Tracking and technology in cars is being weaponized by abusive partners
nytimes.com
nytimes.com
Simply put we need the perpetual right to own, revoke, and control the flow of our data. We need the perpetual right to real privacy from intrusive governments which, ironic to the consitution, are beginning to resemble and exceed the very governments they formed to overthrow.
I have had friends at Apple, Facebook, and Google question whether they could work on open source projects on the side and I highlighted this for them.
Note that employers often still put unenforceable restrictions on these things in their contact which I think sucks. It confuses employees who don’t know their rights and chills valuable work on open source.
https://www.aegislawfirm.com/blog/2023/01/california-moonlig...
This is a big reason why I think clauses in contracts with individuals should not be separable. The entire agreement is either valid or not, you can't stuff it full of a tenuous wishlist of rights.
Lawyers are far too expensive to ask every citizen to hire one every time they want to find out which clauses are blatantly unenforceable.
Maybe it made sense when the sum of laws that apply to everyone was a reasonable quantity, but at this point even lawyers only really know the parts they specialize in.
There have to be millions of pages by the time you include all the case law that set precedent.
Even then I might want to keep the scope narrowly to employment contracts. A contract between two large companies would have wider implications if it could be invalidated completely.
My understanding is that contract law is nuanced and it is important for the functioning of society that small mistakes can be fixed without major repercussions, but I am in favor or making sure large employers aren’t misleading employees.
I presume, perhaps incorrectly, that an industry would spring up around "standardized contracts" offered for very cheap/free. Seems like something Intuit might offer for free as a hook to get you on the platform.
Individuals would also likely use standardized contracts when dealing with other individuals, ideally. I would be okay with exempting them, but I really do think there benefits to centralizing on some standardized contracts. We could do something like what GitHub does when you look at licenses and it tells you what the license grants and denies. You could probably get specific case law for questions, because there are a lot of cases using the exact same contract.
I think it's typically (though not always) an anti-pattern for two individuals to write their own contract. I do not want my landscaper to write his own contract, which I then have to make sure I understand correctly. I'd much rather get "Standardized Lawn Care Contract V2 /w Owner Liability Option" and be able to find an infographic that summarizes who has what responsibility, up to what amounts, etc, etc.
> Even then I might want to keep the scope narrowly to employment contracts. A contract between two large companies would have wider implications if it could be invalidated completely.
I specifically limited it to contracts between individuals because I think having lawyers at-hand is a fair expectation of companies. They have enough resources to find out what's enforceable and what isn't, and B2B contracts would typically be for amounts where hiring a lawyer doesn't erase all the gain from the transaction.
You find out your contract has an invalid clause. What now? Contract null and void and you pay back all the wages received? Or just stop being employed from that moment forward?
In that circumstance, if both parties are still happy with the terms they would presumably sign a new contract minus the unenforceable terms.
If the company opts not to create a new contract, I would say it counts as firing the person without cause.
It is an interesting question though, especially as it pertains to future incentives. Something like the person having earned a bonus that hasn't been paid out yet, the contract is found invalid so the bonus part is scratched out.
Perhaps the individual deserves a choice in that case, whether to proceed without a contract or under the terms minus the unenforceable parts, or maybe something more punitive to the company like the individual keeping any rights they got and the company losing theirs.
I still think it's a workable idea, but you do raise an interesting point that's probably worth adjusting my idea around.
Last but not least, any new political party can be crushed by information asymmetry - if every minor indiscretion of their members is outed, while the ruling parties can keep their own sins hidden, thanks to a friendly intelligence apparatus, no new party will ever upset the status quo. It also means the old parties will be compelled to remain friendly with said intelligence apparatus (wonder why section 702 of FISA got extended again [1]?)
In other words, even if you personally somehow go your entire life without having to hide a single thing, unless others can hide things, you will one day wake-up under tyranny.
They're doing nothing wrong. They have nothing to hide. Everyone knows what they're up to.
And yet, they have this strange, inexplicable desire for privacy in spite of those three things!
