EV Phone Home; An Investigation Into Connected Cars

Monitoring The Traffic Created By 21 Cars From 19 Brands

Ars Technica posted an overview of the findings from a study undertaken by Northeastern University and Consumer Reports to see who your connected car talks to.  The good news is that the traffic was all encrypted so they couldn’t see exactly what data was being sent but they could certainly determine where the data was going.  As you should expect, your connected car’s Android Automotive OS communicates with Alphabet but you might not be as impressed that some of those Alphabet owned domains are their ad servers at doubleclick.net and googlesyndication.com.  There was also a fair amount of back and forth traffic to mapping companies like HERE, TomTom, and Mapbox.

The tests included putting the 11 EV models into a Faraday cage, as you wouldn’t want to run a gas powered vehicle in an enclosed space. They wanted to see if blocking the cell signal resulted in the connected car switching over to WiFi to try to phone home.  There were more than a few cars which did so, and it is noteworthy that of all the models tested only the Cadillac Lyriq, Chevrolet Blazer, Honda Prologue, and Rivian R1S simply stopped trying to reach a network when they were blocked.

While Telsa was far and above the most talkative, the Model 3 contacted 34 advertising, tracking, and analytic domains, as well as 37 domains from apps integrated into the infotainment system.  The ugliest vehicle on the road apparently contacts over two dozen more third-party domains while driving than when it is parked.

The researchers reached out to the manufacturers and in all but one case the companies stated this monitoring was included in their terms and services, blamed the onboard browser or user error accepting optional cookies they could have denied.  They didn’t mention the loss of functionality which results from blocking the traffic generated by the vehicle.  Honda was the only company that replied with a smidgen of good news, they stopped sharing precise location data with at least one tracking company.