The Daily - Your Car May Be Spying on You

Episode Date: March 18, 2024

Warning: this episode contains a discussion about domestic abuse.As cars become ever more sophisticated pieces of technology, they’ve begun sharing information about their drivers, sometimes with unnerving consequences.Kashmir Hill, a features writer for The Times, explains what information cars can log and what that can mean for their owners.Guest: Kashmir Hill, a features writer on the business desk at The New York Times.Background reading: Automakers are sharing consumers’ driving behavior with insurance companies.If your car is tracking you, abusive partners may be, too.For more information on today’s episode, visit nytimes.com/thedaily. Transcripts of each episode will be made available by the next workday. 

From The New York Times, I'm Sabrina Tavernisi, and this is The Daily. As modern cars become ever more sophisticated pieces of technology, they've begun sharing information about their drivers, sometimes with unnerving consequences. Today, my colleague Kashmir Hill explains what our cars now know and what this means for our lives. It's Monday, March 18th. So Kashmir, you're a data and technology reporter, and you usually come on the show to tell us some very frightening new way that technology is going to affect our lives. This time, though, you're coming on the show to talk about cars. Why cars?

Well, like many Americans, during the pandemic, I got a new car. And I hadn't had a car since 1999 when I was in high school. And cars have changed a lot. They've gotten much better. They're more sophisticated. I mean, they're basically computers on wheels. But I know that when you connect things to the internet, it has the ability to record data about you, watch you, potentially spy on you if you don't know what kind of data is being collected and sent out. So you're sitting in this new car looking around thinking, okay, this stuff

is probably spying on me. Exactly. And I wondered what kind of data are cars collecting now and where are they sending it? Who's getting it? I just wanted to know who's tapping into these cars. Okay, over here. Yeah. And this reporting led me to a woman named Christine. My name is Christine Deldo Ogden and I'm from Berger City, Louisiana. Georgia City, Louisiana. Christina is a real estate agent in Louisiana. And for a while, she also sold medical supplies. So her car, a Mercedes, was really important to her work. I had a Class C 300. And actually, my car was basically like my roving office. And as a rep in that capacity, you have to live in your car. So it's pretty much like you're home away from home. Christina had been married for 10 years,

and her now late husband was a federal agent and abusive. I kind of started losing my independence, I guess you could say. And one night, he got violent with her, and she decided to leave him. She got in her car car and she drove five hours away to where her daughter lived. She ended up filing a police report against her husband for domestic violence. And she did not want to be in contact, but he's texting her. He's calling her. And then he started sending her messages that indicate he knows where she is in real time. And there were a lot of weird incidents, like this one particular incident where she was on a work trip.

And I'm sitting in a parking lot. And she was waiting for her colleague in her car. And all of a sudden he shows up and backs up, rolls his windows down and is looking at me. He suddenly shows up in the parking lot. Wow. And she had already made sure that he couldn't track her phone. And then she realizes. Oh, my God.

And it just hit me in that moment that it has to be the car. It has to be the car. That the only way it could be happening is that he is tracking her car. The only way it could be happening is that he is tracking her car. And then I started thinking about, well, the only thing that is tied me to this car is going to be that Mercedes app. So her Mercedes was connected to an app Mercedes offers called Mercedes Me. So I get on there and there's all this information on there that says, you know, you can open your car door. And it's one of these connected car apps. You can use it to lock and unlock the vehicle, maybe turn it on remotely.

And you can also find out the location of the car. And so that's what her husband was doing. He was tracking the location of the car and thus seeing everywhere she went. I had no idea he was actually watching every move I made. That car was a red light, you know, shining that, oh, she's here. Oh, she's there. And he's constantly checking, you know, that app looking to see where I was. We So what does she do once she has this information? So at this point, she already has a restraining order against him. So she lets the detective on her case know, hey, he's tracking me.

And that's when we start calling Mercedes. And I explained to them. She calls Mercedes because she wants to get his access to the car, you know, turned off or evoked. I didn't know he was going to use the ambulance system to track everywhere I went. And that's what he's been doing is tracking everywhere I go. But hang on, let me ask you a question. Let me ask you. She is running into problems because he's the owner of the car. Did they say that the vehicle could be in your name, or was it an agreement that the vehicle stays in his name?