Yet, walk into a gym changing room and you'll see balls swinging everywhere. They've done nothing wrong, nothing to hide, everyone knows what they are doing - but yet, they don't care about privacy?!
Social expectations set privacy expectations. People conform to those expectations outside of their own desires or wants for privacy / non-privacy.
As someone who's been to YMCA locker rooms in the 1990s, 2000s, 2010s, and in the 2020s, this is increasingly only true of the elderly. I don't think I've seen anyone under 30 walking around outside of the showering area without a towel for years now.
Another important distinction is that gymgoers in the changing rooms are free to choose whether to exercise their right to privacy, or to waive it, and there is not a corporation with a 9/10/11 digit valuation with entire teams of engineers dedicated to annihilating their privacy in pursuit of monetization.
What carmakers are doing to the privacy of end users is not terribly dissimilar from gyms prohibiting the use of towels / bathing suits in changing rooms, punishable with loss of contractual rights you had as a customer of the gym for the first violation, like getting financial recourse if the gym fails to abide by their contractual duties.
And yet almost nobody seems to think this is enough of a problem to stop going to that gym, which of course will only encourage the gym to roll out even more bizarre, draconian infringements on the privacy and freedom of their clientele.
Most people would take umbrage with this portion of your argument. They clearly do have something to hide; whether it's from shame, embarrassment or politeness.
For example, you drive the same way anybody else does on the road, you "have nothing to hide" in that sense, but you still wouldn't want your insurance getting up to the minute data on where you're driving and how because that places the control of your finances in their hands. You cook your breakfast the same way everyone else does, you have "nothing to hide" in that case, but you still wouldn't want your neighbours to be able to see a livestream every morning of you cooking without you knowing.
Would you reveal everything about your financial, work and personal lives to someone you were in a business negotiation with? Just because they wouldn't do anything "illegal" with it?
Information about each of us is leverage. Even when used legally, it gives away our power over our lives to others, to use against us.
"Cool, can I install a camera in your toilet? Or do you have something to hide?"
Cars are becoming like PCs or phones, pre-bundled with a bunch of shit that you'd want to selectively purge upon acquisition but somehow car manufacturers don't have to give you the option.
Bafang? Got a nice programming cable, always adjust throttle behaviour and soft start.
I’ve tried to tell him that a computer in the car should be a diagnostic asset, completely usable with open source tools. Imagine seeing the timing and dwell on an old car in curves on the screen rather than using a timing light (as delightful an analog solution that is) and dwell meter. Instead, computers have been used by auto manufacturers as a lock in tool—“check engine,” bring to dealer.
Created by massive activism, unpaid labour of millions of passionate people who otherwise are very expensive and have a very well paying job.
This is not a practical and sustainable solution for most things. In fact it does not work at in when we have to deal with embedded software even in something as simple and cheap as a phone, TV or a smart coffee machine, let alone a car.
We need a bigger stick, legislative solution with serious criminal sanctions. Misusing user's data should be treated like a bank misusing customer money - serious business that must be audited.
Bonus points for spoofing GPS to show the car in Antarctica or something like that, so that the trustworthiness in the accuracy of the entire dataset (and thus the commercial value) goes down, instead of just you choosing to opt out.
Supporting small independent mechanics + right to repair is supporting your ability to protect your own privacy too!
My guess is that even if it is possible now, it won't be for much longer.
Freedom, privacy, and full ownership/control are three concepts that are becoming increasingly foreign to young people, it's quite sad.
Blatantly untrue for commercial modification though. There is no shortage of performance shops that will take a car that makes a couple hundred HP from the factory, replace a bunch of internals, completely void the warranty, and bump it up to the 4-digit range of horsepower, albeit mostly with a small handful of the overall number of makes and models, as not all cars are good platforms for high performance.
I suspect the reason that we don't see much of a commercial privacy modding scene for cars is that there simply isn't sufficient demand.
The manufacturers may be educated, listening, and watching us, but most people would simply prefer to bury their heads in the sand and choose to act ignorant, deaf, and blind in the face of this problem.
