It’s not just Tesla. Vehicles amass huge troves of possibly sensitive data.
Video footage and other data collected by Tesla helped law enforcement quickly piece together how a Cybertruck came to explode outside the Trump International Hotel in Las Vegas on New Year’s Day.
The trove of digital evidence also served as a high-profile demonstration of how much data modern cars collect about their drivers and those around them.
Data privacy experts say the investigation - which has determined that the driver, active-duty U.S. Army soldier Matthew Livelsberger, died by suicide before the blast - highlights how car companies vacuum up reams of data that can clear up mysteries but also be stolen or given to third parties without drivers’ knowledge. There are few regulations controlling how and when law enforcement authorities can access data in cars, and drivers are often unaware of the vast digital trail they leave behind.
“These are panopticons on wheels,” said Albert Fox Cahn, who founded the Surveillance Technology Oversight Project, an advocacy group that argues the volume and precision of data collected can pose civil liberties concerns for people in sensitive situations, like attending protests or going to abortion clinics.
Federal and state officials have begun to scrutinize companies’ use of car data as evidence has emerged of its misuse. There have been reports that abusive spouses tracked partners’ locations, and that insurers raised rates based on driving behavior data shared by car companies. There have also been cases in which local police departments sought video from Tesla cars that may have recorded a crime, or obtained warrants to tow vehicles to secure such footage.
“There’s something deeply ironic that this emblem of personal autonomy, the idea of a car on the open road, might be one of the most heavily surveilled places in many of our lives,” Cahn said.
More than 75 percent of car brands said they can share or sell drivers’ data, according to a 2023 Mozilla Foundation report assessing 25 international brands’ data privacy policies. More than half said they can share information at the request of law enforcement or the government. Only two, Renault and Dacia - neither of which is marketed in the United States - said drivers have the right to have personal data deleted, the report said.
Industry groups say data collection protects drivers and allows automakers to identify potential defects. Sensitive information can’t be used for marketing or shared without consent, the Alliance for Automotive Innovation said in a 2023 memo.
“Yes, your vehicle is generating and transmitting certain safety data. That’s by design,” the memo said. “No, your car isn’t spying on you.”
Many cars have access to location data and camera footage if they’re equipped with features such as parking assistance and navigational systems. But Tesla likely has access to far more data thanks to its suite of cameras used in its driver assistance features, its onboard computers and its nationwide charging network.
Tesla chief executive Elon Musk directly assisted investigators in the New Year’s Day Cybertruck explosion and provided charging-station footage tracking the suspect as he drove from Colorado to Las Vegas, Las Vegas Sheriff Kevin McMahill said. Musk offered investigators “quite a bit of additional information” on the truck and sent a team to Las Vegas to help investigators extract data and video from the charred remains of the truck.
McMahill also said investigators were looking for vehicles that may have been at the charging stations at the same time as the suspect, “because their vehicles would have also had cameras that would have taped anybody in and around them.”
On Thursday, the team of investigators in Las Vegas - which includes the local sheriff and FBI - showed video footage of the suspect, recorded from multiple different angles, at a Tesla charging station in Arizona.
Las Vegas Assistant Sheriff Dori Koren did not specify how that exact footage was obtained, but said the Tesla team sent by Musk helped investigators recover a thumb drive that “records other types of data that includes video by the Tesla.” The team also helped investigators retrieve data from the vehicle that determined it was not in self-driving mode at any point during Livelsberger’s journey to Las Vegas.
While Musk’s swift assistance was applauded by authorities, his highly publicized actions also raised complicated emotions for people like Justin Demaree, a Cybertruck owner and Tesla enthusiast, who runs a popular YouTube channel called Bearded Tesla Guy.
Demaree said while he appreciates Musk’s willingness to help investigators - especially in a case the FBI was initially probing as a potential act of terrorism - the incident showcased just how much personal information Tesla has at its fingertips about its drivers.
“It’s a double-edged sword,” said Demaree, 36, as he drove his Cybertruck in “Full Self-Driving” mode from Orlando to Las Vegas to attend CES, the prominent annual tech conference. “We want our privacy and we don’t want our data shared … but you want to help in a situation where terrorism could be a factor.”
Tesla owner Adam Gershowitz, a law professor at William and Mary who has studied police searches of digital data, said he is willing to sacrifice a level of privacy for the convenience of the car’s navigational systems, infotainment centers and backup cameras at their disposal.
“The thing that makes it so dangerous from a privacy perspective is the same thing that makes it a terrific automobile,” he said.
Still, Gershowitz said, it makes him uneasy to consider how quick Musk was to share the information that immediately dispelled speculation that the explosion was caused by an issue with the vehicle itself. As investigators pieced together the case on New Year’s Day, Musk has posted developments on social media - in one case appearing to beat law enforcement to confirm the explosion was caused by fireworks and a bomb. He cited the vehicle’s telemetry, the technology that automatically gathers and relays data.
Carter Gibson, a 34-year-old tech worker in San Francisco who owns a Rivian - an electric vehicle also chock full of sophisticated technology and cameras - said he doesn’t mind if the data is used to enhance public safety or track those who have caused harm and done something illegal. While the amount of available information opens up new problems around profiling and data sharing, he said, he believes it could be a net positive for society - if done correctly.
Gibson, a Rivian enthusiast who runs a subreddit of more than 100,000 users about the car, said Musk’s willingness to share information so openly was “creepy” and has shaken his trust in how Tesla deals with customer data.
“I, like most people, am not reading the privacy policy in detail, everyone just hits ‘agree,’” he said. “But this is where brand perception really starts to play a role in how safe people feel with the car.”
Tesla did not respond to a request for comment.
The cameras on Teslas and autonomous vehicles can record what is happening around them - a level of “passive surveillance” that is invaluable to police, said Matthew Wansley, a professor at Cardozo School of Law who focuses on the intersection of technology and law.
If law enforcement needs information about what happened outside a club, for example, they might say, “Let’s just call Waymo,” he said, to see whether one of the robotaxis now rolling in San Francisco and other cities was driving by.
Waymo and the Autonomous Vehicle Industry Association did not respond to requests for comment.
Beyond such passive collection of data, drivers unwittingly give away information about themselves when they rent a car, data privacy advocates say.
Rental companies typically opt in to tracking services and other functions that vehicle owners could turn off, said Eva Galperin, cybersecurity director at the Electronic Frontier Foundation.
If the car title is in its name, the rental company has control over location history, biometrics and any other personal information a renter leaves behind, said Andrea Amico, who founded a company called Privacy4Cars that works to protect consumers from vehicle data collection.
“You have zero rights,” Amico said.
The Cybertruck in the Las Vegas case was rented through Turo, which operates like an Airbnb for vehicles. The company did not immediately respond to a request for comment, but its terms of service say the rented cars may collect nonpersonal information like acceleration, location and direction. Users authorize the use or disclosure of such data unless prohibited by law, the policy says.
The American Car Rental Association did not respond to a request for comment.
Amico got the idea for Privacy4Cars while running a used car inspection company. One day, he saw the navigation system in one of the cars still had directions to the previous owner’s home.
“I can see the name of the person because they synced their phone … I know where she’s taking her two daughters to school. I know which cancer hospital she’s going to,” he said. “That’s when I went, ‘Oh, s--t.’”
Related Content
Australia, wary of China, prepares workforce to build nuclear subs
In India’s shadow war with Pakistan, a campaign of covert killings
