What is it about Dana Farber that makes it such a powerful adversary against cancer? It's hundreds of Dana Farber researchers and clinicians making new discoveries inspired by the work of previous Dana Farber discoverers. At Dana Farber Cancer Institute, nothing is as effective against cancer as a relentless succession of breakthroughs. Learn more about their momentum. Go to Danafarber. Org/stories.

From the New Times, I'm Sabrina Tavernisi, and this is The Daily. As modern cars become ever more sophisticated pieces of technology, they've begun sharing information about their drivers, sometimes with unnerving consequences. Today, my colleague, Cashmere Hill, explains what our cars now know and what this means for our lives. It's Monday, March 18th.

So, Cashmere, you're a data and technology reporter, and you usually come on the show to tell us some very frightening new way that technology is going to affect our lives. This time, though, you're coming on the show to talk about cars.

Why cars?

Well, like many Americans, during the pandemic, I got a new car, and I hadn't had a car since 1999 when I was in high school, and cars had changed a lot. They've gotten much better. They're more sophisticated. I mean, they're basically computers on wheels. But I know that when you connect things to the internet, it has the ability to record data about you, watch you, potentially spy on you if you don't know what data is being collected and sent You're sitting in this new car, looking around, thinking, Okay, this stuff is probably spying on me. Exactly. I wondered, what data are cars collecting now? Where are they sending it? Who's getting it. I just wanted to know who's tapping into these cars.

Okay, over here. Yeah.

This reporting led me to a woman named Christine.

My name is Christine Deltal-Ogden, and I'm from Beau Gere City, Louisiana.

Christine is a real estate agent in Louisiana. For a while, she also sold medical supplies. So her car, a Mercedes, was really important to her work.

I had a Class C 300, and actually my car was basically like my roving office. As a rep, in that capacity, you have to live in your car. So it's pretty much like your home away from home.

Christina had been married for 10 years, and her now late husband was a federal agent and abusive.

I started losing my independence, I guess you could say.

One night, he got violent with her, and she decided to leave him. She got in her car, and she drove five hours away to where her daughter lived. She ended up filing a police report against her husband for domestic violence, and she did not want to be in contact, but he's texting her. He's calling her. Then he starts sending her messages that indicate he knows where she is in real-time. There were a lot of weird incidents, like this one particular incident where she was on a work trip.

I'm sitting in a parking lot.

She was waiting for her colleague in her car.

All of a sudden, he shows up and backs up, rolls his windows down, and is looking at me.

He suddenly shows up in the parking lot. Wow. She had already made sure that he couldn't track her phone. Then she realizes.

Oh, my God. It just hit me in that moment that it has to be the car. It has to be the car.

That the only way it could be happening is that he is tracking her car.

Then I started thinking about, Well, the only thing that is tied me to this car is going to be that Mercedes app.

So her Mercedes was connected to an app Mercedes offers called Mercedes Me.

I get on there, and there's all this information on there that says you can open your car door.

It's one of these connected car apps. You can use it to lock and unlock the vehicle, maybe turn it on remotely. You can also find out the location of the car. That's what her husband was doing. He was tracking the location of the car and thus seeing everywhere she went.

I had no idea. He was actually watching every move I made. That car was a red light shining that, Oh, she's here. Oh, she's there. He's constantly checking that app, looking to see where I was. We verified that.

What does she do once she has this information?

At this point, she already has a restraining order against him, so she lets the detective on her case know, Hey, he's tracking me.

That's when we start calling Mercedes, and I explain She calls Mercedes because she wants to get his access to the car turned off or revoked.

I didn't know he was going to use the invoice system to track everywhere I went. That's what he's been doing. He's tracking everywhere I go. Hang on. Let me ask you a question.

Let me ask you if you don't- She is running into problems because he's the owner of the car.

Did they say that the vehicle could be in your name, or was it an agreement that the vehicle stays in his name?

The title in his name. Christine told me it's a decision that they made because he had better credit, but she is the one paying for the car.

