'Not conclusive': BYD responds to hacking
Two Chinese carmakers have come under fire in Australia for alleged lax cyber security measures and questions over privacy, following investigations from the Australian Broadcasting Corporation (ABC). Technology in EVs bring an increased risk of surveillance and privacy breaches and potential hacking, with Four Corners showing how easy it was to allegedly hack a BYD Shark 6.. BYD has now responded to the ABC's claims, stating the footage does not conclusively show its vehicles are open to hacking without first gaining physical access to the vehicle.. "The footage from the Four Corners report does not provide conclusive evidence that a remote attack vulnerability exists without physical access to the vehicle..
Once unrestricted physical access to the vehicle is established the need for passwords diminishes," a spokesperson said.. An ABC investigation uncovered that BYD's privacy policy said data could be collected "in connection with suspected illegal or improper activities" and that this could be done through "surveillance activities".. This broad policy gave BYD significant powers to gather data on owners, and how it could disclose information..
The carmaker has since removed all references to China and mentions of surveillance.. A spokesperson for BYD Australia told CarsGuide privacy policy changes were not made due to the ABC's investigation.. "Any inference that the policy was updated in response to the Four Corners investigation is strenuously denied," they said..
The company's high-tech credentials mean its vehicles feature lots of camera and other monitoring equipment primarily to improve safety, combined with over-the-air connectivity technology. BYD cars use a driver monitoring system that includes a camera pointed towards the driver to detect any drowsiness or a lack of attention. These systems generate substantial amounts of information about those in the car, what they do and the conversations they have. The Chinese government recently released a raft of new rules to tighten how its carmakers operate in overseas markets.. Carmakers are now required to take necessary measures to ensure any data-processing, including collection, use and cross-border transfers must comply with applicable laws. They must also adhere to personal information protection regulations and safeguard consumer privacy. This move is designed to improve buyer trust in overseas markets, but there remains concerns about its application. Australia's privacy rules allow for data to be transferred to China, so theoretically owner data could be at risk. BYD's new policy states in the event of personal data transfers to other countries, it will comply with data protection laws regarding cross-border transfers. "We haven't and would not transfer any data of Australians to the Chinese authorities," it said. Companies must still cooperate with authorities when required under national Chinese security rules. A spokesperson for BYD Australia said the brand cannot be compelled to provide owner information because Australian law governs its operations. The ABC also published an article on cybersecurity concerns for new EVs. Cybersecurity expert Dan Hreszczuk was able to remotely access some of a BYD Shark 6's functions without even needing a password. Hreszczuk said he unpicked the software programs controlling different functions, and could blast music over the speakers, remotely switch the car's lights on and off, and operate the wipers, among other things. "It's a little bit scary how open … the BYD Shark is to a hacker," Hreszczuk told the ABC. A spokesperson for BYD Australia told CarsGuide it was working through its own investigation, and is querying claims made by the ABC.. "We are taking full and immediate action in reviewing alleged claims and will respond in detail once we have completed our investigation," they said..
They said BYD conducts its own simulated cyberattack testing to assess the effectiveness of protections and identify vulnerabilities.. "In current versions of our infotainment system, third-part apps cannot be installed by users, which helps prevent unauthorised software and potential vulnerabilities being installed on the vehicle," they said.. It's not just BYD making headlines over its in-cabin surveillance..
Leapmotor cars feature lots of cameras to provide increased vision and safety for owners, in line with many Chinese EVs.. The ABC has reported some Leapmotor models use cameras removed from federal government buildings over surveillance concerns.. The cameras in question are made by Dahua Technology, and in 2023, many were removed from federal buildings and defence sites..
CarsGuide has contacted Leapmotor Australia for comment to find out which models have Dahua cameras installed in them.. Leapmotor currently sells its B10 and C10 fully-electric or hybrid range-extender SUVs, and its B05 hatchback in Australia.. It will soon introduce the smaller budget-focused B03X designed to rival some of the most affordable EVs on sale in Australia..