If you are privacy minded and drive a OnStar equipped vehicle, you are probably going to start looking at the little blue button on your dash a little differently. Monday OnStar began emailing customers about a change to the companies privacy policy that will allow the company to collect and sell “anonymized” location and speed data from any vehicle with a functioning OnStar system regardless of whether there is an active OnStar subscription. The only way to “opt-out” of the new program is to completely disable the onboard OnStar components by removing the fuse for the system. (Though depending on the cars electrical system, this could also disable other “features” that a driver may still want enabled like say the GPS navigation system. I am not familiar enough with OnStar and GM cars to say exactly what disabling the built in OnStar system will do, if some one that does know want’s to chime in in the comments, that would be great.)

While it is one thing to elect to be tracked by a company so they can provide you a service, it is completely another for them to sell that tracking information without explicit consent. History has repeatedly shown that anonymized data rarely is ever anonymous, usually requiring minimal effort to associate the “anonymous” data with an individual. It is even worse when the tracking is performed on people who have no desire to use a company’s service (or in the case of a used auto sale may have never used the company’s service). This is like buying a car with a CB in it and despite never picking up the mic every word you say being broadcast. In fact a microphone is part of the OnStar system, what is to stop them from revising their policies to say that by having OnStar equipment in your car you give them permission to record everything you say and sell “anonymized” conversations to the highest bidder?

To make matters worse, because the US Government already illegally taps every phone in the country (including mobiles) and since OnStar uses cellular telephone technology for its two-way communications the Government could conceivably track every OnStar equipped car in the country (and not just the cars whose owners pay for the service – which is a possibility even now). In a worst case scenario the Government could even piggy back the OnStar communications to turn on the OnStar mic or control any of the other onboard systems OnStar has access to (like the ignition). While this is just conjecture the fact remains, the US Government has no problem illegally spying on its citizens and OnStar is going to start tracking every car infested with its hardware. Why wouldn’t they take advantage of this to better spy on protect its citizens?

What do you think? Has OnStar crossed a line? Will the Government take advantage of this move? Let us know in the comments.

Update: A rep from OnStar’s PR firm just dropped by the comments and left the following statement, “We value our customers’ privacy and security and have never sold any personally identifiable information to any third party.” He goes on to link to a video they put together regarding the new terms and conditions, scroll on down if you’re interested. Do you think this adequately addresses the concerns raised by the new terms and conditions changes? Let us know in the comments.

Update: Onstar has reversed their decision to continue tracking equipped vehicles after service is cancelled. (Read press release)

OnStar Tracks Your Car Even When You Cancel Service [via The Consumerist]

image courtesy of the EFF  

Today the Wall Street Journal announced that it uncovered a new government program ominously dubbed “Perfect Citizen”. The project will bring NSA monitoring equipment to corporate computer networks that the government deems to be “critical infrastructure” with the stated goal of detecting cyber-attacks. Sources familiar with “Perfect Citizen” told the Wall Street Journal that “[the NSA] wouldn’t persistently monitor the whole system”, which is troubling since that statement indicates that the system can be persistently monitored. Since the NSA had no qualms about illegally tapping every phone in America, how can they be trusted not to abuse the “Perfect Citizen” system? In my mind, trusting the NSA with this power is akin to leaving a junkie locked in a room with their drug of choice and telling them not to touch it. For now at least, companies will have to opt-in to allowing the NSA to install sensors onto their networks. However, with the recent Chinese attack on Google held up as an example, what company would choose not to participate in program to “protect national security”, especially if there was any chance of it being leaked that they declined to participate in something called “Perfect Citizen” (ever notice that the more onerous the program or law the more patriotic sounding the name – PATRIOT Act anyone?).

This of course brings me to the obvious poster child for “Perfect Citizen”, Google. At the beginning of this year it came to light that a number of systems belonging to Google, as well as systems of several other large corporations were penetrated by hackers. According to Google (and later persons within the US government as high ranking as Secretary of State Clinton) the attacks originated from China. From the onset the attack was represented to the public as a state sponsored cyber-attack. In fact, the phrase “act of war” was bandied about in some circles. As Google’s investigation progressed (aided by the NSA), however, little supporting evidence was presented despite strong accusations against the Chinese Government. For the world at large the die had been cast, China had attacked US computers. Admittedly, even I accepted Google’s story as fact. At least until this morning when the Wall Street Journal released the details of “Perfect Citizen”. I started thinking, why would China risk such a widespread attack that was certain to be uncovered and could possibly be considered an act of war. Especially in the case of Google where (according to what we were told) the attacks targeted uncovering dissidents, whose identities are almost certainly not worth going to war to uncover.

Read the rest of this entry »