EV Tracking & Privacy

Question

I'm investigating the possible purchase of an EV, some privacy issues come to mind. I'd rather my car not be tracked... ie location, speed, or anything else for that matter. I don't want my car "calling home". I'm more interested in generalities since I've not chosen a model yet, but any tips that might be make/model specific are welcome. So...

Can internal cell, wifi and bluetooth be disabled on these cars? ie remove sim card, wifi nic, etc.

Can you own and operate these cars without a mobile app installed on your phone?

When you connect to a public charger, does it somehow identify your specific vehicle? ie. is there an information-exchange protocol between the charger and the car that identifies the VIN or other specific data, or does the charger simply negotiate the charging rate (volts, amps, etc)?

When you connect to a public charger, can you pay with cash or credit card like you would at a regular gas station, or are you required to use a mobile app of some sort?

My questions are mostly about the privacy implications of owning an EV vs. a ICE vehicle. With ICE, I can drive around and fill up with gas without any company tracking (and maybe selling the related data) my movements.

If this is the wrong SE, please let me know which one might be more appropriate.

Answer 1

There are two sets of EVs out there, one set is made by car companies which are retrofitting EV technology into existing car ranges, these are your incumbent auto makers, i.e. Ford, GM, Toyoto, VW group, etc. Then there are companies that have formed specifically to make EVs and have designed them that way from the ground up, like Tesla and Nio. These two categories have different approaches to systems and security.

With the incumbent auto makers whether you buy an EV or combustion engine model the back-end computing systems are the same, at least from a body management and entertainment system point of view. Most incumbents have a car app that is totally optional to use, in some cases you have to pay extra to use it. Some cars have built-in communications functionality and can 'phone home', in many cases this is so the car company can charge you money to use a service, for instance GM OnStar. Even if you do not subscribe the OnStar module will record vehicle data and may send it in, fortunately on most GM cars you can physically remove the module. Other car makers may have similar systems. Many cars around the world have 'black boxes' aka event data recorders which store, but do not transmit data so it can be read in the event of an accident. So, whether there are tracking features and whether you can disable them is dependent on make and model, whether an EV or not. In some cases when you buy a car you sign a set of terms and conditions which gives the car company the right to use your data, in some cases you have the option to opt out, it's the same whether you buy an EV or an ICE car.

With the newcomers like Tesla connectivity has been baked into the design, and there's no way to turn it off, at least physically as some features require it. When you buy one you sign terms and conditions which allow the company wide use of the data. You still have privacy options with Tesla, and in Europe and the UK they say they follow the GDPR (General Data Protection Regulation), however you have to trust that they have done this in good faith and their interpretation of the regulation is not permissive. I personally am a bit skeptical of this given Tesla's corporate culture. Keep in mind that a smartphone can leak more information than your car possibly can, so if you are a smartphone user I really wouldn't worry about getting a Tesla or any other make of car.

Charging is a complex mix of acronyms and protocols. The most prevalent I know of are OCPP (Open Charge Point Protocol) and ISO 15118, but there are many others, and in all of the ones I've looked at your car sends identifying information, for instance a digital certificate. Most of the times this is for billing purposes: the car is associated with an account. Some chargers don't use this and instead you use a credit card to pay, but I'd still assume your car exchanges details which identify it, but then again if you're using a credit card your details are known anyway, and I don't know of any charge stations that accept cash. If you don't want an electric car tracked then you'd be stuck with dumb chargers or wall plugs which are extremely slow.

So, the bottom line is if you want to be off the grid an EV is not your best choice, you're better off with an older internal combustion car.

Answer 2

Can you own and operate these cars without a mobile app installed on your phone?

Yes, depending on the car. However you may lose some features such as remote start.

My questions are mostly about the privacy implications of owning an EV vs. a ICE vehicle. With ICE, I can drive around and fill up with gas without any company tracking (and maybe selling the related data) my movements.

Well first, the metaphor is completely broken. With a gas car, you MUST take the car to specialist suppliers such as Shell, BP, Mobil etc. and they all have CCTV cameras all over the place. They will not only get photos of your plates, they'll get photos of you. It is virtually impossible to buy fuel anonymously against a constabulary interested in finding you.

