CSI Auto: How cars are the latest police forensics tool

As well as autonomy and electrification, one of the biggest revolutions in vehicle technology occurring right now is connectivity, which among its many applications allows for convenient ways to communicate, navigate and be entertained whilst driving.

All of this convenience requires data that is collected and stored by vehicles and mobile devices, which has useful applications such as being able to direct you to the nearest petrol station, or instantly alert emergency services that you’ve had an accident.

That data is stored in the car's many computers, allowing it to become a major law enforcement tool that, depending on which car you’ve driven, can track all your movements, exact routes, who you’ve spoken to and even when you’ve opened the doors.

Law enforcement agencies, including police forces in Australia, are now using ‘vehicle forensics’ software produced by companies like Berla that creates “solutions for investigators to identify, acquire, and analyse critical information stored within vehicle systems to uncover key evidence that determines what happened, where it occurred, and who was involved”.

As the US company explains on its website, vehicle systems are constantly collecting performance metrics, monitoring sensor data, scanning external environmental conditions, processing telemetry data, and communicating with other vehicles and infrastructure.

All that information is stored by up to 70 computers contained in each car and has the potential to provide critical evidence that can prove valuable when investigating an incident involving the vehicle or any of its drivers.

4

According to Berla, there are three key categories of information a vehicle can contain that can be crucial to a police investigation. These include:

Vehicle events: The car stores event logs allow investigators to know everything about a car from gear shifts, speed logs, odometer readings, when the car was turned on and off, and even when fuel was added.

Location data: This includes navigation information such as track logs, saved locations, active routes and previous destinations.

Connected devices: Smartphones that have been connected via the USB ports, Bluetooth or wireless network can be identified, along with all of the data associated with those devices. We’re talking phone contacts, calls, texts, social media feeds and everywhere you’ve been.

That information will still be there, even if you’ve deleted it all from the device itself.

According to Berla, accessing all this information via a warrant means police can find out what happened and when by providing a sequence of events leading up to an incident.

Investigators can also view older data to establish a lifestyle pattern and any unusual events before the incident, and determine a timeline down to exactly when and where someone got in and out of a car.

4

And more importantly they can establish who was involved by accessing unique identifiers that tie individuals to a specific vehicle; identify known associates and establish communication patterns between them, and determine who may have been present or aware of key information during an incident.

Berla’s software can tap into a broad range of vehicle computers and infotainment systems from most vehicle brands, including Audi, BMW, Ford, Fiat/Chrysler, Holden, Mercedes-Benz, Nissan/Infiniti, Toyota/Lexus and Volkswagen

Some of the individual models that can reveal such information go back several years, but the newer and more advanced the car the more information it can collate, store and reveal.

Using Berla’s vehicle lookup tool finds that a 2018 Holden Astra RS-V hatch can reveal phone data including call logs, texts, metadata, and contacts, location info including routes and stops, and undisclosed vehicle data.

Privacy concerns

So if you’re not intending to use your car for a crime and have nothing to hide, should you be worried that your car is storing so much personal data?

The fact that information is stored and accessible means it could get into the wrong hands, so there is cause for concern. Then there’s the fact Australians don’t have rights that ensure their data is protected.

“Everything about you, can be used against you potentially by somebody,” said Australian Privacy Foundation Chair David Vaile, who added that as cars become more advanced they’ll be able to provide even more information about us.

4

As recent high-profile cyberattacks have shown, personal data security can never be guaranteed. When it is exposed there’s very little that can be done about it as, unlike most Western and Asian countries, Australians don’t have a right to sue if their privacy is breached.

Vaile is also concerned that access to the metadata from your car’s in-built mobile connection or from a previously synced phone isn’t subject to a search warrant.

“There is a whole raft of information that’s in the nature of metadata where they say ‘oh that’s different, we don’t need a warrant for that’.

“It turns out though that if you’ve got a mobile device or a car system like Apple CarPlay or Google Android Auto, and they’re using the 4G or 5G mobile system, they are generating very large amounts of metadata.

“What used to be considered sort of useful if you’re trying to track who someone is calling, but not much use for anything else … is now much, much more detailed and provides much more information about you.”

Vaile added that laws surrounding metadata are so obscure that carmakers and internet service providers may also inadvertently hand over more detailed data they weren’t obliged to provide without a warrant.

Other concerns include the security of your data for a car no longer in your possession, such as the car you’ve sold or hired, and the fact that laws surrounding data collection are subject to change.

Are you concerned about the privacy implications of the data stored in your car, or do you think it’s a necessary evil for authorities to fight crime and terrorism? Tell us in the comments section below.