Your car is listening, and a foreign intelligence service now thinks you should know it. The Dutch General Intelligence and Security Service, the AIVD, has published a warning that the microphones, cameras and navigation systems built into modern vehicles can in principle be accessed from outside the car, and that hostile states could exploit them to gather information on drivers, according to reports carried by the Guardian and other outlets.
The advice is aimed squarely at people who handle sensitive material. Officials and company staff, the AIVD says, should stop treating a connected car as a private room. Conversations held inside one may be closer to a conference call than anyone planned.
The technical claim is not far fetched. Modern cars ship with microphones for voice assistants and for emergency call systems, cameras for parking aids and driver monitoring, and constant network connections for software updates. Every one of those is a pathway. A voice assistant wake word that never fires still represents a microphone that is on. Emergency call hardware, designed to let a car phone home after a crash, is by definition a transmitter with a location.
What gives the warning its edge is where the hardware comes from. The AIVD issued it against the background of European arguments over connected vehicles built by Chinese manufacturers, which have already been restricted from some government sites in Europe and the United States over data concerns. The agency stopped short of naming brands. Its point was broader: the risk belongs to the category of connected car, not one flag on a bonnet.
For UK business the message lands in an awkward place. Company car fleets are enormous, board members spend hours in them, and the vehicles are increasingly specified for exactly the features the AIVD is worried about. Procurement policies have long covered phones and laptops. Few have considered a microphone in a headliner as an endpoint that needs governing.
The practical steps are boring and therefore effective. Do not hold confidential conversations in a connected vehicle. Check what data the car sends and where it sends it. Treat a vehicle as IT infrastructure, because that is what a manufacturer selling software on wheels has built.
The industry will note that nothing in the warning proves any car has actually been tapped. That is true, and it was never the point. The AIVD is telling people the capability exists, and that the burden of proof has quietly shifted.