Whereas, with an electric vehicle, you can charge darn near anywhere using the level 1 or level 2 charging completely anonymously with no data interchange whatsoever.

Level 1 and 2 AC charging

Don't take my word on it, study the gory details of the J1772 charging protocol for yourself. It's super simple. No secrets are being leaked lol.

Except "I am plugged in", "Please give me power", and (rarely) "I need ventilation".

A common 120V socket can provide Level 1 charging, which charges at a 1440 watt rate, restoring in a 10-hour time, 30-ish miles of range.

Level 2 charging requires a larger 240V circuit, either dedicated just for the EV, or an existing circuit intended for a large Recreational Vehicle (RV), dryer, and the like.

• Any random 240V/30A dryer circuit will charge at 5760W and restore 180 miles of range in a 10 hour charge, give or take.
• The travel units given away with most EVs will assume an RV circuit is a 40A circuit and limit charge rate to 7500 watts. Still, that's 225 miles in a 10 hour charging period (give or take).
• Choosing an EVSE specifically designed for a 50A circuit will go a bit faster, at 9600 watts, or 300 miles in a 10 hour period. That's a full charge on a large 100 KWH battery pack!

With even ordinary level 2 charging, you're all but certain to be fully charged by departure time.

You can find large RV circuits, as you might imagine, at RV campgrounds. They vary by how much anonymity they will afford you, but there will be no computers to hack, just plain old humans. You would need to find a way to kill time at a campground, but that's not terribly difficult if you put thought into it.

Or you can bring along a stack of solar panels and lay them out like Mark Watney on The Martian LOL. That would be pretty cool :)

DC fast charging

If you are on the road and want the "10 minute charge" experience, then you MUST compromise away your privacy.

First, you'll need to "live the app life". The app is required for many business reasons. So you will need at least a burner phone and a prepaid credit card bought for cash.

Further, the car is interchanging meaningful data with the DC fast charger. The reason for this is billing: For instance if you buy a new car, you might get 3 years of free charging. The charger needs to handshake the vehicle's VIN (or its MAC address) to make sure you are charging the car that is entitled to the free charging, and not pouring the free charging into a different car. So billing really enters into DC fast charging, and that means exactly the kind of tracking you do not want.

The protocols in question are IEC 61851 for synchronizing the DC power supply with the battery, and ISO 15118 for the identification and billing.

Build your own EV

Another option is simply build your own EV. People have been doing that for going on 50 years now - in 1992 Noel Perrin wrote a book called "Solo" about life with an electric car. The homebrew EV movement is going strong, AC drive is now common (which means regenerative braking and no need to think about transmission gears), and the batteries are so much better.

Obviously if you build an EV yourself, you can exclude any trackers or other intrusive tech.

Answer 3

I own a Tesla Model 3. I too am concerned about privacy. As such I have never used the Tesla app (and don't even have a device that could run it anyway) and I removed the cellular modem from the car. (This was a difficult job and I would be happy to answer a question about how to do it if asked separately.) I'm confident that the car is unable to remotely transmit or receive any data with Tesla. It's been that way for about a year and I can tell you my experience.

First off the car generally works fine. It drives and all the basic features operate as expected. It can even give turn-by-turn directions and uses GPS to know its location.

However, some small things don't work as expected:

• The car won't accept voice commands. Instead the screen shows an error message about connectivity. This behavior tells you that on a connected Tesla, voice commands get sent to the mothership.
• The clock drifts at a rate of about 3 minutes per year. That means the clock is set over cellular, not GPS. There's no way to manually set the clock on a Tesla so you just have to live with it.
• There are no updates. Whether that's good or bad is subjective.
• The car cannot get out of service mode, which limits its speed to something like 7 MPH, without a connection. Once I took the car for a repair and the technician enabled service mode and he had to connect it to Wifi to disable it. So if you don't want your car connected to Wifi for even a moment, you need to instruct the shop not to enable service mode.

Note, the car probably still collects data and it can probably be extracted locally. To prevent that, you could use a hack to gain root and manually clean the filesystem. I have no knowledge on how to do that or whether shops would actually exfiltrate data locally.