Jim Mason, a forensic engineer with ARCCA, helped us access and download the contents of our cars infotainment computer.Geoffrey Fowler / Washington Post Behind the wheel, its nothing but you, the open road and your car quietly recording your every move.On a recent drive, a 2017 Chevrolet collected my precise location. It stored my phones ID and the people I called. It judged my acceleration and braking style, beaming back reports to its maker General Motors over an always-on Internet connection.Cars have become the most sophisticated computers many of us own, filled with hundreds of sensors. Even older models know an awful lot about you. Many copy over personal data as soon as you plug in a smartphone.But for the thousands you spend to buy a car, the data it produces doesnt belong to you. My Chevys dashboard didnt say what the car was recording. It wasnt in the owners manual. There was no way to download it.To glimpse my car data, I had to hack my way in.Spilling our Chevy Volt’s secretsJim Mason hacks into cars for a living, but usually just to better understand crashes and thefts. The Caltech-trained engineer works in Oakland, California, for a firm called ARCCA that helps reconstruct accidents. He agreed to help conduct a forensic analysis of my privacy.I chose a Chevrolet as our test subject because its maker GM has had the longest of any automaker to figure out data transparency. It began connecting cars with its OnStar service in 1996, initially to summon emergency assistance. Today, GM has more than 11 million 4G LTE data-equipped vehicles on the road. I found a volunteer, Doug, who let us peer inside his two-year-old Chevy Volt.Modern vehicles dont just have one computer. There are multiple, interconnected brains that can generate up to 25 gigabytes of data per hour from sensors all over the car. Even with Masons gear, we could only access some of these systems.This kind of hacking isnt a security risk for most of us it requires hours of physical access to a vehicle. Mason brought a laptop, special software, a box of circuit boards and dozens of sockets and screwdrivers. Buried behind the touch screen and radio controls sits our Chevrolet’s infotainment computer, a box identifiable here by a circle for its fan. Geoffrey Fowler / Washington Post We focused on the computer with the most accessible data: the infotainment system. You might think of it as the cars touch screen audio controls, yet many systems interact with it, from navigation to a synced-up smartphone. The only problem? This computer is buried beneath the dashboard. After an hour of prying and unscrewing, our Chevys interior looked like it had been lobotomized.(Dont try this at home. Seriously we had to take the car into a repair shop to get the infotainment computer reset.)It was worth the trouble when Mason showed me my data. There on a map was the precise location where Id driven to take apart the Chevy. There were my other destinations, such as the hardware store Id stopped at to buy some tape.Among the trove of data points were unique identifiers for my and Dougs phones, and a detailed log of phone calls from the previous week. There was a long list of contacts, right down to peoples address, emails and even photos.Infotainment systems can collect even more. Mason has hacked into Fords that record locations once every few minutes, even when you dont use the navigation system. Hes seen German cars with 300-gigabyte hard drives five times as much as a basic iPhone 11. The Tesla Model 3 can collect video snippets from the cars many cameras. Coming next: face data, used to personalize the vehicle and track driver attention.A privacy policy only a lawyer’s mother could loveMy volunteer car owner Doug asked GM to see the data it collected and shared. The automaker just pointed us to an obtuse privacy policy. Doug also (twice) sent GM a formal request under a 2003 California data law to ask who the company shared his information with. He got no reply.GM spokesman David Caldwell declined to offer specifics on Dougs Chevy, but said the data GM collects generally falls into three categories: vehicle location, vehicle performance and driver behavior. Much of this data is highly technical, not linkable to individuals and doesnt leave the vehicle itself, he said.The company, he said, collects real-time data to monitor vehicle performance to improve safety and to help design future products and services.But there were clues to what more GM knows on its website and app. It offers a Smart Driver score a measure of good driving based on how hard you brake and turn, and how often you drive late at night. Theyll share that with insurance companies, if you want. With paid OnStar service, I could, on demand, locate the cars exact location.The OnStar privacy policy, possibly only ever read by yours truly, grants the company rights to a broad set of personal and driving data without much detail on when and how often it might collect
Origin: What does your car know about you? We hacked a Chevy to find out