It's almost like non-technical folks have developed a "learned hopelessness" over their privacy, which is really sad in some ways. That's the same thing people living under many brutal, murderous, totalitarian dictatorships developed too after their privacy was obliterated, like in the former Soviet Union.
Besides, I wasn't really talking about a typical family car, but rather a handful of platforms like stuff with LS-family, Coyote blocks, R35's, Mk4 Supras, etc. There's variability even between those, but a gen 2 coyote motor will easily take 900+ crank on the stock internals, just need to swap oil pump gear and crank sprocket gear and something to make that power (turbos/supercharger/nitrous/etc). Swap some lower rotating assembly stuff and you're well into the 1XXX range with sufficient boost.
Also, some of the people I'm thinking of are most certainly NOT usng factory engine blocks, but rather aftermarket blocks. Factory blocks are mostly cast aluminum trash, with a few exceptions.
Remember the words of former head of the NSA, Michael Hayden, "The U.S. government kills people based on metadata".
There are a handful of open source headunit projects, I think PILOT Drive* is the most interesting even though it seems to be fairly recent
*: https://hackaday.io/project/191356-pilot-drive-an-open-sourc...
I share my location with a lot of people on iMessage. Basically any time I have ever had to meet somebody, if they’re a close friend or family member, I share my location with them indefinitely and never turn it off, and lots of people do the same thing to me.
I think this is like the 2020s version of giving somebody a spare key to your house.
And the spare key analogy seems poor. I can trust a friend not to use a spare key to facilitate robbing my house which they could presumably break into anyway—without my minute to minute movements being any of their business.
It's been years we've been doing this. Honestly, I can't imagine not doing it.
This is a similar paradigm for other things like phone/family tracking, smart home, etc. Far too many people don't give a shit about privacy or security until they are a victim. Then the call is for some third party to make it secure for them rather than go with the more permanent and secure fix of doing away with the unused features (like removing the connection).
I have three cars, only one a modern connected BEV, a modest MG ZS long range 2022. Just for instance with it's app sometimes I connect to someone else car in another country, localizing it. Apparently unlocking and remote command heating/A/c does not work sometimes, asking for a pin, sometimes does work not asking for nothing.
The problem is not the ex-husband, the problem is the crappy crapware you put on your vehicles to control them as you wish without much formal owners but in reality just users controls...
That's the real ABUSE.
[1] https://samcurry.net/web-hackers-vs-the-auto-industry/ also https://news.ycombinator.com/item?id=34230093
Other than burning all the carbon, I think this insane totally unregulated, opaque, user-hostile, leaky, insecure surveillance panopticon is a good candidate for a large scale human self-own.
Privacy loss is a little like climate change. The problem builds but nothing obviously bad happens right away, so people don't notice or don't really care. Nothing bad happens until it does but when it does it's too late.
One of the things I've found is that Europeans seem much more concerned about privacy than Americans. I've chalked this up to their experience in the 20th century with Hitler, Mussolini, Franco, and the Soviet sphere of influence. Maybe Americans need their own experience with totalitarianism to show them why surrendering all privacy for convenience and free candy might not be a great idea. (Who knows... we might get it soon!)
Another class of very bad things that can happen is foreign influence powered by all this surveillance. We've already seen some of this from Russia, but China is smarter and better funded and probably has 100X the data and access. If they decide to invade Taiwan expect a full information warfare assault against the US population powered by fine grained surveillance data and delivered via social media. Since they probably know when you go to the bathroom, they'll be able to use AI with all this information to micro-target every single individual.
Mercedes has lawyers as well as network admins, and the fact that the victim had a court-issued restraining order is not the sort of thing that one can simply choose to believe in or not.
If the law currently supports Mercedes' response, it's time for the law to be updated to recognize the increasing scope for this sort of abuse. The husband forfeited a certain amount of freedom of action through the behavior that earned him the restraining order, and neither Mercedes' interest in the car as security on a loan nor the many other advantages of tracking a vehicle necessitate, let alone justify, Mercedes' response.
