Data security: Car edition. Really.

When you hear “data security”, what comes to mind? Your laptop? Phone? Internet of Things “smart” oven? (I’d hate to let a hacker know how badly I burnt that casserole)

Anything else? How about your computer on wheels?

Modern cars are rolling supercomputers. They have dozens of systems collecting unique data to make your driving experience safer, more enjoyable, and sometimes more distracting. For example, the traction control computer collects information on road conditions hundreds of times a second. However, it’s probably not a source of identity theft (though what could be learned from its records would surprise you). Nor is the network of proximity sensors to help you navigate tight areas.

Your car does contain a number of personalized systems. Let’s look at the big ones:

GPS: Your car knows where it is at all times, where it has been, the paths you take, and even the speed at which those drives were made.

Bluetooth: When you pair your phone, it does more than share a 4-digit code. To automatically reconnect, the car remembers your phone’s unique ID. This isn’t a huge privacy issue on its own, but today’s cars save far more. To make dialing easier, a lot of systems import your contacts and synchronize your text messages. No big deal, just your entire phone book and call/text history.

HomeLink: Do you have buttons on your mirror or visor? Do they open your gate/garage? Then you have HomeLink. These can even support turning on/off lights, though new smart integrations have made that a bit redundant. Combined with the GPS history, this is the biggest privacy risk in your car. The former tells anyone in the car where your house is located. The latter Opens. Your. Home.

Those are the big three. Others vary by manufacturer and features. Things like a custom entry code (many Ford vehicles still use this feature…do not choose a birthday!) are seen on occasion. App integration is becoming more common, making your phone an advanced car key.

So, what of all these features? I’m a huge fan of integrations which make sense, and I use them often. However, I also know there is a level of security necessary. To add a small degree, I never program my actual home address into the GPS. The “point” is around the entrance to my community, not in my driveway. Do you really need those last 4 turns? Granted, someone could just find my address on the registration, but I’m hoping a potential thief is just too dumb to consider such an option. Why make it easy? Note: My garage opener doesn’t reach from the home “point”.

It’s good to know what these features can reveal while you have the car, but what about when you sell it?

Given the privacy/security risk inherent, I find it almost criminal that an easy “I’m selling my car, delete everything” button is not available in every car. For mine, I’ve had to do the following:

1. Delete my phone pairing from the car.
2. Remove the “Home” location in my GPS.
3. Remove all recent waypoints in the GPS.
4. Reset the HomeLink buttons.
4. Cancel/transfer satellite radio service (technically, with an active Radio ID, one can use a phishing strategy to get my personal information from SiriusXM)

You’re right, there is no direct credit union guidance in this post. However, given my recent experience in buying a new car, I felt it necessary enough to share. Be honest, how many cars do you think are traded-in with the prior owner’s home address and garage code?

Help protect your staff and membership by sharing this with everyone! (And along with every booked loan)