The title is in his name. And Christine told me it's a decision that they made because he had better credit. But she is the one paying for the car. I've got it in my papers that I have access to the car. I'm the only one that's ever really paid a note on this car. And she actually had an order from the judge that had awarded her ownership of the car during divorce proceedings. She had this temporary restraining order. And so she's telling Mercedes, look, I know he's technically the owner of the car, but this is my car. A judge has said this is my car.

I have a restraining order against him. He's not supposed to be getting this access to me. Please turn this off. He has violated several protection orders because he stalks me on this car. And it's really hard to do anything. Okay. And she calls repeatedly. Because I know I can't be the only woman if this happens to you. And they can't help her. Crazy. And she calls repeatedly.

And they can't help her. Crazy. The person who owned the car had the right to be connected to the vehicle. And Mercedes just didn't seem to have any kind of protocol for what to do when this happens. That is really, really remarkable. So what does she do? So she eventually ends up taking the Mercedes to a mechanic and she pays $400 for him to basically pull the device in the car that provides internet connectivity. So she disconnects her car.

And it meant that she lost kind of navigation services in the car. She lost the ability to call roadside assistance, but she didn't care. She said, I just don't want him to be able to track me. It's pretty terrifying, this story, Cash. And I have to say, it's pretty surprising to me that there wasn't a way Mercedes could stop this. What did Mercedes say about this? Mercedes said they could not comment on an individual customer. But this is not just Mercedes. There have been other reports of

women. This happened to other car brands with Tesla. The detective in Christine's case, it actually had another case just like this with Alexis. And I think what's really troubling here is that cars are a lifeline for these women. It's literally how they are getting away from abusive situations. But because it's connected to the internet, it's another place where they can be tracked and harassed. And this is the paradox of connected cars. They are no longer private spaces. And what do we make about the fact that these cars, you know, they have all this technology that now, as we're seeing, can be exploited, but the car manufacturers don't seem to have anticipated that? Yeah, I mean, car manufacturers have been making cars for a long time, but they just started making these connected cars really just in the last decade. And car companies, when they have thought about safety, for example, in the past, they're thinking about seatbelts.

They're not thinking about data security, privacy and harassment, all of these things that happen when you have humans combined with technology. These car companies are so new to this. And I don't think they've kind of worked out the kinks in the way that the Googles and the Facebooks of the world have to the extent that they have. thing yet, right? They have come into this technology space, this digital space, looking around and not practiced it like how to treat data carefully and really what to do with it at all. Exactly. And so these are new problems for car makers, but they're not new problems when it comes to technology. And this was a case of a bad actor invading the privacy of a driver. But as I continued my reporting, I discovered that car companies themselves were invading the privacy of millions of drivers. We'll be right back. So, Kashmir, you said that these privacy issues in cars actually go beyond individuals exploiting technology, that in fact, you discovered that car companies themselves were invading people's privacy. Tell me about that. forums, places on the internet where people talk about their cars and their love of cars and their issues with cars on Reddit, on kind of dedicated discussion boards. And I kept seeing the same story over and over again. And it was people whose insurance rates had gone up and they would ask the

insurance agent, why did my insurance go up 20%, you know, 50%? Or why can't I get insurance? And the agent would tell them, you need to pull your LexisNexis report. So LexisNexis, they're basically a big data broker. And LexisNexis has a division called LexisNexis Risk Solutions. And historically, it's kept track of moving violations, speeding tickets, any accidents you've been in, whether you were at fault or not at fault. And so these people go to LexisNexis, they ask for their files. And when it comes to them, the files are hundreds of pages long. And in them, they are finding information about every trip they have taken in their cars over the previous six months, how far they drove, when the trip started, when the trip ended, how many times they hard braked, hard accelerated, or sped. Wow. And these people were shocked. And so they came to the online