>Mercedes has lawyers as well as network admins, and the fact that the victim had a court-issued restraining order is not the sort of thing that one can simply choose to believe in or not.
It has nothing to do with belief in a restraining order. A restraining order says nothing about transferring the car title.
I anticipated this response, but apparently I didn't make it clear enough: The husband forfeited a certain amount of freedom of action through the behavior that earned him the restraining order. At this point in the divorce proceedings, where continued use of the car has been granted to one of the spouses pending a final resolution, and there is also a restraining order in effect on the other, there is no justification for the other spouse having a right to track the vehicle. If it had been stolen (which is not the case) and he was unable to track it himself, that would just be a consequence hehad brought on himself through his bad behavior.
If Mercedes did not have any interest in tracking the car, then that just removes one possible justification for its inaction.
> A restraining order says nothing about transferring the car title.
And this issue is nothing to do with transferring the car title.
The broader issue is that if a couple has turned on all sorts of data and account sharing it’s easy to see how information leaks can easily happen in spite of efforts to plug them by one party.
Privacy concerns with manufacturer aside, I find the tracking feature to be very useful due to the amount of theft and break-ins we have over here in Canada.
"Your phone may be tracking you (when you don't actually own it and you're on your abusive partner's iCloud account)."
That being said, this also seems like the basic legal system needs to catch up in some of these cases.
For example, in the first one, the wife had been granted sole use of the car but the husband's name was on the title? That doesn't even seem legally consistent to me, leaving aside all technology matters.
I actually like it when rarely doing hours of highway driving, but for my normal use it’s absolutely unsuitable on the narrow and degraded backroads where I’m often squeezing by farm equipment. Definitely don’t like it trying to second guess me having to go over the line.
I absolutely loathe driving the crosstrek.
edited to clarify: I can shut off steering assist, but sometimes i drive with it on because my wife does (normally) and i like to make sure it's still "safe" - so each time i get in and the steering assist is "slightly different" than the last time, i notice. She only sees the gentle curve, like maybe the cameras are dirty, or this road's lines aren't sufficient for steering assist, etc. Whereas i notice immediately that it's acting different.
Auto theft in a lot of places in the United States has spiked so much since COVID that being able to track your car is critical infrastructure at this point*, particular if you drive the cars that are easy to steal right now (I have a friend that had his car stolen 3 times). I think being able to steal a car with a USB cable is a much worse problem for car manufacturers to deal with right now and I really hope we don't hand criminals yet another theft tool (on top of their unlimited supply of dangerous weapons) by eliminating car trackers by law or self immolation.
* https://www.axios.com/2023/07/20/car-thefts-2023-kia-hyundai...
A lot of the recent fear of crime feels like it's being driven by sensationalist reporting and overstating of the facts. E.g. "crime has doubled" has a very different meaning when you realize we were at record low crime rates just a few years ago.
[1] https://www.statista.com/statistics/191216/reported-motor-ve...
> losing it in a parking garage
I stop for a second and pay attention to where I parked my car. Maybe even take a quick picture of the surroundings with my phone. The "lock chirp" using my key fob usually makes up for the times I'm not quite sure where it is.
> determining whether it's been towed or stolen
Most municipalities where you're likely to be towed have an impound vehicle search website. I'm not going to let other people track me all the time just for a bit more convenience on the extremely rare occasion that my vehicle might be towed or stolen.
> rescue help in case it's in a more remote area during a blizzard
I check the weather and don't drive into remote areas during blizzards. I suppose if you're inclined to do that, you might want someone to track you all the time so they can maybe rescue you when you make those kinds of choices?
> Crime in a lot of places in the United States is so bad right now that being able to track your car is critical infrastructure at this point
If you are unfortunate enough to park a Kia in Seattle or San Francisco, I guess you've got a problem. But tracking my car is more for the benefit of my insurance company in that case.
It is however typical HN mentality to assume that nobody wants tracking whereas it is a matter of individual choice.
> a very steep price for me
Great. Now have some empathy with people for whom the price isn't steep at all.
