Kenn Dahl says he has always been a careful driver. The owner of a software company near Seattle, he drives a leased Chevrolet Bolt. He’s never been responsible for an accident.

So Mr. Dahl, 65, was surprised in 2022 when the cost of his car insurance jumped by 21 percent. Quotes from other insurance companies were also high. One insurance agent told him his LexisNexis report was a factor.

LexisNexis is a New York-based global data broker with a “Risk Solutions” division that caters to the auto insurance industry and has traditionally kept tabs on car accidents and tickets. Upon Mr. Dahl’s request, LexisNexis sent him a 258-page “consumer disclosure report,” which it must provide per the Fair Credit Reporting Act.

What it contained stunned him: more than 130 pages detailing each time he or his wife had driven the Bolt over the previous six months. It included the dates of 640 trips, their start and end times, the distance driven and an accounting of any speeding, hard braking or sharp accelerations. The only thing it didn’t have is where they had driven the car.

On a Thursday morning in June for example, the car had been driven 7.33 miles in 18 minutes; there had been two rapid accelerations and two incidents of hard braking.

  • GolfNovemberUniform@lemmy.ml
    link
    fedilink
    arrow-up
    184
    ·
    4 months ago

    I think this should be legally prohibited. Also is it possible to physically disconnected the network modules so they can’t send anything?

    • catloaf@lemm.ee
      link
      fedilink
      English
      arrow-up
      71
      arrow-down
      1
      ·
      4 months ago

      If it doesn’t already, that’s probably going to put you in the high-risk group with other car modders.

      • ColeSloth
        link
        fedilink
        arrow-up
        17
        arrow-down
        1
        ·
        4 months ago

        It will be cat and mouse, but I would imagine for the time being, disconnecting the cell antenna on the board would stop it. Who knows what kind of, if any bullshit extra errors and codes that will keep popped up but I’m guessing if it became a popular thing, they would start making cars that will create bullshit errors and codes. I wouldn’t do anything permanent until the warranty period is over.

      • GolfNovemberUniform@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        4 months ago

        Why not to just break the antenna (or whatever it has) in half? It’s much simpler and shouldn’t cause damage to the chip itself

        • rikonium
          link
          fedilink
          arrow-up
          11
          ·
          4 months ago

          The antennae only likely won’t reduce range enough. Check for an opt-out procedure prior to purchase since that’s easiest, then look for what fuse powers the connection (also easy), but worse case, lay eyes on the module itself and evaluate.

    • Sabata11792@kbin.social
      link
      fedilink
      arrow-up
      14
      ·
      4 months ago

      I can’t wait to see tuturials. I don’t know much about cars and would love to see people disable these, or perhaps do something malicious. Not that I have a new enough car yet, but I know one day it’s going to be unavoidable.

        • driving_crooner@lemmy.eco.br
          link
          fedilink
          arrow-up
          6
          ·
          4 months ago

          If you’re using android auto or something like that this information is going to be transmitted on the same connection used for navigation and internet so you better learn the map of the city again if you want to scape the Spyware.

        • Sabata11792@kbin.social
          link
          fedilink
          arrow-up
          4
          ·
          4 months ago

          I was thinking something like free data plan till they disable the transmitter or at least an unplug. Never bought a new car, do you agree to terms and conditions or sign a contract specifically mentioning/consenting to the tracking?

          • rikonium
            link
            fedilink
            arrow-up
            4
            ·
            4 months ago

            In Toyota’s there’s a red sticker on the dash talking about it and how to opt-out. (or at least I’ve seen it in a rental and a new car - but it might also be yanked by dealer’s PDI)

    • vlad@lemmy.sdf.org
      link
      fedilink
      arrow-up
      8
      arrow-down
      1
      ·
      4 months ago

      I’m sure it’s possible, but I’m sure they’ve made it as painful as it can be.