I've got it in my papers that I have access to the car. I'm the only one that's ever really paid a note on this car.

She actually had an order from the judge that had awarded her ownership of the car during divorce proceedings. She had this temporary restraining order. She's telling Mercedes, Look, I know he's technically the owner of the car, but this is my car. A judge has said, This is my car. I have a restraining order against him. He's not supposed to be getting this access to me. Please turn this off. But he has violated several protection orders because he stalks me on this car.

It's really hard to do anything. Okay.

She calls repeatedly.

Because I know I can't be the only woman if this has happened to.

They can't help her. Crazy. The person who owned the car had the right to be connected to the vehicle. And Mercedes just didn't seem to have any protocol for what to do when this happens.

That is really, really remarkable. So what does she do?

She eventually ends up taking the Mercedes to a mechanic, and she pays $400 for him to basically pull the device in the car that provides internet connectivity. So she disconnects her car. It meant that she lost navigation services in the car. She lost the ability to call roadside assistance, but she didn't care. She said, I just don't want him to be able to track me.

It's pretty terrifying this story, Cash. I have to say it's pretty surprising to me that there wasn't a way Mercedes could stop this. What did Mercedes say about this?

Mercedes said they could not comment on an individual customer. But this is not just Mercedes. There have been other reports of women. This happened to be with other car brands with Tesla. The Detective in Christine's case, it actually had another case just like this with Alexis. I think what's really troubling here is that cars are a lifeline for these women. It's literally how they are getting away from abusive situations. But because it's connected to the internet, it's another place where they can be tracked and harassed. This is the paradox of connected cars. They are no longer private spaces.

What do we make about the fact that these cars, they have all this technology that now, as we're seeing, can be exploited. But the car manufacturers don't seem to have anticipated that.

Yeah. I mean, car manufacturers have been making cars for a long time, but they just started making these connected cars really just in the last decade. Car companies, when they have thought about safety, for example. In the past, they're thinking about seatbelts. They're not thinking about data security, privacy, and harassment, all of these things that happen when you have humans combined with technology. These car companies are so new to this, and I don't think they've worked out the kinks in the way that the Googles and the Facebooks of the world have to the extent that they have.

It's just not their thing yet. They have come into this technology technology space, this digital space, looking around and not practiced it, how to treat data carefully and really what to do with it at all.

Exactly. These are new problems for car makers, but they're not new problems when it comes to technology. This was a case of a bad actor invading the privacy of a driver. But as I continued my reporting, I discovered that car companies themselves were invading the privacy of millions of drivers. We'll be right back.

So, Cashmer, you said that these privacy issues in cars actually go beyond individuals exploiting technology, that, in fact, you discovered that car companies themselves were invading people's privacy. Tell me about that.

Yeah. So for the story about how car apps were being used by abusers, I was spending a lot of time on car forums, places on the internet where people talk about their cars and their love of cars and their issues with cars, on Reddit, on dedicated discussion boards. I kept seeing the same story over and over again. It was people whose insurance rates had gone up, and they would ask the insurance agent, Why did my insurance go up 20%, 50%, or why can't I get insurance? The agent would tell them, You need to pull your LexusNexus report. So LexusNexus, they're basically a big data broker, and LexusNexus has a division called LexusNexus Risk Solutions. Historically, it's kept track of moving violations, speeding tickets, any accidents you've been in, whether you are at fault or not at fault. So these people go to LexusNexus, they ask for their files, and when it comes to them, the files are hundreds of pages long. In them, they are finding information about every trip they have taken in their cars over the previous six months, how far they drove, when the trip started, when the trip ended, how many times they hard-brake, hard-accelerated, or sped.

Wow. These people were shocked. They came to the online forum saying, Why is this happening? Does anyone know why this is happening? How do I turn this off?

Okay, so what's the answer? How was it happening?

We talked earlier that cars can collect this really detailed data, and that's what was happening. The cars were collecting this data. This was happening to people who drove cars made by General Motors. General Motors was getting this data, and then General Motors was giving it to LexusNexus.

