On a narrow country road outside Canberra, I'm driving a BYD Shark 6, the hybrid ute loved by tradies and even a cabinet minister.
asserted
I → drive → tradies
But while I'm at the wheel, I'm not the only one in control — a hacker has access to the car.
As the 2.6 tonne ute rounds a bend, he gets to work.
asserted
he → have → bend
With the stroke of a key, he kills the headlights, plunging me into darkness.
asserted
he → kill → darkness
The Shark has spent the last two weeks with Dan Hreszczuk, a cybersecurity expert, who specialises in cars.
asserted
who → spend → cars
His task was to hack the vehicle and find out what could be seen and done remotely by the Shark's Chinese manufacturer.
"It was easier than we were expecting," Hreszczuk says.
uncertain
Hreszczuk → hack → manufacturer
Modern connected cars — particularly EVs and hybrids — are increasingly run by software, giving manufacturers the power to change, update and control vehicles, like never before.
In the case of BYD and others, that software is controlled from China.
asserted
software → connect → China
With fuel prices on the rise, EVs and plug-in hybrids like the Shark have gone mainstream this year, making up almost a third of new cars sales to date.
asserted
EVs → plug → date
EVs, with all their sensors, cameras and microphones, hoover up and spit out vast amounts of data.
asserted
EVs → hoover → data
Experts say that data poses a greater risk in the hands of Chinese EV makers, as they can be compelled by the country's national security laws to co-operate with authorities.
asserted
they → say → authorities
To put this potential access to the test, it made sense to pick a model from China's top EV brand, BYD.
Hreszczuk, the co-founder of Fortify Labs in Canberra, was stunned by the BYD Shark's lack of cybersecurity.
asserted
Hreszczuk → put → cybersecurity
"The access we took advantage of didn't even have a password," he says.
asserted
he → take → password
"It's a little bit scary how open … the BYD Shark is to a hacker."
This lack of a password allowed Dan to access the car's digital arteries.
asserted
Dan → allow → arteries
From there it was a matter of unpicking the software programs which control different functions in the car.
asserted
which → unpick → car
Sitting by the side of the country road, he demonstrates what could be done with remote access to a vehicle.
uncertain
what → sit → vehicle
First, he locks the doors while I'm inside, blasts music over the speakers and plays images on the BYD's giant infotainment screen.
asserted
I → lock → screen
Then, as I drive, he remotely switches the wipers on at top speed, sprays the windscreen with water and turns the lights on and off.
asserted
he → drive → lights
Adding to the distraction: Dan has the speaker telling me repeatedly; "For safety use low beam".
asserted
speaker → add → beam
Fortunately, I was only travelling 30km/h and the road was pretty straight.
asserted
road → travel → km/h
Then, Dan kills the lights altogether.
asserted
Dan → kill → lights
Dan says he wasn't able to access more critical functions like brakes and cameras as these were well protected.
But it doesn't take much imagination to understand how dangerous, even this kind of access could be in the hands of a malicious actor, with a vehicle travelling at high speed on a winding road.
uncertain
vehicle → say → road
Surveillance
While sabotage is one worry, the concern most-often cited is surveillance, due to the array of cameras and microphones on an EV.
asserted
concern → cite → EV
Last year, the UK military banned Chinese EVs — even those made with Chinese components — from parking within 3 kilometres of some of its most sensitive locations.
asserted
military → ban → locations
China itself has previously banned foreign EVs from military sites and political enclaves, aware of their surveillance potential.
asserted
China → ban → potential
In Australia, there's no blanket ban on Chinese marques by Defence, but ASIO has warned ministers and public servants not to have sensitive conversations in their cars or connect work devices.
asserted
ASIO → be → devices
But there's nothing to stop them owning a Chinese EV.
asserted
them → be → EV
Trade Minister Don Farrell has a BYD Shark 6, the same vehicle that Dan hacked.
asserted
Dan → have → that
Farrell recently told a newspaper it's the "best ute I've ever owned".
asserted
I → tell → newspaper
ASIO's surveillance fears appear well founded, based on what else Dan is able to do to with the Shark even at a low level of access.
asserted
Dan → appear → access
We devise a demonstration: I'll take the BYD for a drive around Canberra, and give my mum a call to talk her through some internet banking.
asserted
I → devise → banking
As I drive past the war memorial and down Anzac Parade, Dan has already remotely accessed the vehicle and is tracking my progress.
asserted
Dan → drive → progress
Then he gets to work.
asserted
he → get → ?
"How about we turn on the microphone?" he suggests to the crew back at his lab.
uncertain
he → turn → lab
At that point Dan can hear everything.
asserted
Dan → hear → everything
"Hey Siri," I say to my iPhone.
asserted
I → say → iPhone
"
When she picks up, I'm straight into the details of how I had set up her internet banking.
asserted
I → pick → banking
"I'm going to use as a temporary password, my initials, the number of my house, and then my full date of birth.
asserted
I → go → birth
And then you can go in later and change it if you want," I tell her.
asserted
I → go → her
Back at the lab Dan records the whole conversation.
asserted
Dan → record → conversation
The key is he's now got a recording of me saying, "Hey Siri".
asserted
me → get → Siri
When I pull into a service station and leave my phone unlocked in the car, Dan seizes his opportunity.
asserted
Dan → pull → opportunity
…and 27 more, not listed.
The Aporia