Privacy and Surveillance Blog

Posted: 11/16/04 2:19 p.m. CST

By Bob Gritzinger AutoWeek

Someday it'll happen, probably when you least expect it.

Systems like OnStar use 4-inch square boxes known as event data recorders or crash data recorders to collect driving information.

Just as you countersteer while drifting out of a tight corner or after you punch the brakes hard, you'll hear the mechanically animated female voice emanating from your car's audio system: "Collision detected. Calling OnStar."

You need not be anywhere close to a collision, really. During one road test this summer, it was just a matter of running a routine slalom in a Chevrolet Malibu Maxx — without so much as hitting a rubber cone — when OnStar called to check.

If you're anything like the test drivers, it won't be until after you've explained to the distant helper that you didn't have an accident, the airbags did not deploy and you don't need assistance, that you'll begin to experience an uneasy feeling in the pit of your stomach.

How'd they know you were driving like that? What else do they know? And who else knows?

Welcome to Paranoiaville — the driving equivalent of George Orwell's "1984," brought to life in the post-9/11 world of Homeland Security.

Your first impulse might be to complain of the intrusion to those behind the bright blue OnStar button, but here's a flash: You should be far more alarmed by what alerted OnStar in the first place — the black box insidiously hard-wired into your car's electronic guts, unstoppable, unalterable, and unbeknownst to most drivers, silently recording every dramatic move.

These 4-inch square boxes (actually silver, not black) — known as event data recorders or crash data recorders — collect an array of information every five seconds. Unlike aircraft recorders pulled from plane crash wreckage, these devices don't record cockpit voices or such a wide range of information over such a long period, but they do constantly record everything from seat belt use and airbag deployment to throttle position and braking action — information retained the moment G-forces, called g's, indicate that a crash is imminent.

The threshold at which the recorder begins saving data or sending a call to OnStar for help varies depending on the vehicle. It typically falls in a range of 1.0 to 2.0 g's. At the low end, the module wakes up and begins retaining recorded information, followed by a second threshold, typically when the airbag deploys, when additional data are saved. Once retained, the data typically are retrievable for as long as 250 ignition cycles, or about 45 days on average.

In short, data from these recorders can paint a fairly descriptive picture of exactly what occurred in a vehicle in the critical moments immediately before, during and after a crash. Used as intended, data help safety engineers make cars safer — and help companies cut their product liability risks — by learning from information collected during collisions.

"You can't shut it off, and you can't manipulate it," says General Motors safety engineering spokesman Jim Schell. Other event data recorders help mechanics get to the bottom of service problems, sometimes without a customer even driving into the service bay. Similarly, OnStar and other helpful on-board services can provide directions and information, track stolen vehicles, send help in emergencies and even save lives.

As with most technology, though, unintended consequences are often the rule, not the exception. If someone's Chevrolet Tahoe records a 1.0-g ramp maneuver and calls OnStar, does that information help clear GM of liability after the SUV unexpectedly rolls over five miles down the road?

Or take the driver who races his Miata one weekend and files a warranty claim the next. What are the chances that his data recorder will rat him out to the manufacturer who then voids the warranty? And who is to say that recording a few seconds of data might not lead to recording a few more seconds, and a few more seconds, until automotive black boxes record and retain information constantly just like the ones on planes?

"It all seems to be going toward the idea of tracking people as much as possible so companies can wring as much money as possible out of people," warns Eric Skrum of the National Motorists Association, a Wisconsin drivers' rights group. "Most people don't even realize it's there, and nothing addresses who owns that information."

OnStar says it, too, is opposed to giving information from its subscribers, but for purposes of record-keeping the company does retain information from collisions and near-collisions for as long as 18 months at a time.

Although it uses global-positioning technology, OnStar won't track down a cheating spouse, but plenty of companies using similar technology will be more than happy to trace a car's movements — for a fee.

And while auto companies and the public remain as divided as the red and blue states of the U.S. electorate on what information should be recorded by event data recorders and who should have access to it, police, government regulators, insurers and the legal community already are lined up and ready to reach into the car's internals and retrieve information.

"The technology is there, and it will do more than we can imagine," Skrum said. "There are no safeguards in place, no protections for the motorist."

Government regulators obviously have a keen interest in the development and proliferation of data recorders. Though the National Highway Traffic Safety Administration says automakers are installing event data recorders on their own fast enough without any regulations in place, the agency has proposed a rule mandating a standard by 2008 for all those voluntarily installed event data recorders. The rule proposes that recorders collect as many as 42 points of common data readily downloadable by anyone with the proper equipment, expertise and authority.

The rule is still under review, with adoption a year or more away. But in all likelihood it will go into effect despite public sentiment that so far is running 10-to-1 opposed, judging by public comment on NHTSA's website.

David Sobel, general counsel for the Electronic Privacy Information Center in Washington, worries about the unintended consequences — and abuses — of data recorder technology. Today the recorders are collecting data for five seconds, but Sobel doesn't doubt that "at some point somebody will suggest recording five minutes or more" that could, for instance, allow police to ticket a speeder without ever witnessing the driver speeding.