Wow. Okay, so the car company itself was actually just handing it over?

Well, I don't think they were just doing it for free. But yes, they were sharing and selling this data. It wasn't for everybody. It wasn't everybody who a GM car that this was happening to. It was happening to a subset of people who had knowingly or unknowingly, in some cases, been enrolled in something called Smart Driver.

And what's Smart Driver?

So Smart Driver is a feature offered by GM. It's called OnStar Smart Driver. It's supposed to be a program to help you be a better driver. You can collect digital badges for being a good driver, like break genius and speed limit hero. You get some feedback, like take it easy on the breaks. Don't speed up so much. Make sure you're leaving room in front of your car so you're not going to hit the person in front of you. Don't tailgate.

It's a little bit like one of those exercise apps. Like, great job. You ran five miles. Nice braking there, or on the contrary.

Yeah, it was that gamification of real life, right? Mm-hmm. Get a good score, be a good driver. But what people who turned this on didn't realize was that there was something buried in the privacy policy that no one reads that said that they could share that data with third parties. The third parties that they were sharing it with were LexusNexus and another data broker that works with the insurance industry called Verisk.

Some vague fine print lets them turn this driving game into a data harvesting machine, essentially.

Yeah. When I talked to GM, the spokesperson said that people could turn this on in the vehicle app or at the dealership when they bought the car. It seemed possible that this was quietly being turned on at the dealership by salespeople. I found this company manual that said that salespeople could earn bonuses from GM by getting drivers to enroll in OnStar connected services, including smart driver.

I mean, there's something creepy about it, right? Like, these people were driving around. They had no idea that every move they made, including when they break, when they turned, how fast they approach to a stop sign, all of that was being being watched. It feels like a fundamental violation of privacy in your own car.

One of the drivers I talked to said it felt like a betrayal. Like, he had no idea this information was getting collected and that it would be shared in this way that cost him financially. His insurance went up. He said, I'm a safe driver. I've never been in an accident. I don't even understand how they're judging me on this. It was really confusing to the people this was happening to.

How much were their rates actually up? Give me an example.

One Cadillac driver I talked to in Palm Beach, Florida, said that he actually got denied by seven auto insurance companies, and he wound up paying double what he was paying before for his auto insurance.

That is a huge increase.

How typical was that?

Do you have a sense of that?

It's hard to tell. It was just a lot of posts on these different forums, and some people said 20%, some people didn't know how much it had affected their insurance. But yeah, it seemed to range from, I saw 20%, I saw 50%, and I saw people who said their insurance doubled.

What was the scope here in terms of companies? I mean, was this just GM?

I was only seeing people really explicitly complaining about GM cars. I'd had this experience of my insurance went up, I went to LexusNexus, I found my details. But then when I started looking into this, I saw that actually a lot of different automakers are starting to do a form of this. And some of the automakers said, This is about safety. We're trying to help people be better drivers. Often, they have a driver score or driver feedback or a road score in their app. Sometimes it's the data broker that's actually giving you the score in the app, not your automaker.

Okay, so they say it's for safety. Does that explanation hold water?

A version of this has been going on for a long time. There's something called usage-based insurance, where you with your insurance company, say, Okay, I'll I'll put a dongle in my car, or I'll put your app on my smartphone, and I'll let you monitor my driving. Those programs have actually been quite successful. I talked to one expert, and he says that when people are knowingly doing this, being observed, that the impact on safety is enormous, that these people become better drivers. But that doesn't work if you don't know that you're enrolled in this program. If you don't know that how you drive is going to impact your insurance, then you're not going to improve your driving. There's no safety benefit here. At the same time, there's this question of, what does this data even mean? What is hard-breaking? What is hard acceleration? How does it reflect how risky a driver you are? I was actually thinking about this a couple of days ago because I was driving home late at night, and a herd of deer just suddenly sprinted across the road, and I had to slam on the brakes. I saved my car insurance company a bunch of money because I didn't I hit the deer and damage my car.

