Comment by frafra | Hacker News Reader

Comment by frafra | Hacker News Reader

Parent Full thread

As reported, installation of such device is mandatory (first link), but it does not need to be active. This is why some car manufacturers disable it upon request (see the third link). I mean, BMW and Porche disable that if requested.

Devices that allow tracking when no accident occurred, violate the current regulation. This is stressed multiple times. "not connected to the mobile phone networks until a serious accident happens" -- https://ec.europa.eu/newsroom/dae/redirection/document/5963

"it is not permanently connected to mobile networks" -- https://ec.europa.eu/commission/presscorner/detail/fr/MEMO_1...

"not connected to the mobile phone networks until a serious accident happens" -- https://ec.europa.eu/newsroom/dae/redirection/document/5963

There is even a technical test to check if the device is compliant with the privacy regulations: "Procedure for verifying the lack of traceability of an eCall in-vehicle system", where the "Failure to establish the connection can be attributed to the 112-based eCall in-vehicle system not being registered on the network" -- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...

Registering the SIM on the network before an accident occurred could be considered a violation indeed.

Unfortunately, something being legislated does mean nothing. In Germany, there has been Covid location tracking via an app (Luca App) for venues. Despite legislation explicitely forbidding that, police tried and gained access to this data.

My previous car sometimes came up with a warning that eCall currently is not available. I'd attribute that to bad reception which means that connection at least has been tried.

I know, there are plenty of cases (and this is why we should defend our rights and support associations like https://noyb.eu/ in my opinion), but I would object that having an app, running on an always-connected smartphone, which register and share data, poses a potential higher risk than an embedded device with a much smaller task that is tested and validated before being sold on the market. There is almost no data record in this case, thus a leak would have a minimal impact, while a backdoored/tampered/non-compliant hardware would still be problematic, but less likely (hopefully).

Your previous car could have had a non-compliant implementation, but it could be that the system run a passive network scanning from time to time, without trying any connection, just because it would be way faster to connect to a network and send a message if there is an up-to-date list of the compatible available operators. Having a better understanding about the specifics of the various implementation would be interesting. The devil is in the details :)

To connect to cellular (2G/3G/4G/5G), you have to listen for a beacon from a base station. If you don't hear a beacon strong enough, you aren't even allowed to try to connect (as it involves transmitting a connection request).

> Devices that allow tracking when no accident occurred, violate the current regulation. This is stressed multiple times. "not connected to the mobile phone networks until a serious accident happens" -- https://ec.europa.eu/newsroom/dae/redirection/document/5963

Note that the linked document applies only to eCall In Vehicle System. Nothing prevent manufacturer to install a second system, using the same or separate modem, and track user's location and actions continuously. If the law requires you to install a GPS receiver and a modem, it would be uncapitalistic not to try to gain some profits from the data.

Sure, so? Is that mandatory? No. Would it require explicit user permission? Yes, as any other device or service in EU. The user or the manufacturer always have the ability to put extra devices which do whatever, if they respect the current regulations. This has nothing to do with having eCall installed by default.

Reply on news.ycombinator.com