      • Shurimal@kbin.social
        link
        fedilink
        arrow-up
        26
        arrow-down
        1
        ·
        4 months ago

        Most likely the module, if it is a separate module and not part of the SoC of the infotainment system or whatever, works over CAN bus and the car will throw errors when it doesn’t detect its presence, or doesn’t detect the SIM card. Might even refuse to start if that module is missing. Might be possible to remove the antenna so the car thinks it’s just outside of the service area, but if it’s built into the PCB and the PCB is cast into resin/silicone for waterproofing, even this might be extremely difficult. Probably the module is also serialized* so replacing it with a “dummy” module or a module from a junkyard won’t spoof the system, either.

        *Manufacturers have been serializing even airbags for years, making replacing a faulty one with one from a junkyard impossible.

        • Patches@sh.itjust.works
          link
          fedilink
          arrow-up
          4
          ·
          4 months ago

          You’re approaching it in the wrong way. You don’t need to stop the Data Collection just the phone home. Find the antenna and Faraday Cage it.

          • AngryJadeRabbit@lemmy.world
            link
            fedilink
            arrow-up
            5
            ·
            4 months ago

            Yeah, some aluminum foil on the inside of those shark fin antennas will probably stop all communication. Just have to use your phone for radio & navigation, which isn’t a big deal on CarPlay or whatever the androids use.

        • IllNess@infosec.pub
          link
          fedilink
          English
          arrow-up
          2
          ·
          4 months ago

          Maybe we can trick it forever that it is far away from a cell tower. That way the car has to start without connection.

          Who knows, maybe they force you to use their app and after driving and connecting to the internet, that sends data back to the manufacturer.

      • rikonium
        link
        fedilink
        arrow-up
        6
        ·
        4 months ago

        I’m sure it varies widely. In Toyota’s you can call in to disconnect (I did it while waiting for a tire pressure machine) but to do it physically you pull a single fuse and the trade off is losing the microphone.

        Others have pulled the dash and disconnected antennae but it just reduces the range of the box since it’s a cellular radio like a phone.

          • rikonium
            link
            fedilink
            English
            arrow-up
            4
            ·
            4 months ago

            in this case that’s Toyota specific and it means likely loss of phone calls on the go (but nothing else) even though the data can’t leave your vehicle anymore. It all depends on how they wire up the system. Maybe it’s easier, maybe it’s tied to something random.

        • vlad@lemmy.sdf.org
          link
          fedilink
          arrow-up
          3
          ·
          4 months ago

          Do you have any resources that I can use to learn more about about removing telemetry from a vehicle? Is there a good forum that could help me potentially do this to my car?

          • rikonium
            link
            fedilink
            arrow-up
            6
            ·
            edit-2
            4 months ago

            There’s no easy one-stop solution since it can vary widely.

            I would look at subreddits (yuck, reddit!), or dedicated forums for your model if they exist, you’d probably be surprised what’s out there. (Example, there’s Piloteers (Honda Pilot), Kia-Forums (Kia), 4Runners and Toyota-4Runner, etc. But information may be scattered.

            First objective is figuring out if it’s even on your vehicle or applicable. Older 3G radios are done since the networks that connected to them are gone now. My '16 Kia had no cellular radio. Maybe you have an SOS button or they advertise a phone app to control your vehicle remotely?

            Edit: And if you can’t find specific model/year information for your vehicle, you can look for information for related vehicles and see if it’s relevant. Ex: Honda Passport, Pilot, Ridgeline sharing a lot of engineering.

    • geekworking@lemmy.world
      link
      fedilink
      arrow-up
      2
      arrow-down
      1
      ·
      4 months ago

      Somebody could go to jail for this. You.

      The DMCA makes it a felony to circumvent protections in services. If they wanted to push this and depending on the system disabling or using some hack to bypass could be illegal.

      I don’t think that anyone would actually bring the case against an individual, but a company selling any sort of device or instructions to make it easier for people could be targeted.