Indeed. Which is why car manufacturers should make it easy for individual drivers to disable tracking in a way that can't be remotely reenabled by car companies.
It seems this is a case of too much tech for some people. Disabling most vehicle tracking is easy. It's usually a matter of disconnecting a wire/fuse/antenna/bridge. The criminals can easily learn it and defeat it, while many drivers don't know how to, or just don't care too until they are a victim.
My friend has a 2020 I-PACE sitting in his garage and wants to disable remote tracking. Exactly which wire, fuse, antenna, or bridge should he disconnect in order to do that without negatively impacting any other functionality of the vehicle? What tools will he need to do it? How long will it take him? What damage might he cause to his car if he makes a mistake because he's never done this before? How will this modification affect his warranty?
The usual way to get that info is to go to the model specific forum (very common for common vehicles). If there are no existing instructions, a shop manual is hugely helpful.
I do question your argument about some people not being able to find thwir car. Do people who lack the mental faculty to find where they parked simultaneously have the mental faculties required to safely operate the vehicle?
I’ll always have the parking garage problem due to poor memory. Sometimes I remember that I take a picture but my brain can’t remember to do that reliably. Building habits is nearly impossible for me. I even have a documented disability saying this happens, so it’s not for lack of trying.
My solution to solving this problem is to not require habits but to preemptively account for my blind spots. AirTags have been life changing for me.
Ah, yes, the "letting people who don't care know I'm now home or letting everyone know that I'm walking away from my unattended vehicle (so robbers better not touch it)" alert everyone loves.
Do you do the thing where you hit it a bunch of times to blast the horn and show off that 90s tech because you need people to see how cool you are?
Heh, I do this but it's because depressing the button on my remote doesn't guarantee that the alarm will arm. The sound of the chirp is key to whatever mode I put it in. I could also just use my phone, but the app is stupidly slow and I kind of hate that my car has an app. I'd much prefer the equivalent of dance dance revolution on a 90s key fob than accept all the things that come with an app.
This line was unwarranted. What part of steelframe's response suggested that steelframe likes letting other people hear the parked car's location, never mind honking?
Citation needed. Crime rates have been falling for decades. [1]
I have no doubt there are individual areas with high crime, and for those isolated pockets, people could opt-in to buying and installing tracking devices on their vehicles.
[1] https://en.m.wikipedia.org/wiki/Crime_in_the_United_States
It seems to me that both Kia and Hyundai are in the Top 10 of new car sales in the US.
https://www.carlogos.org/popular-car-brands/
From my anecdotal experience, Hyundais are excellent rental cars. And pretty popular as used cars here in Europe, too.
> … tiny handful of creepy boyfriends …
Way to downplay the very serious issue of domestic abuse and coercive control.
“However, at Refuge we’re keenly aware that technology is often used by perpetrators of domestic abuse to further isolate, intimidate and stalk their partners from their support networks, making it even more difficult for women to escape their abusers“ [1]
[1] https://www.theguardian.com/society/2021/may/12/tech-playing...
And also to isolate it to men as the perpetrators.
> … tiny handful of creepy boyfriends …
And the person who replied to you was continuing your thought with an additional point, not calling you out.
If so, I misunderstood, apologies @robertlagrant
I've seen that internal data before. It's profoundly creepy and not something I'm okay with the manufacturer having on my family, but I can't meaningfully opt us out of.
Both the tracking described in the article and the usb vulnerability are symptoms of an industry that has irresponsibly deployed potentially dangerous technology.
Categorically false. https://www.rubyhome.com/blog/property-crime-stats/
"Official" FBI stats only go through 2019 but the rates match so I have no reason to believe that the graph showing a marked and steady decline in property crime rates decreasing is incorrect. Property crime rates have decreased every single year for two decades and look to be approximately half what they were 20 years ago.
Every single year people regurgitate this "crime is so bad right now!!1" meme that never seems to die and is always wrong. Crime is decreasing, it has been decreasing in almost every geographic area in almost every category. If you're younger than Gen X this has been happening for most of your entire life. We live in one of the safest times in human history, most of us reading this live in one of the safest countries in the world, and Kias being easy to steal or some idiotic DAs refusing to prosecute petty thefts out of some misplaced sense of social justice does not change reality.
