In brief
- Security experts are warning that internet-linked vehicles are posing increasing risks.
- Ninety-five per cent of vehicles in Australia are expected to be internet-linked by 2035.
Security specialists are sounding the alarm over the growing threat posed by internet-connected vehicles to Australian consumers, driven by their expanding data-gathering functions.
Recently, the Australian Security Intelligence Organisation (ASIO) advised government officials to steer clear of conducting sensitive discussions within such vehicles. The warning highlights the increasing vulnerability these high-tech cars present.
“It’s clear that a connected car has various channels through which it can gather information,” stated Lisa Alonso Love, ASIO’s deputy director general, during a Senate Estimates session last week. She emphasized, “Confidential conversations should only take place in environments specifically designed for handling classified information.”
Alonso Love further cautioned, “People need to be aware of what they discuss inside vehicles, as there’s a possibility that this information could be accessed by others.”
In discussions with SBS News, experts have highlighted how the risk of cybercriminals exploiting the smart features of these vehicles is on the rise. They stress that the general public remains largely unaware of the potential dangers that come with their technologically advanced automobiles.
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
“Most people haven’t fully ingested how many data points are being collected in a vehicle,” Montii Abid, a cybersecurity consultant and researcher at the University of Technology Sydney, said.
“The tech has moved away from being something simple to being a computer with a microphone, cameras, personal data, everything.”
A 2021 report by consulting firm McKinsey estimated that half of the vehicles on Australian roads that year were connected to the internet. By 2035, that number is expected to rise to 95 per cent.
The same report found that sensors across the car can generate one to two terabytes of raw data every day.
Legal protections lacking
Australian legal protections are not current enough to deal with the new generation of smart vehicles, Abid said. He has called for a “consent overhaul” in how we approach our transportation, given that internet-linked cars are only expected to expand their data-collection reach.
“If you’re a passenger in one of these cars — for example, you’re in an Uber— you don’t have any protection,” Abid said, noting that cameras and microphones can capture personal data about anyone who enters a vehicle.
“[Car] manufacturing is happening overseas, so the data is stored overseas where Australian privacy laws don’t apply.”
Unlike the European Union’s newer flagship privacy framework, the General Data Protection Regulation (GDPR) of 2018, Australia’s privacy laws are underpinned by the Privacy Act of 1988.
Abid argued that the rules in Australia are “much weaker” as “there’s no opt-out requirement”.
“You’ve got to accept all the data collections to use the vehicle,” he said.
Jarni Blakkarly, a journalist with the consumer rights group CHOICE was part of an investigation in 2024 into how much data vehicles in Australia collect on their drivers.
He told SBS that most Australians are unaware of what kind of data their cars are collecting on them and might not be happy with all of it.
“If it just recognises your voice when it says ‘take me home’ .. that might be one thing,” he said.
“But, if your driver data, for example, with your speeding — potentially, we don’t know that this is happening in Australia, but potentially — could be shared with your insurance provider, which then goes into your insurance pricing.”
Most manufacturers engaging in’ concerning’ practices
The rise of Chinese-made vehicles in Australia has prompted some concern over the threat of state-backed espionage, but Blakkarly says his research revealed that most companies engage in concerning practices.
“Whether those concerns are also shared for Chinese companies or not, our research didn’t look at that, but we found a wide range of companies from a wide range of countries that had concerning practices,” he said.
The CHOICE study found that almost all major vehicle brands in the country collect driver data, with most sharing it with third parties.
KIA, Hyundai, and Tesla all shared their users’ biometric data with third parties, and Tesla even went as far as recording short video and audio clips that were also shared.
“Where’s that data going after these companies get it, and what’s it being utilised for?” Blakkarly asked.
“At the moment, there’s not a lot of protection in this space, and there have been concerns raised by various regulators about them as well.”
Australia’s privacy watchdog, the Office of the Australian Information Commissioner (OAIC), confirmed in February that it was investigating two Asian vehicle manufacturers for potential data-harvesting issues.
Two other probes into the excessive data gathering and improper data handling of two further manufacturers were dropped due to the low likelihood of enforcement action.
If consumers are concerned about the information being gathered on them, Abid said they should go online and investigate exactly what data their vehicle manufacturer collects.
“Within the vehicles themselves, you’ll find that a lot of them have settings and controls that they can opt in and opt out of.”
For the latest from SBS News, download our app and subscribe to our newsletter.
