The Hidden Risks of Connected Cars: Spying, Privacy, and the Geopolitical Battle Over Vehicle Security

Connected cars are transforming the automotive industry, integrating advanced technology like Wi-Fi, Bluetooth, and automated driving systems (ADS) for greater convenience and safety. However, the fundamental truth remains: anything that connects to the internet provides an opportunity for the collection and exploitation of user information by a sophisticated and potentially hostile opponent. In this context, “sophisticated and hostile opponent” often points to China—a country at the center of a complex relationship with the U.S. and other nations.

While China engages in trade deals, like those limiting fentanyl precursors, it also engages in cyber activities such as placing malicious code on U.S. electrical networks and gas pipelines. The U.S. Department of Commerce’s recent “Notice of Proposed Rulemaking” reflects two decades of Chinese cyber espionage, aimed at acquiring technology, influence operations, and pre-positioning software for potential future conflict. The new proposal will target vehicle connection systems and automated driving systems, categories deemed most vulnerable to espionage and disruption. As the world grapples with the risks and benefits of global trade, the threats posed by connected cars, especially those with Chinese components, are undeniable.

Vehicle Connection Systems: A Gateway for Surveillance

Vehicle connection systems encompass built-in Wi-Fi, telecommunication modules, and Bluetooth connectivity. While they make it easier to navigate, stream media, and access vehicle diagnostics, they also open a window for surveillance and data exploitation:

• Data Exposure: Vehicles now collect extensive data, including location history, communication logs, and user habits. If compromised, this data can be exploited for espionage, targeted attacks, or blackmail.
• Third-Party Risks: Many car manufacturers rely on third-party software for communication features, potentially allowing foreign adversaries to exploit vulnerabilities and intercept information.
• Remote Surveillance: A car’s connection system could become a surveillance tool, allowing conversations to be recorded, calls intercepted, and sensitive data exfiltrated. This risk is heightened when the technology comes from countries known for aggressive cyber activities.

Automated Driving Systems: Convenience with a Hidden Cost

Automated driving systems are the next frontier in vehicle technology, relying heavily on data, sensors, and real-time connectivity. But this level of automation introduces new risks:

• Remote Manipulation: There are concerns that adversaries could hijack an automated driving system, causing a car to crash or stall remotely. While operationally complex, it’s a scenario that keeps cybersecurity experts awake at night.
• Data Manipulation: Autonomous systems depend on reliable data. By tampering with traffic information, GPS signals, or sensor data, hackers could deceive ADS, leading to dangerous driving behavior.
• Privacy Breaches: Automated systems are always collecting data—recording surroundings, capturing audio, and tracking user activity. This could be exploited not just by cybercriminals, but by sophisticated adversaries with geopolitical motivations.

Geopolitical Concerns: China’s Role in Connected Car Security

The Department of Commerce’s focus on vehicle connection and automated driving systems stems from a broader concern about the geopolitical landscape. The new regulation targets Chinese-made technology, following revelations about cyber activities tied to China’s strategic goals. These actions are a response to:

• Chinese Espionage: For two decades, Chinese cyber espionage has aimed to acquire valuable technology, expand influence, and prepare for potential conflict scenarios. Connected cars represent just another avenue for intelligence collection.
• Malicious Infrastructure Breaches: The successful infiltration of U.S. critical infrastructure by Chinese actors highlighted the risks of foreign-made technology in sensitive domains. Cars are now seen as another vulnerability, especially with their growing reliance on global supply chains.
• Retaliatory Bans: China’s own history of restricting foreign technology underscores the risks. Chinese regulations require companies to cooperate with state intelligence, leading to distrust among global stakeholders. For instance, China initially banned Tesla’s connected cars from sensitive areas, only to reverse the decision after assurances of compliance.

How Connected Cars Can Be Exploited for Spying

The risk from connected cars isn’t just hypothetical; it’s a real and tangible threat that mirrors earlier espionage tactics:

• Surveillance Potential: Connected cars can be used to monitor conversations, track locations, and gather personal data—an extension of mass surveillance capabilities already seen in other forms of communication.
• Critical Infrastructure Vulnerabilities: With cars increasingly integrating with smart grids and urban infrastructure, the risks of foreign manipulation grow. A vehicle’s charging or navigation system could become an entry point to larger, more critical networks.
• Data Exploitation: Foreign actors could build vast databases of connected car data, identifying targets of interest or simply storing information to analyze later. This follows a familiar pattern seen in previous intelligence-gathering operations, where bulk data is amassed and analyzed for potential value.

A Broader Context: The Internet of Things and the Rise of Cyber Espionage

The connected car is just one piece of a larger puzzle known as the Internet of Things (IoT). From internet-connected thermostats to surveillance cameras, everything linked to the internet can be a target for espionage and disruption:

• Escalating Cyber Threats: Cars, like any IoT device, are susceptible to hacking. Incidents as trivial as internet-connected fish tanks being exploited serve as a reminder that sophisticated adversaries can target any connected device. Cars are simply the next logical step for well-resourced intelligence operations.
• The Need for Stricter Security Measures: Enhanced cybersecurity standards can mitigate some of these risks, but they won’t fully address the problem posed by advanced adversaries. As connected devices proliferate, cybersecurity needs to be prioritized globally to ensure that privacy and safety are maintained.

Balancing Innovation and Security: A Global Dilemma

At the heart of this issue lies a question of trade-offs: Should nations accept the risks of espionage and disruption for economic benefits? While some may be tempted to overlook these threats, the growing use of Chinese technology in connected cars has raised alarm. The U.S. Department of Commerce’s proposal aims to limit exposure, but global interdependence means this is a challenging task.

Conclusion

Connected cars offer unmatched convenience and promise a safer future with advanced automated systems. However, they also introduce significant risks related to cyber threats and espionage, especially from foreign adversaries like China. Balancing security with innovation is a crucial challenge that will shape the future of automotive technology.

To defend against these threats, implementing strong security measures is essential. VDA Labs specializes in automotive security solutions, helping to identify vulnerabilities, protect sensitive data, and ensure your systems remain secure. Contact VDA Labs today to discover how we can safeguard your connected car technology against cyber threats.