When devices are connected, they can spill your deepest secrets to dozens of companies. Take your connected car, as Ars Technica notes.
“All of the cars contacted a first-party domain (i.e., the OEM)—after all, all the cars tested were connected cars and that means connecting to something. And a few left it there—the Buick Envista and Mercedes-Benz EQS didn’t appear to reach out to anywhere else, for example.”
But some were more promiscuous.
“The [Tesla] Model 3 contacted 34 advertising, tracking, and analytic domains, as well as 37 domains from apps integrated into the infotainment system.”
Your deepest secrets, shared with everyone. Google Gemini.
Over 70 domains makes sense, when you treat a car as a very mobile computer.
Our family is about to buy a laptop, and I’m already dreading the experience. It will be loaded with bloatware from the computer manufacturer and the operating system provider. And it will include software from third parties, including software that is free for a limited time and then starts charging you.
Now take this same business model to a car, a computer that doesn’t have a keyboard or a mouse. And try to delete THOSE apps. Or imagine breach reporting.
And while you can find online courses for a Mac or a Dell, I don’t know of any computer courses in managing (not just using) a car. But if you don’t know how to manage your car, it’s your fault.
“Some of the automakers also deflected blame onto the embedded browser running inside the infotainment system and said it was up to users to select the right prompt when asked to accept or reject a cookie. And seven said that it’s the consumer’s responsibility to read and accept all of the terms and conditions for all the connected services, even though in many cases the software is already installed on the car.”
Which raises a question. If you don’t buy a car off the lot, you can customize the color, trim, and other hardware features. But what about the software? Can you order a car without pre-installed McAfee or Sirius/XM that starts billing you after a month?
Today we will learn about identity and a car battery purchase. From personal experience.
My car wouldn’t start
The last couple of times that I started my car it was difficult to start. This afternoon it wouldn’t start at all. The battery had a sticker that read “09/19”; if that was a month and two-digit year, then it was probably time to replace the battery.
So I called the company that sold the battery to me. I won’t reveal the name of the company, but its initials are AAA. (Or “Triple A” to the kewl kids.) They sent a truck out, and informed me that I did NOT purchase my battery in September 2019. I purchased it in OCTOBER 2019. (Presumably 09/19 was the month the battery was available for service.)
Proving my identity, not the car’s
Before the driver from Golden Bear Towing arrived, I reviewed all the ways I would have to identify myself.
To receive AAA service, I would need to show my AAA membership card. Yes I submitted my service request while logged in to the AAA app, but rules said I needed to show my card.
Of course, mere possession of a card (or an app) proves nothing, so I also needed to show government-issued photo identification, such as a driver’s license.
While not always necessary, in this case I needed to have a vehicle listed on my AAA contract. (If I had a problem with a Hertz rental vehicle I would call Hertz, not AAA.)
Finally, if I ended up purchasing a new battery, I would have to provide a debit or credit card (although they also take cash).
Not my real license plate number. Google Gemini.
The one odd part? While I had to prove everything about myself, I didn’t have to prove anything about the car, such as title. I previously wrote about the importance of title from a non-person identity (NPE) perspective:
“Because of their expense, certain NPEs such as vehicles and real estate are associated with title, or proof of ownership.
“Just because I have physical possession of a car or house doesn’t mean that I’m the lawful owner. Maybe I am house sitting. Or renting a car. Or I am a squatter or thief. When it comes to legal (and financial) title, possession is NOT 9/10ths of the law. Otherwise, Hilton and Hertz would be out of business.”
I was sitting in said car, waiting for the Golden Bear Towing truck. AAA messaged me a handy dandy link to show me where my service person was, but by the time I got around to clicking it, he had already arrived.
Google Gemini.
I got out of the car, but as you and I know that did not prove I had title to the car. But I had the key.
And after the old battery was tested (12%, below recommendations) and replaced with a new one, it came time for my identity proofs.
AAA card? He didn’t need to see it.
Government ID? He didn’t need to see it.
Payment card? THAT he needed to see.
Google Gemini.
But he simply looked at the card, called the card number and the total into his office, and got approval over the phone.
Security lessons learned
If you always go by the book, this would be horrifying. After all, I write about Identity Assurance Level 3 (IAL3) all the time. And I never even had to show a driver’s license at all.
Why not?
Google Gemini.