      • GolfNovemberUniform@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        4 months ago

        If they make disabling spyware illegal, I’ll do it anyways because human rights. If they decide to charge me for it, I’ll just consider it a violation of my freedoms

  • agitatedpotato@lemmy.world
    link
    fedilink
    arrow-up
    146
    arrow-down
    4
    ·
    4 months ago

    Comprehensive privacy law time? Nahh just ban the Chinese EVs and pretend this doesn’t happen. Same thing as tiktok. You’ll never be protected as long as they can point to the Chinese boogyman.

    • Ephera@lemmy.ml
      link
      fedilink
      arrow-up
      17
      arrow-down
      2
      ·
      4 months ago

      Yeah, I feel like that’s why the EU has such strong privacy regulations. Tech giants in our market are mostly either state-tolerated&-utilized monopolies from the US or state-owned monopolies from China.

    • RaoulDook@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      4 months ago

      There’s also the potential that raising concerns of Chinese spyware raises more concern of the rest of it. They should continue raising those concerns about them all. And ban all the spyware.

  • plz1@lemmy.world
    link
    fedilink
    English
    arrow-up
    134
    arrow-down
    1
    ·
    4 months ago

    “Sharing” is a funny way to word a headline. They are selling it, for a profit, because it’s legal. It’s immoral and shady as hell, but “prevent it or expect it” applies here.

    • delirious_owl@discuss.online
      link
      fedilink
      arrow-up
      19
      arrow-down
      1
      ·
      edit-2
      4 months ago

      Yeah should say “currently legalized sales of personal data” to emphasize that this sort of thing is illegal in many other regions.

  • kbal@fedia.io
    link
    fedilink
    arrow-up
    99
    arrow-down
    2
    ·
    4 months ago

    Last time I drove a rental car I was constantly aware that it was probably tracking everything I did, sending that data back to its owners, who would then sell it on to data brokers and insurance companies and whoever else wanted it.

    It was sort of tolerable on a temporary basis, until I got to driving along a road where the speed limit had recently changed. The car helpfully displayed what it thought the speed limit was, and suddenly I had to choose between driving safely and driving according to what the computers presumably wanted to see.

    Drivers of the world, do not let your cars have Internet access. No good can come of it.

    • Codilingus@sh.itjust.works
      link
      fedilink
      arrow-up
      41
      ·
      4 months ago

      Classic JDM shit boxes till I die. Used to be a joke, but since cars have become what are essentially IoT devices, it’s become real. 🥲

    • sugar_in_your_tea@sh.itjust.works
      link
      fedilink
      arrow-up
      23
      ·
      4 months ago

      Yes, the only access to the Internet a car should have is through my phone in an opt-in basis. That way I can stream music, map directions, etc through my phone that I’ve already made somewhat secure.

    • plz1@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      4 months ago

      That’s not always a choice, without hurdles. I have a truck with it, but I would have no idea how to disable it short of cutting the antenna wire for it.

      • kbal@fedia.io
        link
        fedilink
        arrow-up
        27
        ·
        4 months ago

        It serves as a convenient representative example of the ways in which such systems can go wrong.

        • kbal@fedia.io
          link
          fedilink
          arrow-up
          5
          ·
          edit-2
          4 months ago

          I mean, this is the world of software and computer systems. The map is always outdated, the model is always fictional, and the metric is always measuring the wrong thing. Even aside from the obvious privacy problems this kind of big data approach has its limits which are too easily ignored by insurance companies eager to take the average across thousands of mistakes hoping to get something profitable. As is becoming increasingly more obvious to the general public as computer algorithms designed in secret rule more of our lives, quite often the best that can be managed is a system that works adequately well for the purposes of its designers even while it takes decisions that are utterly stupid at the level of the individual people subjected to it.

      • AHemlocksLie@lemmy.zip
        link
        fedilink
        arrow-up
        21
        arrow-down
        2
        ·
        4 months ago

        That assumes the outdated map software manages to somehow make an accurate report. Most likely, if it makes one, it’ll be “Going X over a Y MPH area” even though Y is wrong, or it’ll be just “speeding by X MPH for Y seconds/minutes”. Either way, nobody is likely to verify and correct the data, so you could be punished for perfectly safe and legal driving.