"There are many potential uses of this technology that are yet to be conceived of," Sobel says.

Lining up on the other side of the argument are safety advocates, police, crash reconstructionists, insurance companies and black-box manufacturers.

The National Transportation Safety Board called for requiring standardized recorders in all light-duty vehicles after it was unable to ascertain what happened when an elderly driver plowed through a farmer's market in Santa Monica, Calif., last year, killing and injuring scores of people.

Board spokesman Keith Holloway said public concerns about personal privacy shouldn't get in the way of providing a valuable tool for accident investigators.

"We don't want to record someone's whole route," Holloway says. "We're focusing on the last few seconds before an accident. Granted, some people could use that information (in criminal prosecutions or lawsuits), but that is not our concern."

Former NHTSA administrator Ricardo Martinez, who now heads Safety Intelligence Systems, a black-box manufacturer in Atlanta, has urged NHTSA since 2001 to mandate data recorders in cars.

Though most crash reconstructionists argue that recorder data are merely a supplement to a careful on-scene investigation, Martinez argues that crash scene investigations are expensive, time-consuming and often inaccurate. For instance, investigators can no longer rely on skid-mark evidence because cars equipped with antilock brakes, traction control and stability systems often don't leave skid marks on the pavement.

Even Canadians have weighed in, sharing experiences on how recorder data have helped to convict — and to clear — Canadian drivers in crashes. On the one hand, a black box helped convict a Quebec driver in a fatal crash even though he claimed the driver who was killed was at fault.

But in another case, black-box evidence cleared a driver in a fatal chain-reaction crash in Ontario despite witness testimony that the crash was triggered by a reckless driver.

Similar cases have cropped up in the United States as well, including a case in which recorder data helped convict the driver of a Ferrari who crossed the center line at high speed and hit an oncoming car, killing the driver.

In another fatal accident case, though, a Florida driver used recorder data to prove that he wasn't speeding and beat the rap.

If there's a bright spot in the black-box debate, it's that almost everyone agrees that proliferation of the data recorders must come with strong rules governing notification of the technology's presence in the vehicle and what it might record, who owns the data, how the data can be used and who can legally obtain them.

"Those rules are not anywhere close," warns Barry Steinhardt, of the American Civil Liberties Union's Technology and Liberty Program.

"The technology is growing at the speed of light, and the laws are back in the Stone Age. We're not saying 'Smash the black — actually they're silver — boxes.' But we've yet to establish a legal regime that can put some chains on this growing surveillance monster."

For now, simple notification that a recorder is aboard is about all a person can expect, and some companies don't even do that. But what's the likelihood that such notices will be read and understood any more than those long legal disclaimers people skip past when they're installing software on their personal computers? Notification matters in courts and to lawyers. But for Joe Public, it's mostly a lot of empty words.

Even the Insurance Institute for Highway Safety, a private safety research agency that rarely finds fault with greater regulation on America's cars and trucks, has concerns that valuable crash data from the recorders may be lost for research purposes if privacy protections aren't part of the package.

The agency's Adrian Lund also expressed concern that if federal regulations demand that the data recorders monitor too many safety systems, automakers may leave safety technology off their cars to avoid engineering the monitoring of those systems.

So far, California is at the forefront of black-box regulation. In July, the state approved a wide-ranging data recorder law requiring manufacturer notification to buyers and specifying that recorder data are the property of the vehicle owner or lessee and can be downloaded only with the owner's permission or through a court order.

But smart cops are way ahead of the law. Sgt. Tim Brown, a Michigan State Police crash investigator who is a seasoned veteran in this field as a result of downloading some 50 data recorders from crashed cars in the past two years, recommends getting a search warrant to download the data.

Automakers see the writing on the wall and already are incorporating notice of data recorders into owner's manuals. But even if a driver happens to read the disclaimer, there's little he or she can do to prevent the device from recording data short of shorting out the car's airbags and other safety systems.

So much for the enemy you can't see. What about the one you can?

OnStar gets enough emergency calls to keep a library of rescue "true story" commercials on TV and radio, 11,000 blue button pushes a month and another 700 automatic notifications due to airbag deployments.

While we might appreciate a call from an OnStar adviser if we're upside down in a ditch, we might not always want someone looking over our driving shoulder. But forget about the urban legends — what can all this stuff really do?

Eavesdropping, for one. In California, a federal court slapped the hands of investigators who tapped into illicit in-vehicle conversations via the car's built-in communications system (not OnStar), but the ruling did not focus on privacy issues.

Rather, the court held that using the system to eavesdrop on vehicle occupants interfered with the system's contractual obligation to provide emergency services and communications to the vehicle owner.

Though service providers such as OnStar and ATX Group Inc. of Irving, Texas (used in many Mercedes, BMW and Rolls-Royce vehicles), contend that surreptitious eavesdropping isn't possible without setting off a series of warnings, privacy advocates warn that it won't be long before the long arm of the law finds a way around those alerts. Then there's global positioning satellite data to consider.

