OPSEC52 / Week 25 — Vehicle telemetry: your car is a rolling tracker that phones home

You hardened the phone and the house, then drove off in a networked computer that logs every trip and uploads it over a modem you can’t turn off. The car records where you go, how you drive, and who you call. It is the surveillance device you paid the most for and can opt out of the least.

Threat model: the connected-car data chain — a telematics modem streaming location and driving behaviour to the automaker’s cloud; an infotainment unit that ingests a paired phone’s contacts, call logs, texts and location; in-cabin cameras and mics on newer models; and the external ALPR networks that log the plate itself. All of it is held by manufacturers, brokers and insurers who answer to courts and buyers, not to you.

The practice

Smart-home surveillance (Week 24) was the sensor you mounted on your wall. The car is the one that follows you down the road. A modern vehicle is not a machine with a radio; it is a networked computer with wheels, and it reports home continuously over a cellular modem built into the chassis — no Wi-Fi to disable, no app to uninstall.

Three channels matter. The telematics modem. The car’s own SIM streams a precise location history, trip logs, speed, hard-braking and acceleration events to the automaker. That record is sold to data brokers and insurers, handed to police by subpoena, and in several documented cases shared without a warrant. “Connected services” you never switched on are frequently on by default, and the account that holds the data outlives your ownership of the car.

The infotainment head unit. The moment you pair a phone over USB or Bluetooth, the car can pull your contacts, call and text logs, and location — and many head units cache that copy on the vehicle’s own storage, where it survives until a factory reset. A rental or a sold car then carries the last driver’s address book. The screen is a second surveillance surface: newer cars add in-cabin cameras and microphones marketed as “driver attention” or “assistant” features.

The plate, from outside. Automatic licence-plate readers (ALPR) — on police cars, toll gantries, parking lots and private networks — log where and when your specific plate passes, building a movement history you never opted into. This one you cannot shut off from the driver’s seat; the defence is awareness and knowing which journeys are recorded.

The quiet aggregation is the same as the smart home: presence, routine, association, and now movement — assembled by parties who are easy to serve and eager to sell.

How to apply it today

• Don’t pair your primary phone. If you must, turn off contacts/message sync in the car’s Bluetooth settings, and delete stored phone data from the infotainment unit — especially before returning a rental or selling the car.
• Opt out of connected services and data-sharing. In the automaker’s app and the car’s privacy menu, disable location sharing, “data collection,” and telematics where the option exists. Decline the insurer’s tracking dongle or usage-based app.
• Treat “off in the app” with suspicion. The app toggle rarely silences the modem. For a strong threat model, that means an older, less-connected vehicle — or a workshop that can disable the telematics unit.
• Wipe before you hand it over. Factory-reset the infotainment before selling, and remove the car from your automaker account; otherwise the next owner inherits your trips and your address book.
• Vary routes and know the ALPR map. You can’t beat plate readers, but you can avoid making a sensitive trip the one obvious line on the map — and not advertise the car tied to your name.
• Rentals are not anonymous. The rental logs your trip under your ID, and the head unit keeps your paired data; use a burner phone, or none, and clear it on return.

Common mistakes

• Thinking a VPN helps. The car’s own modem is the channel; your phone’s VPN does nothing for what the chassis uploads.
• Pairing once and forgetting. A single USB connection can copy your whole contact list onto a car you’ll later sell.
• Assuming “connected services” are off because you never set them up — on most makes they ship on by default.
• Treating a rental or loaner as a clean device. It records you the same way your own car does, and keeps the data after you walk away.

See also

• Week 22 — Foreign SIMs (the modem is a SIM you don’t control)
• Week 23 — Airport OPSEC
• Week 24 — Smart-home surveillance
• Second of the Home & vehicle pillar — upcoming weeks cover smart-doorbell adversaries and data brokers.

Curated by Cyber Satoshi