Although it’s a car, it’s not an expensive car. Even a cursory read of this post reveals that this car is from model year 2018 or earlier.
The purchase was not an expensive purchase.
Although I didn’t undergo all the rigorous proofs of identity, there were enough secondary proofs that suggested that I was who I said I was. AAA dispatched its driver to my residential address, which they knew, to a particular car, which they knew.
Now presumably it is possible that I may have fraudulently induced Golden Bear Towing to replace a battery on a car that wasn’t mine.
Possible, but not probable.
In the real world, you need just enough proof of identity to keep things…running.
“The FTC’s Safeguards Rule, which dates back to 2003, requires financial institutions to maintain safeguards to protect customer information. The FTC issued the Rule to implement the requirements of the Gramm-Leach-Bliley Act, and it applies to financial institutions subject to the FTC’s authority.”
Go on…
“That includes most automobile dealers who finance or lease automobiles.”
The safeguards
So what safeguards do car dealers need to implement?
Maintain a comprehensive written information security program that covers the customer information, including unauthorized access to the information. The program must cover any third-party service providers that can access the customer information, including anyone who bought or sold the data.
Create a written security incident response and recovery plan so that when things go wrong, you are prepared.
Update your information security program as necessary.
Mechanics of breach reporting
The most visible part of the response and recovery plan is breach reporting in accordance with federal law and state law.
But that firm will be just one of many firms that will be reporting. Many if not all companies that provided data to this identity verification provider will ALSO have to report.
Expect a flood of notifications, possibly very soon.
What should you say in advance of breach reporting?
But breach reporting is not enough. Your firm, whether it’s a car dealer, an identity verification provider, or someone else, needs to proactively communicate how you handle breaches. And communicate this long before a breach occurs.
Why? To give your customers reassurance that if a breach happens, you’ll handle it.
Have you developed:
the strategy to explain how you will handle PII breaches?
the tactics to write these explanations for your content and your proposals?
If you haven’t, bring on an experienced identity, privacy, and product marketing consultant to help you with your strategy and tactics.
John E. Bredehoft in Bredemarket’s worldwide corporate headquarters in Ontario, California.
Bring on Bredemarket.
And book a free appointment to assess your needs.
Feel free to reshare using the “Share this” buttons below.
In 1883, Benz again found financial helpers and set up Benz & Co. Rheinische Gasmotoren-Fabrik. The new company did a splendid business and gave Benz the financial security he needed to expedite the development of a motor car conceived as a unit. For his newly developed Benz Patent Motor Car, in 1886 he was granted patent No. 37 435 – the birth certificate of the automobile.
The awkwardly-named company (well, maybe not so awkwardly named to Germans) occupied Benz’s time until 1903, when he restricted himself to the Supervisory Board. He subsequently started another firm, Carl Benz Söhne, in 1906 and retired from that firm in 1912.
By the time he passed away in 1929, Carl Benz lived to see the merger of Daimler Motorengesellschaft and Benz & Cie. (the 1899 rename of Benz & Co. Rheinische Gasmotoren-Fabrik) to form Daimler-Benz AG. The cars produced by the merged company were called “Mercedes-Benz.” Perhaps you’ve heard of it.
When a car pulls up to you, do you want to look inside?
Here’s another question: when a car pulls up to you, and you’re a law enforcement officer, do you want to look inside?
And here’s a third: if you’re driving a car, how much window tint should the car windows have?
The answer to that third question varies on a state-by-state basis, which also affects the effectiveness around the second question.
I’ll use my state of California as an example. According to the “Window Tinting Laws By State” page on Geoshield’s website, the Visible Light Transmission (VLT) percentage on car windows depends on which car window you’re talking about.
For the front side windows, the minimum VLT value is 70%.
For back side windows and rear windows, any VLT value is allowed.
For the windshield, the minimum VLT value is 100%, except on the top 4 inches of the windshield.
But VLT percentages vary on a state-by-state basis. In Arkansas, front and back side windows have a minimum VLT of 25%.
And I would bet that if someone in California drives to Arkansas with “excessive” back side window tinting, they can get in trouble…if the highway patrol officer notices.
So if you’re a criminal, and you don’t want a law enforcement officer to see you, it’s safest for you to sit in the back seat. If you’re a rich criminal, you’re probably being chauffeured anyway, so this should be easy.
By the way, how many of you figured out why I’m asking these questions?