forum saying, why is this happening? Does anyone know why this is happening? And how do I turn this off? Okay, so what's the answer? How was it happening? So, you know, we talked earlier that cars can collect this really detailed data. And that's what was happening. The cars were collecting this data. This was happening to people who drove cars made by General Motors. General Motors was getting this data and then General Motors was giving it to Lexus Nexus. Wow. Okay. So the car company itself was actually just handing it over? Well, I don't think they were just doing it for free. But yes, they were sharing and selling this data. And it wasn't for everybody. It wasn't everybody who drove a GM car that this was happening to. It was happening to a subset of

people who had knowingly or unknowingly, in some cases, been enrolled in something called Smart Driver. And what's Smart Driver? So Smart Driver is a feature offered by GM that's called OnStar Smart Driver. And it's supposed to be a program to help you be a better driver. And you can collect digital badges for being a good driver,

like brake genius and speed limit hero. And you get some feedback like, take it easy on the brakes. You know, don't speed up so much. Make sure you're leaving room in front of your car so you're not going to hit the person in front of you. Like, don't tailgate. So it's a little bit like one of those exercise apps, like, great job. You ran five miles. Nice braking there. Or on the contrary. Yeah, it was that gamification of real life, right? Like, get a good score, be a good driver. But what people who turned this on didn't realize was that there was something buried in the privacy policy that no one reads that said that they could share that data with third parties. And the third parties that they were sharing it with were LexisNexis and another data broker that works with the insurance industry called Verisk.

and another data broker that works with the insurance industry called Verisk. So some kind of vague fine print lets them turn this driving game into a data harvesting machine, essentially. Yeah. So when I talked to GM, the spokesperson said that people could turn this on in the vehicle app or at the dealership when they bought the car. So it seemed possible that this was quietly being turned on at the dealership by salespeople. And I found this company manual that said that salespeople could earn bonuses from GM by getting drivers to enroll in OnStar Connected Services, including Smart Driver. I mean, there's something kind of creepy about it, right? Like these people were driving around. They had no idea that every move they made, including when they braked, when they turned, how fast they approached a stop sign, all of that was kind of being watched.

It feels like a fundamental violation of privacy in your own car. One of the drivers I talked to said it felt like a betrayal, like he had no idea this information was getting collected and that it would be shared in this way that cost him financially, like his insurance went up. And he said, I'm a safe driver. I've never been in an accident. I don't even kind of understand how they're judging me on this. So it was really confusing to the people this was happening to. And how much were their rates actually going up? Like, give me an example. So one Cadillac driver I talked to in Palm Beach, Florida, said that he actually got denied by seven auto insurance companies. And he wound up paying double what he was paying before for his auto insurance. That is a huge increase.

How typical was that? Do you have a sense of that? You know, it's hard to tell. It was just a lot of posts on these different forums, and some people said 20%. Some people didn't know how much it affected their insurance. But yeah, it seemed to range from, I saw 20%, I saw 50%, and I saw people who said their insurance doubled. And what was the scope here in terms of companies? I mean, was this just GM? And what was the scope here in terms of companies? I mean, was this just GM?

So I was only seeing people really explicitly complaining about GM cars. I'd had this experience of my insurance went up. I went to Lexus Nexus. I found my details. But then when I started looking into this, I saw that actually a lot of different automakers are starting to do a form of this. And some of the automakers said, you know, this is about safety. We're trying to help people be better drivers. Often they have like a driver score or driver feedback or road score in their app. And sometimes it's the data broker that's actually giving you the score in the app, not your automaker. Okay. So they say it's for safety. Does that explanation hold water? So a version of this has been going on for a long time. There's something called usage-based insurance, where you with your insurance company say, okay, I'll put a dongle in my car, or I'll put your app on my smartphone, and I'll let you monitor my driving. And those programs have

actually been quite successful. I talked to one expert expert and he says that when people are knowingly doing this, being observed that the impact on safety is enormous, that, you know, these people become better drivers. But that doesn't work if you don't know that you're enrolled in this program. If you don't know that how you drive is going to impact your insurance, then you're not going to improve your driving. There's no safety benefit here. At the same time, there's this question of, what does this data even mean? What is hard braking? What is hard acceleration? How does it reflect how risky a driver you are? I was actually thinking about this a couple days ago because I was driving home late at night and a herd of deer just suddenly sprinted across the

