Auto Immunity

Story by Kelen Tuttle

Photo by Leah Eisenstadt

How new technology is turning your car into a spy machine.

The Office of Homeland Security envisions the day when facial recognition technology identifies an individual in a crowded airport, wireless mobile technology snaps three dimensional photos of everyone who enters or exits the country and sensor networks track suspected criminals through cities.  In the name of security, the government is currently funding security technology at a rate unseen since the Manhattan Project, and privacy-rights advocates are rightfully worried about the potential for serious abuse.

What most people fail to realize, however, is that much of this new tracking technology already has arrived.  But it's not in our airports or along our borders.  Instead, it's closer to home, hidden in our own cars.  Unbeknownst to most Americans, an estimated 35 million cars in the U.S. contain electronic devices that can monitor everything from driving habits to private conversations.

Nestled under the dashboard of 30 million American cars, hidden from view near the airbag deployment system, sits an event data recorder. During the first five seconds of a car crash, this "black box" device springs into action, recording how fast the car was traveling, whether the driver had his foot on the gas or the brake, and how well safety devices performed.  General Motors installed the first of these data recorders in the early 1990s.  After retrieving recorder data from repair shops around the nation, the car manufacturer then used the data to check that airbags and antilock brakes functioned properly during accidents.  Over the years, other companies picked up on this idea: today, Saturn and GM install event data recorders in all their new vehicles, and Ford installs them in 80 percent of its inventory, including the Expedition, Taurus and Mustang.  As a result, our cars are safer.

Yet what started as accident surveillance has now escalated to tracking technology.  To better predict its customers' accident risk, Progressive Auto Insurance of Ohio began asking drivers to voluntarily install a different type of data recorder in 1998.  Unlike manufacturers' event data recorders, which only record five seconds of data, this matchbox-sized blue plastic box collects information from the moment the driver turns the key.  It not only remembers how much, how fast, and when the car is driven, but also contains a GPS device that records everywhere the car travels.

This device was quite popular in a pilot program.  Between 1998 and 2001, five thousand drivers signed up for Progressive's program in Texas.  They voluntarily plugged the company's data recorder into a port located on the steering column of all cars, where it connected to the car's computer.  Drivers removed the device twice a year, plugged it into their personal computer's USB port using an adapter, and uploaded a report detailing their driving for the past six months. All drivers received a rate reducation for e-mailing Progressive this information: the most cautious drivers—those who drove only occasionally, during daylight hours, and never above 70 mph—received a 25 percent discount on their quarterly auto insurance.  Less fastidious drivers—those who drove often, fast, and hard—saved between five and 15 percent.

This program may herald a new trend in auto insurance.  By keeping a record of where the drivers traveled, as opposed to where they live, Progressive hopes to better gauge risk.  Although the Texas program ended because at the time GPS was too expensive to install in thousands of cars, Progressive spokeswoman Leslie Kolleda says the technology will soon become cheap enough for her company to reinstate the program across the nation.  Unless consumers complain, this practice is likely to spread throughout the industry, said Eric Skrum of the National Motorists' Association.

Yet in the process of better predicting drivers' safety, the technology will create a detailed record of drivers' movements that would never otherwise exist.  With this record in place, there would be no legal constraints on Progressive's ability to share this information with others, according to Patrick Mueller, a law student at the University of Wisconsin-Madison who's spent the past two years studying the legal aspects of event data recorders.  By offering Progressive access to personal data, drivers give up any future rights to keep this information private.  According to Mueller, if Progressive ever decides it needs to increase its profits even further, the company can legally sell its record of a driver's movements to the highest bidder, whether a divorced spouse or another insurance company.

Tracking a driver's location at all times is scary enough, but a recent court case reveals that there's even more to worry about. According to California court documents, the FBI recorded the conversations of a suspected Las Vegas mobster for several months in 2001 by surreptitiously turning his car's OnStar-like communications device to "listen" mode.  This device, which allows drivers to contact emergency personnel in the case of a crisis, contains a GPS locator system, a microphone and a speaker.  Under the authority of the Homeland Security Act, the federal agents ordered the unnamed communications company to turn the device into a bug by remotely switching on the microphone and rerouting the signal to an FBI listening post.  This, combined with the system's GPS device, allowed the FBI to hear everything said in the car and track the suspect's movements at all times, all without his knowledge.

California's Ninth Circuit Court of Appeals determined this tactic to be illegal—but not because the judges worried about privacy violations.  Instead, they determined that rerouting the signal interfered with the ability to get emergency assistance.  Because the distress signal would reach the FBI listening post and not emergency dispatchers, rerouting the signal short-circuited a safety system the drivers counted on.

Yet even this verdict is unlikely to forstall privacy violations using OnStar-like communications devices.  The FBI could easily work around this constraint if they haven't done so already by splitting the signal, says Chris Hoofnagle, a lawyer at the Electronic Privacy Information Center.  In this manner, FBI investigators could eavesdrop on the conversation and the emergency dispatchers could simultaneously receive a call for help.  This type of wiretap, which does not require a court order under the homeland security act, is possible on any vehicle equipped with an OnStar-like device: an estimated three million cars around the country.  Without another court case, there's no way to know just how many of these cars the FBI currently tracks.

According to the National Motorists' Association, very few drivers know about this type of privacy infringement and, as a result, leave themselves vulnerable. Last year, an estimated one million new car owners subscribed to OnStar, presumably without knowing just how much anonymity they were giving up.  What began as a valuable resource for drivers' safety has turned into a whole new technology that doesn't help drivers and even poses a threat to their privacy.  As invisible surveillance technology expands into our everyday lives, it's time to take notice and enact laws that curb motor vehicle privacy violation before it speeds out of control.