Researchers find mountains of sensitive data on totalled Teslas in junkyards

Teslas are incredibly data-hungry, storing massive troves of data about their owners, including videos of crashes, location history, contacts and calendar entries from paired phones, photos of the driver and passengers taken with interior cameras, and other data; this data is stored without encryption, and it is not always clear when Teslas are gathering data, and the only way to comprehensively switch off data-gathering also de-activates over-the-air software updates for the cars, which have historically shipped with limited or buggy features that needed the over-the-air updates to fix them.

Tesla has a history of being secretive about the data its cars collect, fighting customer attempts to recover data from their cars, and selling a special cable needed to access limited car telemetry for $995. Tesla employees told CNBC that the company uses telemetry to secretly identify Tesla owners who tinker with or investigate their cars, and flags them for late software updates.

Two pseudonymous security researchers called GreenTheOnly and Theo recovered 'hundreds' of wrecked Teslas from scrappers and junkyards and systematically investigated the data left behind on the cars. Much of the data that these junked Teslas store is not unique -- other manufacturers' 'smart' car systems store mountains of driver data in the clear (this is especially a problem for rental and fleet cars, which harvest data from many different drivers). But Tesla does store more data than its rivals, and goes further than other manufacturers in disincentivizing independent security research through its alleged blacklisting system; the fact that Tesla also operates a robust bug bounty system reveals a deep ambivalence about independent scrutiny about its products.

But GreenTheOnly and Theo noted that in Teslas, dashboard cameras and selfie cameras can record while the car is parked, even in your garage, and there is no way for an owner to know when they may be doing so. The cameras enable desirable features like “sentry mode.” They also enable wipers to “see” raindrops and switch on automatically, for example.

GreenTheOnly explained, “Tesla is not super transparent about what and when they are recording, and storing on internal systems. You can opt out of all data collection. But then you lose [over-the-air software updates] and a bunch of other functionality. So, understandably, nobody does that, and I also begrudgingly accepted it.”

Tesla cars keep more data than you think, including this video of a crash that totaled a Model 3 [Kate Fazzini and Lora Kolodny/CNBC]

(Image: Theo)

(via Matt Blaze)