road and I had to slam on the brakes. And I saved my car insurance company a bunch of money because I didn't hit the deer and damage my car. But I wonder in the data, do I look like a terrible driver who was tailgating somebody and then had to slam on the brakes? I mean, back to your point earlier in the show, right? These car companies are kind of tech companies in training, right? And I imagine that they will soon learn some of the lessons that other tech companies have had to learn, which is surveilling your customers, collecting troves of data that doesn't go unnoticed for long periods of time. I mean, it will have a response. have a response. People are not happy about this. And I've been watching those. I'm still in those online car forums. And I see people reacting to this story. And they're saying, oh, my God, I just checked my app and I'm signed up for this. I can't believe it. They're saying I'm not going to buy a GM car. I'm not going to buy any of the cars that are mentioned in this article.

But the thing is, there's there's lots of different automakers that are doing this. I talked to Senator Ed Markey about this. Senator from Massachusetts. Senator from Massachusetts. He's been talking to car makers, asking them, what data are you collecting about people? Who are you sharing it with? And they had sent him some very evasive answers. But he said, when I described to him what was happening with GM, he said, that sounds like a violation of the law that protects consumers against unfair and deceptive business practices. And a couple of days after my story came out, there was a class action lawsuit filed against General Motors and LexisNexis in the Southern District of Florida. Texas in the Southern District of Florida. So this is really a moving target in terms of, you know, in a way, a new social problem. I mean, you started digging into the privacy implications of these cars and you found pretty quickly two very egregious examples of ways car drivers' privacy is being violated, which kind of makes me wonder, you know,

what else is going on with these cars that we don't even know about yet? Right. Honestly, this is what I have been seeing in the last decade or so. I've been reporting on privacy and data collection. At first, I was writing about Facebook and Google. But now everything is Internet connected. It's not just cars. So many of the products we get, your TV, your vacuum, sometimes your bed, your toothbrush, like they want to put a Wi-Fi connection on everything. And it can be really convenient.

It can give us information remotely. You know, we can turn things on and off our lights. But once you have this internet connection, it means people can get at these devices who previously couldn't. And it means that things that don't look like a camera, that don't look like a recording device, are. They're watching you and they're gathering information about you. And it's this big question of who's getting it and how is it going to be used? Kashmir, thank you. Thanks for having me on, Sabrina. We'll be right back.

Here's what else you should know today. In a highly anticipated ruling, a judge overseeing the election interference case against Donald Trump and his allies in Georgia decided on Friday that the Fulton County District Attorney, Fawnie Willis, could remain in charge of the prosecution, but only if her former romantic partner withdrew from the case. The ruling essentially meant the case against Trump and his allies in Georgia could proceed, since the judge could have removed her and her entire office from the prosecution, but chose not to.

The decision revolved around a defendant's claim that Willis should be disqualified because her romance with her office's lead lawyer, Nathan Wade, had given her an inappropriate financial stake in prosecuting Trump. Within hours of the ruling, Wade resigned from the case. But even as the judge spared Willis, he refused to fully vindicate her. The ruling described her decision to date Wade and take multiple vacations with him as, quote, a tremendous lapse in judgment that had raised a significant appearance of impropriety. And in Russia, Vladimir Putin garnered 88 percent of the vote in the presidential election held

this weekend, according to Russian election authorities. His win was a foregone conclusion, as the Kremlin had blocked any real competition. In a quiet show of opposition, Russians formed long lines at polling stations in several major cities at noon on Sunday at the request of the team of the now-deceased opposition leader, Alexei Navalny. If Putin serves to 2030, the end of his new term, he will have the longest tenure of any Russian leader since Catherine the Great in the late 1700s. Today's episode was produced by Olivia Natt, Alex Stern, Diana Wynn, Will Reed, and Ricky Nowetzki. It was edited by Devin Taylor.

Contains original music by Marion Lozano, Pat McCusker, and Rowan Nemisto. And was engineered by Alyssa Moxley. Our theme music is by Jim Brunberg and Ben Landsverk of Wonderly. and Ben Landsberg of Wonderly. That's it for The Daily. I'm Sabrina Tavernisi. See you tomorrow.