Researchers from the University of Washington and the University of California, San Diego did an experiment to see what could be learned from just the information many cars are already recording. The result was that the way people drove was as identifiable as a fingerprint.
In the experiment, detailed in a paper that the researchers hope to present at the Privacy Enhancing Technology Symposium this summer, researchers asked 15 participants to drive in an isolated parking lot and on a 50 mile journey through Seattle. The same car, a 2009 sedan, was used for each. Each driver drove the course at the same time of day and they were all forced to listen to the same radio station (described in the study as “uptempo pop music”). Basically, everything was done to make sure the only substantive difference in the data was the way people drove.
The researchers got data from the car’s own internal network—called the CAN bus—on things like steering wheel position, speed, turn signal use, and brake pedal position. They didn’t even take every bit of data the car recorded, just the 16 they thought most likely to be in the vast majority of cars. And it wasn’t that hard to get the data—they plugged a laptop into the dashboard.
The researchers then fed 90 percent of the data into a learning algorithm. So the algorithm “learned” how each of the 15 participants drove. The remaining 10 percent of the data was then fed into an algorithm to “match” to one of the participants. In other words, the system was matching driving it had never seen to the profiles it had built.
When it was given data from all 16 sensors for the whole drive, the match was made 100 percent of the time. When it was given data from five sensors, three sensors, and even just the brake pedal, the match was made 100 percent of the time.
On just 15 minutes of data and all 16 sensors, the match was made 100 percent of the time. Just the brake pedal was 87 percent accurate.
This research reveals just how much data your car is actually collecting—and that turning over all that data through apps or insurance company dongles may be revealing more about yourself than you realize. Tesla, with its auto-uploading feature, probably knows a lot about its drivers.
The researchers also say that there’s no real way to tell if this is a problem that’s going to get better or worse. On one hand, cars are coming with more and more sensors and more sophisticated ones. On the other hand, a human won’t be identified by the driving patterns of an autonomous car. Yes, in the future, the paranoid will all have self-driving cars.
It should be noted that 15 people is a small group—there is every chance that it might be much harder to distinguish between 1,000 drivers than 15. And that being able to figure out who was driving a car at what time would have some interesting benefits for law enforcement and insurance claims. Of course, those benefits may not outweigh the privacy concerns of a computer knowing exactly how you drive.
And the data isn’t protected that well. Anyone can get it all by plugging a computer into a car’s dashboard. Think about how much you’re giving away the next time you see your mechanic do that.