Australia’s domestic intelligence agency has cautioned politicians and government employees against discussing classified or sensitive matters inside vehicles, particularly those equipped with internet connectivity, due to the potential risk of surveillance and data collection.

The warning was delivered during a Senate estimates hearing on Thursday evening, where senior officials from the Australian Security Intelligence Organisation (ASIO) were questioned about the security implications of modern connected vehicles.

As more Australians purchase cars that can connect to the internet, concerns are growing about how information generated inside those vehicles could be accessed, stored or transmitted. According to figures from Austroads, connected vehicles are expected to account for 93 per cent of all new vehicle sales by 2031. More than 1.2 million such vehicles were already operating on Australian roads by 2021.

Connected vehicles typically use built-in SIM cards or pair with smartphones to access online services and communicate with external networks. These systems support a range of functions, including remote vehicle management, software updates delivered over the air, navigation services and advanced infotainment features.

Some of these vehicles are available to federal parliamentarians through government-funded vehicle allowance programs, raising questions about whether they could present a security risk when used by elected representatives.

1

When asked whether MPs should avoid vehicles manufactured in China, ASIO Deputy Director-General Lisa Alonso Love said the broader concern was not limited to any particular brand or country of origin.

She told the hearing that sensitive discussions should only occur in secure environments specifically designed for handling classified information.

“Whether a vehicle is connected to the internet or not, our advice is that parliamentarians and public servants should not discuss classified or sensitive information inside vehicles,” she said.

Ms Alonso Love noted that internet-connected vehicles may provide additional avenues through which information could potentially be collected or accessed. For that reason, she stressed the importance of restricting high-security conversations to approved secure locations.

She also urged officials to remain aware of the information they discuss while travelling, warning that conversations held inside vehicles may not always remain private.

The Australian Signals Directorate (ASD) has previously highlighted cybersecurity risks associated with connected vehicles, noting that the level of risk varies depending on the technology installed and the degree of connectivity.

Modern telematics systems can gather significant amounts of data, which is often transmitted to vehicle manufacturers or external service providers. Information collected may include location data, driving habits, audio recordings, images captured inside or outside the vehicle, and details obtained from connected smartphones.

Depending on the system, vehicles may also store access to call records, text messages, contact lists and calendar information.

The ASD has warned that some of this data may be stored overseas, where Australian privacy and data protection laws may not apply, potentially creating additional security and privacy concerns for users.