OnStar says it won't track a customer's vehicle unless the vehicle is reported stolen to police. Then, OnStar deals directly with the police, rather than the subscriber, to locate the vehicle. Furthermore, once a customer declines service and quits paying, the electronics in the vehicle are deactivated, and OnStar cannot initiate a new connection.

OnStar — the industry's largest provider of on-board safety and security systems with 2.7 million subscribers and systems built into most GM models sold in recent years (as well as Audi, Volkswagen, Acura, Subaru, Isuzu and Lexus vehicles) — promises to be a strong gatekeeper when it comes to privacy.

"Privacy is a huge concern to this company," says OnStar spokesman Terry Sullivan. "We're always going to err on the side of the angels, and we're going to protect the privacy of our customers." But that privacy doesn't extend to sharing OnStar data within the giant corporation, where the marketing side may find a driver's OnStar data helpful to the next sales campaign.

Others have similar privacy policies and systems. ATX policy calls for challenging court orders that seek to track vehicles equipped with ATX.

"Law enforcement has learned that a system like ours or OnStar's isn't a good tracking or eavesdropping tool," says Gary Wallace, ATX vice president of corporate relations. "They know they can do it faster and easier themselves."

LoJack Corp. of Westwood, Mass., is a company with operations in 25 countries that tracks stolen vehicles. LoJack has some of the same public relations problems as OnStar: Paranoid people think the company's tracking equipment can keep tabs on a subscriber's whereabouts at all times. That's not true, says Pat Clancy, LoJack vice president of law enforcement.

"The only way a LoJack unit can be activated is through stolen vehicle reports," Clancy says. A customer might try to track a cheating spouse by filing a false stolen car report, but only the police will ultimately know the vehicle's location.

Police also find that activating a LoJack unit to serve as a tracking beacon for surveillance often has the opposite effect. The beacon attracts marked patrol cars with LoJack tracking equipment from every jurisdiction it enters, ending any hope of surveillance.

Rental car companies also have come under fire for using global positioning satellite data to track driving habits, and once again, California is on the forefront of rule making. In August, Gov. Arnold Schwarzenegger signed a law prohibiting rental car companies from using global positioning satellite data to enforce speed and in-state driving restrictions.

Similarly, faced with consumer complaints and a state government order, Acme Rent-A-Car in Connecticut has abandoned a strategy of charging extra fees based on black-box data showing that customers had exceeded the speed limit.

For those looking for other things to worry about, consider this: Oregon is working on a toll-road system that downloads global positioning satellite data and odometer readings at the gasoline pump to collect fuel taxes on each gallon based on the amount a motorist drives. Similar systems are in place for truckers in some European countries, but Oregon's system proposes that all motorists come under the user-pay tracking system. Some 15 other states are looking into the concept.

While the data theoretically would be collected strictly for calculating equitable road taxes, even the task force working on the system recommends that "legal safeguards be built into any GPS-based mileage fee to prevent anyone other than the vehicle owner/operator from knowing the vehicle's movements without the consent of the vehicle owner/operator."

Here's the kicker: Because the travel data would be managed by private vendors, presumably to save money and government red tape, any legal privacy protections governing those data go out the window.

"In a free society with free people, you should only have to give out information to those you want it to go to," says Don Harkins, editor of The Idaho Observer, a newspaper in Spirit Lake, Idaho. "It should not be collected and collated by people you don't know. It's none of their damn business."

So what if you really do want to keep track of an errant teen, a malingering worker or a suspect spouse? Besides private investigators, plenty of tracking-specific companies are ready to jump into the fray.

Reynolds and Reynolds Co.'s Networkcar unit promises to keep track of your teen driver via global positioning technology for $995 for the first year, and GPSi LLC will outfit a car with a system called Guidepoint that allows satellite tracking, early theft warning and roadside service. The Pontiac, Mich., company says it has done business with those who want to keep an eye on Junior or follow a spouse's path to a paramour's place.

"We don't endorse that, but we have some customers who have bought our system for that purpose," says Brian Edwards, the company's vice president of corporate development.

As in the case of black boxes, there is little law governing who owns the information and who can get it.

"We're very aware that's a law waiting to be written," Edwards says.

In an ominous twist, insurer Progressive Casualty Insurance Co. is forging ahead with a plan to give customers a discount on car insurance premiums by taking advantage of the black boxes.

Progressive's TripSense test program in Minnesota, which is likely headed for a nationwide introduction in a year, allows customers to install monitors on their cars that record speed, miles traveled and time of day that the driving occurred. Those who drive less, at lower speeds, and at safer times of day, can save as much as 15 percent on their car insurance premiums.

Some already see uses such as Progressive's as the first step to constant monitoring of the driving public. Jim Haas, Progressive's Minnesota product manager, admits that some insurers may decide to tie insurability and risk to use of the box.

"We can't control what other companies do," he says, "but I don't think we're ever going to get to a point where we're saying we won't insure you unless you have this device."