But I wonder in the data, do I look like a terrible driver who was tailgating somebody and then had to slam on the brakes?

I mean, back to your point earlier in the show, right? These car companies are tech companies in training, right? I imagine that they will soon learn some of the lessons that other tech companies have had to learn, which is surveilling your customers, collecting troves of data, that doesn't go unnoticed for long periods of time. I mean, it will have a response.

People People are not happy about this. I've been watching those. I'm still in those online car forums, and I see people reacting to this story, and they're saying, Oh, my God, I just checked my app, and I'm signed up for this. I can't believe it. They're saying, I'm not going to buy a GM car. I'm not going to buy any of the cars that are mentioned in this article. But the thing is, there's lots of different automakers that are doing this. I talked to Senator Ed Markey about this.

Senator from Massachusetts.

Senator from Massachusetts. He's been to car makers, asking them, What data are you collecting about people? Who are you sharing it with? They had sent him some very evasive answers. But he said, when I described to him what was happening with GM, he said, That sounds like a violation of the law that protects consumers against unfair and deceptive business practices. A couple of days after my story came out, there was a class action lawsuit filed against General Motors and LexusNexus in the Southern district Florida.

This is really a moving target in terms of, in a way, a new social problem. I mean, you started digging into the privacy implications of these cars, and you found pretty quickly two very egregious examples of ways car drivers privacy is being violated, which makes me wonder, what else is going on with these cars that we don't even know about yet?

Right. Honestly, this is what I have been seeing in the last decade or so. I've been reporting on privacy and data collection. At first, I was writing about Facebook and Google, but now everything is internet connected. It's not just cars. So many of the products we get, your TV, your vacuum, sometimes your bed, your toothbrush. They want to put a WiFi connection on everything. It can be really convenient. It can give us information remotely. We can turn things on and off, our lights. But once you have this internet connection, it means people can get at these devices who previously couldn't. It means that things that don't look like a camera, that don't look like a recording device are. They're watching you and they're gathering information about you. It's this big question of who's getting it and how is it going to be used.

Kasmir, thank you.

Thanks for having me on, Sabrina.

We'll be right back. Here's what else you should know today. In a highly anticipated ruling, a judge overseeing the election interference case against Donald Trump and his allies in Georgia decided on Friday that the Fulton County district attorney, Fawnie Willis, could remain in charge of the prosecution, but only if her former romantic partner, withdraw from the case. The ruling essentially meant the case against Trump and his allies in Georgia could proceed since the judge could have removed her and her entire office from the prosecution but chose not to. The decision revolved around a defendant's claim that Willis should be disqualified because her romance with her office's lead lawyer, Nathan Wade, had given her an inappropriate financial stake in prosecuting Trump. Within hours of the ruling, Wade resigned from the case. But even as the judge spared Willis, he refused to fully vindicate her. The ruling described her decision to date Wade and take multiple vacations with him as, a tremendous lapse in judgment that had raised a significant appearance of impropriety. And in Russia, Vladimir Putin garnered 88% of the vote in the presidential election this weekend, according to Russian election authorities. His win was a foregone conclusion, as the Kremlin had blocked any real competition.

In a quiet show of opposition, Russians formed long lines at polling stations in several major cities at noon on Sunday, at the request of the team of the now deceased opposition leader, Alexei Navalny. If Putin serves to 2030, the end of his new term, he will have the longest tenure of any Russian leader since Catherine the Great in the late 1700s. Today's episode was produced by Olivia Nat, Alex Stern, Diana Wyn, Will Reid, and Ricky Nowetzky. It was edited by Devon Taylor, contains original music by Marion Lozano, Pat McCusker, and Ron Nemistow, and was engineered by Alyssa Moxley. Our theme music is by Jim Brunberg and Ben Lansferck of WNDERLY. For The Daily. I'm Sabrina Tavernousi. See you tomorrow.