We also have surveys of the public asking if they have been a victim of crime, for example the National Crime Victimization Survey.
According to the FBI statistics, crime is down recently, according to the victimization survey, crime is up recently (both say that crime is down since the 1990's). According to the victimization survey, the majority of crimes are not reported to law enforcement.
From the 2022 victimization survey summary, https://bjs.ojp.gov/library/publications/criminal-victimizat...:
"The violent victimization rate increased from 16.5 victimizations per 1,000 persons in 2021 to 23.5 per 1,000 in 2022.
From 1993 to 2022, the overall rate of violent victimization declined from 79.8 to 23.5 victimizations per 1,000 persons age 12 or older.
In 2022, about 2 in 5 (42%) violent victimizations were reported to police.
Motor vehicle theft victimization increased from a rate of 4.3 victimizations per 1,000 households in 2021 to 5.5 per 1,000 in 2022."
So whether you believe crime is up or down is going to depend on what data you choose to believe. In the victimization survey data, crime is slightly down recently in rural areas, about the same in suburban areas, and up by a large amount in urban areas.
According to my security cameras, crime in my neighborhood is down this year, but still at a much higher level than 2019.
But let's look at property crime at https://ncvs.bjs.ojp.gov/quick-graphics#quickgraphicstop: Down almost every year, and with the exception of 2010-2012 every year it increased it decreased the following year. The trend is clearly down every year with the occasional increase for one year.
Similar to the violent crime statistics, it was flat in rural and suburban areas, up in urban areas.
The effective result of that is skyrocketing crime without skyrocketing crime reports. What use is a crime report if the police won’t do anything about it?
It's against the law to put false information on a police report. At least if you're just a scrunchie citizen.
with many of that group living in some of the most high crime cities in the country - SF, Seattle, Portland, Austin, Denver, NYC, Chicago, Boston, LA, etc.
If you want to list actual high crime places in the US, it's:
Baltimore, St Louis, New Orleans, Detroit, and Cleveland.
Besides Chicago, none of the others you listed are even top 20.
Looking at the states, MD, MO, LA, MI, OH v.s. CA, WA, OR, TX, CO, NY, MA
I was thinking maybe guns but then why would TX and CO (relatively relaxed on guns) be in the lower category?
Then I wondered if maybe it's relating to the housing-challenged (more property crime maybe?), but I can't imagine that climates like those of Detroit and Chicago, with subzero temps and tons of snow in the winter, are very unhospitable to the unsheltered, probably even fatal to those who can't access shelter.
Anyone else have any ideas? I'm stumped here. I know crime is a complex social issue but it seems like there's some weird variable I must be missing.
Or probably like a hundred other variables.
> I was thinking maybe guns but then why would TX and CO (relatively relaxed on guns) be in the lower category?
There's basically zero correlation between US state gun laws and homicide (or US state gun ownership rate and homicide). I mean like the correlation there is 0.05 or something, quite literally zero. Some of the most lax states (Idaho, New Hampshire) have some of the lowest homicide rates (on par with Europe). Some of the other most lax states (Louisiana, for example) have some of the highest homicide rates. And v. versa for strong gun laws (as far as US can get lol).
Poverty correlates better. Income inequality correlates better. But neither sufficient to explain everything.
But the sum of reported crimes is almost certainly considerably smaller than the sum of all crimes actually occurring.
After all, how many people in SF or Seattle do you think even bother filling out a police report after their car is broken into for the 18th time, when doing so the first 3 times did absolutely nothing?
If I understand that correctly it is not a huge problem to focus on? But we should keep an eye on the trend continuing.
I wonder what the ROI on additional criminal justice costs or additional antitheft costs is? They would have to be pretty cheap to make it worth it.
Check out the theft rates on Dodge Chargers and Dodge Challengers in the Hellcat trim level.
If you're friend has had their car stolen so many times, what are they doing about it?