Connected Car Technology Can Enable Abusers to Track Their Victims
A growing number of automakers are enabling location tracking in internet-connected cars, a technology that experts say can be misused by abusers to track their victims.
Image: Flickr/Hubert Figuière
Imagine Find my iPhone, but for your car. An app that lets you keep track of your vehicle at all times with your mobile device could thwart thieves and locate your vehicle in a labyrinthine parking garage. Sounds great, right? Now imagine someone is stalking you with it.
Using geolocation and GPS tracking for stalking has been a problem since the technologies were invented; in 2003, Wired reported on men installing GPS trackers on their exes’ cars. But as more cars become internet-connected and semi-autonomous by default, the risk of stalkers or abusive partners leveraging the technology is becoming more acute.
“If you’ve got one person controlling, stalking, harassing, and abusing another person, those same [geolocation] features—that can be fabulous if you’re not being abused—can actually aid the stalker,” Cindy Southworth, executive vice-president of the National Network to End Domestic Violence and the founder of the Safety Net Project, told me in a phone interview.
In July, a Twitter user expressed concern that their Ford vehicle enabled location tracking. “There are good reasons I might not want someone else who drives the car to know my location,” they wrote, explaining that it wasn’t obvious to them that the tracking was enabled. “Dealership laughed at my privacy concerns. This just seems wrong to me.”
FordPass is a mobile app that remotely connects to Ford’s Sync infotainment system. Like Google Maps, Ford’s mapping technology can log recently and frequently visited locations. This feature is marketed as a convenience—but for people who are being stalked or abused, it’s a liability.
“If the victim knows that her location is being logged in her car, because it’s very obvious—it’s something that shows up, you can see it on the screen—then she’s more likely to take [a taxi] if she needs to go meet with an attorney or file a police report,” Southworth said.
“The challenge we run into is when the histories are more subtle,” she continued. “Then it’s harder for the victim to know that her full history is in the [GPS], or in the car log, or the phone log.”
In an email to Motherboard, a Ford spokesperson said that a car owner can erase their location history by doing a “master reset,” which returns the car to its factory settings.
“Once a master reset has been done, that person has the power to grant access to the system to others but nobody else can connect without them knowing about it and giving approval. Others can request access but they have to receive approval before connecting,” the spokesperson wrote. It isn’t possible to manually delete individual locations entered into the app or navigation system, the spokesperson added.
This solution ignores the complexities of domestic violence and stalking. Controlling behavior is a top sign of domestic abuse, and often includes one partner dictating to the other where they can and can’t go and then questioning them about where they’ve been.
“Tracking everywhere you go might work for one family, but it could be quite dangerous for another, and yet clearing the history is also problematic because it raises the question of ‘what are you hiding from me?’” said Southworth.
Domestic violence and stalking are not fringe issues. According to 2017 stats from the Centers for Disease Control, a quarter of American women and one in seven men have been victims of severe intimate-partner violence in their lifetimes. The CDC also reports that 10 percent of women (and two percent of men) have been stalked by a current or former intimate partner.
Globally, the World Health Organization estimates that 30 percent of women have been in a physically or sexually abusive relationship, and that “as many as 38 percent of murders of women are committed by a male intimate partner.” Devices that track our every move have proliferated throughout society, and abusers are exploiting digital tools to monitor their victims’ activities.
This is a reality that automakers and other “smart” technology companies haven’t done much to solve for.
Justin Brookman, the director of consumer privacy and technology policy at Consumers Union, told me in an interview his organization consulted with DC law firms and various associations of automakers a few years ago to negotiate a set of best practices around privacy. Car companies were reluctant to limit their data collection, he said.
“I thought there were some things that were good in there, but they really didn’t address data collection itself,” Brookman said. “They kind of reserved the right to collect data and do whatever they want with it.” This data could, for instance, be used to send drivers geo-targeted ads or guide autonomous cars.
In 2012, General Motors’ OnStar debuted Family Link, a service that allows remote users to track their family members and receive alerts about where the car goes. Today, companies in the vehicles software and hardware space are racing towards expanding location-tracking capabilities.
“Most of the car manufacturers that we are talking to, this has become table stakes. It’s not just a unique selling point anymore… Everybody’s doing it,” said Sumeet Puri, global head of systems engineering at Solace, a software company working on wireless communications in the automotive space as well as other industries.
As Puri explained, geolocation technology is fundamental to the success of autonomous vehicles and smart city infrastructure, and likely isn’t going away anytime soon.
Southworth said transparency is key in these circumstances. Car manufacturers should notify users their location is being logged, and give them the option of turning tracking on or off discreetly. Users should also be able to delete trips one at a time rather than be forced to do a bulk-erase, she said.
- With reporting from Joseph Cox
Get six of our favorite Motherboard stories every day by signing up for our newsletter.