Australia is years behind in dealing with the cybersecurity risks from Chinese-made cars as they become some of the country’s most popular vehicles, an MP has warned.
Internet-connected cars can collect and store audio and video recordings, phone use including contact books and records of calls and messages, location data, and even details about people in the car like their weight and facial scans.
The nation’s cyber spy agency, the Australian Signals Directorate, has warned this information could be used by foreign intelligence services, depending on the laws of the car manufacturer’s country.
Sign up to The Nightly’s newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.
Chinese companies can be compelled to hand over data in this way.
Home Affairs Minister Tony Burke has previously come under scrutiny for choosing to drive a Chinese-made EV, with Cabinet colleagues saying he had taken “appropriate precautions” to protect sensitive information.
Liberal MP Mary Aldred is concerned about the slow action on Chinese EVs, which have proven massively popular in Australia since they are generally cheaper than other models.
She points to a US restriction on importing vehicles that use Chinese or Russian hardware and software due to security concerns, in rules that are seen as being aimed at Huawei.
Malcolm Turnbull banned Chinese-owned Huawei from the 5G rollout in Australia in 2018 on national security advice, but there haven’t been any further restrictions on it entering the market in other ways.
Ms Aldred said Australia was so far behind its security partners.
“We’re essentially talking about computers on wheels when it comes to EVs, and it’s deeply concerning to see a technology company that’s been banned or significantly restricted by Quad member countries because of national security concerns having the capacity to hoover up consumer and government data in Australia depending on the person driving the vehicle,” she told this masthead.
“The fact that the former US Biden Administration is still more up to date than the current Albanese Government on regulatory reform in this area shows how out of touch the Prime Minister is on technology.”
She warned there were significant consequences if the data was misused, ranging from domestic violence to corporate espionage and national security concerns.
Chinese electric vehicle maker BYD was the second-highest selling brand in April, capturing 8.3 per cent of Australia’s new car market, according to Federal Chamber of Automotive Industries data.
Its Sealion 7 was the seventh top-selling vehicle for the month.
The Tiggo, a compact SUV from Chery, and Haval’s Jolion, both Chinese companies, also made the top 10.
ASD estimates that within five years, 93 per cent of all new vehicles sold in the country will be connected to the internet.
They offer features such as inbuilt GPS, connecting to your phone via USB or Bluetooth, remote access or control via a smartphone, and advanced infotainment like real-time weather or traffic monitoring.
While many people think only of electric vehicles, most new cars with combustion engines also come under this category.
There hasn’t been any clear progress on whether connected vehicles would be specifically regulated under the Privacy Act.
Nor are they regulated under the Cyber Security Act, although the Infrastructure Department has been consulting on adopting two UN rules around cybersecurity into the national road vehicle standards.
The Office of the Australian Information Commissioner has launched 18-month investigations into Toyota and Hyundai, headquartered in Japan and South Korea respectively.
The Commissioner is examining whether the car companies collect more information than necessary, whether it is used for secondary purposes without people’s consent, and whether it is destroyed when no longer needed.
“These investigations were commenced consistent with the OAIC’s regulatory priorities, taking a risk based approach to regulation and in accordance with its statement of regulatory approach,” a spokesperson said.
However, it isn’t looking at any Chinese companies at this stage, and the Attorney-General’s Department told Senate estimates in February that no one had met with any Chinese carmakers to discuss their ability to track Australians who had bought their vehicles.
