keep increasing over the next several years.
The data collected by these vehicles can be extensive. Sensors embedded in seats, dashboards, engines, steering wheels and cameras can generate huge volumes of information every day. This can include precise location, speed, braking behaviour, seatbelt use, infotainment activity and signs that a driver may be sleepy or impaired. Some systems can also infer personal characteristics such as age, weight, race and facial expressions from in-car and location data.
Connected vehicles may also access information from smartphones linked by Bluetooth, including contacts, calendar entries, maps, habits and other personal details. Passenger privacy is also affected, because data collection may capture conversations and actions inside the vehicle. Sales agreements often place responsibility on drivers to inform passengers that sensors may record or collect information.
Privacy concerns are not limited to one brand or country of manufacture. A 2023 Mozilla report found that vehicles were among the worst products it reviewed for personal data collection, and none of the 25 cars examined passed its privacy review. The report said some manufacturers use the information to improve products, but vehicle data can also be shared with affiliates and data brokers and repackaged for sale. Reuters also reported in 2023 that Tesla employees had privately shared highly sensitive images and videos collected from customer vehicles.
Consumers can reduce some risks by reviewing privacy policies before buying, checking vehicle data practices through privacy-reporting tools, disabling optional connected features where possible and performing a full factory reset before selling or lending a car. However, opting out of certain data collection may limit some vehicle functions.
