The recent Four Corners program examining connected vehicle security may have been eye-opening for many motorists, but for Fleet Managers it should reinforce an issue that has been developing for years: a modern vehicle is increasingly a connected device as well as a transport asset.
Connectivity is becoming standard across the automotive industry. Vehicles can communicate with manufacturers, fleet management platforms, telematics providers, mobile applications, charging networks and other digital services.
For fleets, these capabilities can deliver significant operational benefits. They can improve visibility, maintenance planning, utilisation, driver safety and vehicle management.
But connectivity also creates another area of risk that Fleet Managers need to understand and manage.
Four Corners puts vehicle security in the spotlight
Questions about vehicle connectivity attracted broader attention following claims raised by the ABC’s Four Corners program about vehicle security and data.
Responding to questions arising from the program, BYD Australia said it was reviewing allegations relating to unauthorised remote access.
BYD COO, Mr. Stephen Collins, said:
“BYD Australia takes vehicle security very seriously for its customers and all road users. We are taking full and immediate action in reviewing alleged claims made in the Four Corners program relating to unauthorised remote access of certain non-critical vehicle control functions. We will respond in detail once we have completed our investigation. The safety of our customers and all road users is our absolute priority.”
The program may have made the issue appear new or confronting to the wider public, but the underlying questions around connectivity, cybersecurity, privacy and data management should already be familiar to many fleet operations.
Fleet Managers have been dealing with connected assets for years through telematics, GPS tracking, electronic logbooks, asset tracking devices, fuel systems, mobile applications and other fleet technologies.
The vehicle itself is now becoming another increasingly sophisticated part of that connected ecosystem.
Vehicle selection is becoming an IT conversation
This means Fleet Managers may need to involve more people in vehicle procurement than they have traditionally.
A connected vehicle could warrant conversations with an organisation’s IT, cybersecurity, risk, privacy, safety, procurement and legal teams, depending on the organisation and the information being collected.
The starting point doesn’t necessarily need to be a new fleet-specific policy.
Many organisations already have policies governing connected devices, information security, cloud services, personal information, employee monitoring and access to corporate systems. Fleet Managers need to understand whether those existing policies also apply to connected vehicles and the services attached to them.
Questions worth considering include what information the vehicle collects, where it is stored, who can access it, how long it is retained, whether it is transferred overseas and what functions can be accessed or controlled remotely.
There is also the question of what happens when a vehicle changes drivers, leaves the fleet or is sold.
Data privacy matters as much as vehicle security
The discussion isn’t limited to whether someone can remotely interact with a vehicle.
Connected vehicles can potentially generate significant amounts of information about the vehicle and its use. Depending on the system, that could include location, journeys, charging behaviour, vehicle status, diagnostic information and interactions with connected services.
BYD also responded specifically to concerns about personal information generated by its vehicles.
Collins said:
“BYD Australia notes concerns raised about connected vehicle data security in Australia. Personal data generated by BYD vehicles in Australia is stored on Australian servers. We have publicly called for purpose-built connected vehicle legislation in Australia – a clear, enforceable standard applying equally to every brand in this market. We welcome that scrutiny and would comply fully with any such framework.”
The important point for fleet buyers is that these questions shouldn’t be restricted to one manufacturer.
As more manufacturers introduce connected services, over-the-air software updates, smartphone applications and remotely accessible vehicle functions, understanding how these systems operate will increasingly become part of fleet due diligence.
Telematics has already introduced fleets to the issue
For experienced Fleet Managers, many of these considerations won’t be completely unfamiliar.
Telematics has already forced organisations to think about who owns fleet data, who can see vehicle locations, how driver information is handled and what happens to data collected by third-party providers.
Asset trackers and other Internet of Things devices have created similar conversations.
Connected vehicles extend those questions because some of the technology is now embedded in the vehicle from the factory rather than installed and managed separately by the fleet organisation.
That distinction could become increasingly important when organisations develop procurement specifications and assess new vehicles.
Add connectivity to fleet due diligence
The response to connected vehicles shouldn’t be to avoid the technology. Connectivity is becoming part of the modern vehicle and can provide fleets with useful operational and safety benefits.
Instead, Fleet Managers need to understand what they’re buying.
Alongside traditional fleet questions about whole-of-life cost, safety, fit-for-purpose requirements, payload, reliability, emissions and aftersales support, procurement processes may increasingly need to examine cybersecurity, data privacy and connectivity.
Fleet Managers don’t necessarily need to become cybersecurity experts. They do, however, need to know when to bring those experts into the conversation.
The Four Corners program has brought connected vehicle security into public discussion. For fleet operators, it should be a prompt to review how connected vehicles fit within their organisation’s existing policies and risk frameworks.
Because as vehicles become more connected, data security is becoming part of fleet management too.
