Calls for stronger privacy protections and clearer information about connected vehicle technology have intensified following a reported cybersecurity demonstration involving a BYD Shark 6.
The Australian Automotive Aftermarket Association (AAAA) is calling for connected vehicles to be explicitly addressed in the Federal Government’s privacy reforms, while the Australian Automotive Dealer Association (AADA) is seeking clearer information for dealers and consumers about vehicle connectivity, data collection and cybersecurity.
Shark 6 cybersecurity investigation
The concerns follow an ABC Four Corners investigation in which cybersecurity researcher Dan Hreszczuk, co-founder of Canberra-based Fortify Labs demonstrated remote access to functions on a BYD Shark 6 after gaining physical access to the vehicle.
According to the ABC, Mr Hreszczuk had physical access to the vehicle for around two weeks and identified digital access that was not password protected.
During the demonstration, he was reportedly able to lock the doors, turn the headlights on and off, operate the wipers and washers, play music and images through the infotainment system, and access the vehicle’s microphone. He was also reportedly able to track the vehicle’s location.
The investigation found that more safety-critical functions, including the vehicle’s brakes and cameras, could not be accessed.
BYD Australia Chief Operating Officer Stephen Collins said the company was still determining how the vehicle had been accessed and whether the issue extended beyond the vehicle tested.
“We’re only a few days since it aired. We saw it at the same time everyone else saw it,” Collins said.
“We’re going to look at it holistically, and once we’ve done that, then we’ll come out with statements as to what we’ve found and what our position is.”
Collins said it was too early to determine whether any vulnerability identified could be addressed through a software update.
“Quite possibly, but it’s probably premature to say,” he said.
“Certainly over-the-air updates are an important feature of our vehicles and of our technology.”
Privacy reforms under scrutiny
The AAAA noted that the issue extends beyond Chinese vehicle brands, with the Office of the Australian Information Commissioner confirming in April that it was investigating Toyota and Hyundai over their management of connected vehicle data.
BYD told the ABC that it has not and will not provide Australians’ data to Chinese authorities and that it had responded to preliminary inquiries from the privacy regulator. The ABC also reported that BYD revised its Australian privacy policy before supplying it to Four Corners.
AAAA Chief Executive Stuart Charity said connected vehicles should be explicitly included in Australia’s privacy framework.
“Buying a car should not mean surrendering your privacy,” Charity said.
“The Government is rewriting Australia’s privacy laws now. Connected vehicles must be explicitly addressed in those reforms.”
AAAA seeks stronger data protections
The AAAA submitted its response to the Federal Government’s draft privacy legislation before the Four Corners broadcast.
The association argues that the draft does not provide a general requirement for affirmative consent before vehicle-generated personal information is collected. It also says protections for passengers and secondary drivers and rights to have vehicle data deleted need strengthening.
The AAAA is also calling for manufacturers to remain accountable for software security throughout a vehicle’s working life, including secure software updates and timely vulnerability fixes.
The proposed protections would apply to all connected vehicles regardless of their country of origin or powertrain.
The association is also seeking a secure mechanism allowing vehicle owners to authorise independent repairers or data intermediaries to access diagnostic information needed for a specific repair, with the authorisation able to be withdrawn.
“Consumers should not be told privacy prevents their trusted workshop from accessing information while a manufacturer’s dealer network can use it,” Charity said.
Dealers facing customer questions
The AADA has separately called for greater transparency around connected vehicle technology, citing increasing questions from customers about what modern vehicles can do, what information they collect and which functions can be accessed remotely.
AADA Chief Executive James Voortman said dealers and their employees were increasingly being asked to explain connected vehicle technologies.
“Australian car buyers are asking legitimate questions about connected vehicle technologies and deserve clear answers,” Voortman said.
“Those questions are not limited to privacy and data collection. Customers also want to understand how these technologies operate, what protections are in place and how manufacturers and regulators are managing potential cybersecurity and safety risks.”
The AADA said dealers are the customer-facing part of the supply chain and are regularly asked questions about connected technologies that are now standard features of modern vehicles.
Responsibility for connected technology
The AADA said responsibility for vehicle design, software systems, connected technologies and regulatory compliance rests with manufacturers and relevant government authorities.
It said industry should not be left without the information required to support customers.
“Manufacturers are responsible for the technologies they introduce to the Australian market, while government agencies and regulators play a critical role in ensuring appropriate oversight and public confidence,” Voortman said.
The AADA also argued that manufacturers, rather than dealers, should be liable for the products they supply to the Australian market.
“If Australians are expected to embrace increasingly connected vehicles, there must also be a coordinated effort to ensure clear and accessible information is available to both industry and the public,” Voortman said.
The association is calling for greater collaboration between manufacturers, transport regulators, security agencies, dealers, consumer groups and the wider automotive industry.
“Our objective is simple. We want Australian dealers and their customers to have confidence in the technologies entering our market, supported by factual information, transparency and appropriate safeguards.”
BYD questions circumstances of demonstration
BYD Australia Director of Public Relations Paul Ellis said the company was seeking more information about how the demonstration was conducted, including whether additional hardware was connected to the vehicle.
“You can’t just stand on the side of the road and hack into a BYD that drives past,” Mr Ellis said.
“The software that’s used doesn’t work like that.”
Ellis said BYD had asked the ABC whether a connected device was present during the demonstration.
“We’re asking questions of the ABC. Was there a connected device in the vehicle when the remote tampering was done as well?” he said.
“We need a bit of their cooperation as well, because we have an absolute obligation, as Steve has pointed out. We’ve got to do this absolutely right.”
BYD said it was taking “full and immediate action” to investigate the claims.
“BYD Australia takes vehicle security very seriously for its customers and all road users,” the company said.
“We will respond in detail once we have completed our investigation. The safety of our customers and all road users is our absolute priority.”
Questions over connected vehicle data
BYD said personal data generated by its vehicles in Australia is stored on Australian servers. Collins said personal in-car data is held on Telstra servers and governed by Australian law.
“That data is held locally, and where it’s personal in-car data, it’s held locally. It’s governed by Australian law,” he said.
“There was some discussion, I think, about Chinese law being able to access that data, but it’s overridden by Australian law.
“That data is protected. We’re confident it’s protected, and we can give our customers that confidence.”
Ellis said information handled through Apple CarPlay and Android Auto remains within those respective ecosystems.
“If you have your apps on your phone connected to the car, we can’t do anything. We don’t have any visibility on that,” he said.
“So that information doesn’t sit with BYD.”
BYD also said owners cannot directly install third-party applications on its infotainment hardware as a cybersecurity measure.
BYD supports clearer regulation
BYD has also called for clearer Australian rules covering connected vehicle data and privacy.
“For some time we’ve encouraged the government to consider and particularly make the requirements crystal clear,” Collins said.
“We’re happy to consult as much as we need to with any authorities on this matter, and secondly, whatever that outcome is for the legislators, we’ll comply.”
Did you find this article interesting? Click the ‘heart’ button above to give it a like!
