Blog

Your Car Is Sharing More Private Data Than Your Smartphone. Who’s Getting It?

Modern vehicles, like every other technology device we own, from smartphones to fridges and even dog collars, are connected to the internet 24/7. They learn from us, know things about us, and most of the time use that information to make our lives easier. Cars, specifically, collect vital driving and behavior data that is borderline impossible to opt out of if you want to use your vehicle’s modern convenience features. And a new study recently found that your sensitive information (some of which isn’t even car-related) is being shared with far more parties than you realize.

The only way you’ll be surprised by what you’re about to read is if you’ve been in a coma for the last decade or two. But even for those of us who are mildly aware of how the technology we rely on every day interacts with us and the data we generate, this recent study by Boston’s Northeastern University in partnership with Consumer Reports will make you raise an eyebrow—several times.

The study covered 21 vehicles of 19 different brands (listed below) and 30 companion mobile apps that process and handle user data.

You can peruse the 18-page paper here, but you can also see the main takeaways below:

  • Companion Apps Share Data That Goes Beyond Car Stuff: 70% of companion apps contacted more than five unique ATA (advertising, tracking, analytics) domains, typically sharing location, timing, and other data packets. For most test vehicles, adding the automaker or third-party (usually pre-installed) app at least doubles the number of ATA companies exposed to the owner’s data. The Envista and Nissan Ariya, which were nearly silent on their own, each reach 20+ ATA companies once the app is counted. myCadillac contacted 51 ATA domains.
  • How Many Third-Party Apps Your Car Contacts Wildly Varies: Over Wi-Fi, vehicles contacted at most four first-party domains but averaged about 9 integrated third parties. The Tesla Model 3 contacted 34 ATA domains and the Cybertruck 23, while the Mercedes EQS and Buick Envista contacted no third parties. Thirteen of the 21 vehicles contacted Google ATA domains, including ones like doubleclick.net that aren’t needed for core services. Vehicles with Android Automotive and Google services contacted many more trackers, and even sibling brands differed; oddly enough, the Envista, Lyriq, and Blazer did not behave in the same manner.
  • Some Apps Share Your VIN With Vendors, Something Not Even Your Smartphone Can Do: Seven apps (19 of 21 cars) transmitted personal information to ATA third parties: all four GM apps, HondaLink, Lincoln, and MyNissan. VINs were the most common, sent to recipients including Google, Microsoft, and Meta. The worry is that a VIN plus an email, phone number, or location lets an ad company link a specific person to their browsing and purchase history. The study also highlights that a VIN can’t be reset the way a phone’s advertising ID can. Also, I just published a blog this week about how I enjoyed Honda’s infotainment with Google Built-in, and cracked a joke about the price I am willing to pay for convenience.
  • OEMs Mostly Pass the Buck to Their Partners and Vendors: Of 17 manufacturers contacted for the study, 14 responded. All said their vendor contracts covered data flows. Five blamed embedded browsers in their apps, and seven said reading third-party terms is the consumer’s responsibility. Of course, if you opt out or simply don’t use the features, then you wouldn’t be utilizing your car to its full potential. Tesla warned about reduced functionality or inoperability, while Rivian warned about disabled navigation and over-the-air updates. The privacy policies disclosed that data may go to third parties but not which ones or why. Only Honda changed course. It had Amplitude delete the location data it received and stopped the app from sending it. Go Honda.
  • Gathering This Data Wasn’t Easy: Even if you only use the official apps pre-installed in your car, some of these may connect to your phone and ultimately open your browser. Once it does, the whole flow of data changes because it follows your phone’s browser settings, not your car’s. This means your car is now receiving cookies and browsing data and sharing them in ways you weren’t aware of or expected.

Keep reading

Fire Fighters Union in Michigan Quietly Pulls Endorsement of Abdul-El Sayed Then Scrubs Website

A fire fighters union in Michigan has yanked their support for far left Democrat Abdul El-Sayed in the race for U.S. Senate.

They’re now chalking the original endorsement up as a clerical error. Either way, it’s not a good look for El-Sayed, who has come under increased scrutiny in recent months.

The people who run big unions often endorse Democrat candidates, but the rank and file members tend to vote Republican. We have seen this happen again and again.

The Midwesterner reports:

Michigan fire fighters union calls Abdul El-Sayed endorsement ‘clerical error’ — quietly erases from slate of supported candidates

The Michigan Professional Fire Fighters Union quietly removed U.S. Senate candidate Abdul El-Sayed from its slate of endorsed candidates.

MPFFU President Matt Sahr told The Midwesterner the union’s slate of endorsed candidates initially went out to members on Sept. 11 or 12 with an endorsement for El-Sayed’s campaign prominently displayed at the top alongside Jocelyn Benson for governor and endorsements for the Michigan Supreme Court.

Fifteen days later, on Monday, MPFFU leaders sent out a revised slate of endorsements that replaced El-Sayed with an endorsement for Lt. Gov. Garlin Gilchrist for Secretary of State.

“Our intention was to stay out of that race,” Sahr said, adding the initial slate of endorsements “got distributed out before it got approved” and dismissed it as a clerical error.”…

At least one MPFFU member disputes that.

“This was not a clerical error. What we are seeing now is MPFFU leadership trying to sweep this under the rug. If rank-and-file members had not voiced our concerns, I have no doubt this organization would still be supporting Abdul El-Sayed over Mike Rogers,” a MPFFU fire fighter from southern Michigan told The Midwesterner.

Keep reading

The Government’s WAR Against American Doctors

After earning a medical degree, who gets the residency, the citizen or the foreigner?

We tell our children to study hard. Get the education. Earn the degree. Prepare for a profession where they can make a difference. Suppose Johnny does all of that.

He graduates from medical school. He has the degree. But on the usual path toward independent medical practice, there is another essential step: postgraduate clinical training, usually through residency training. And without a residency selection, a student’s medical career is effectively on hold, as residency training is required to obtain a full medical license and practice independently.

So, now Johnny needs a residency. And that brings me back to the question we asked in my last article: When does the system give American applicants First Consideration? The ANSWER – it doesn’t. It rewards Foreign Trained Physicians with VISA preferences to overcome Medicare Reimbursement CAPS on U.S. Doctors.

A controversy involving Rochester General Hospital in New York brought that question into sharp focus. A viral post alleged that 80 of 82 resident physicians were foreign-trained working under H‑1B or J‑1 VISAS, leaving only two positions for Americans.

That is a serious allegation. It also remains unverified. Medical-school rosters do not establish citizenship or VISA status, and the hospital’s published response did not provide that breakdown. Still, the questions deserve answers.

How many American applicants applied? How many were interviewed? How were applicants selected? And what role did VISA sponsorship play?

Before we can answer those questions honestly, we need to understand three things: 1. How residency selection works; 2. How H‑1B and J‑1 differ; and 3. What the numbers actually tell us.

A country concerned about having enough doctors should also be concerned about whether qualified Americans have a fair opportunity to complete their training.

Keep reading

“Are You An FPV Pilot”: Pentagon Calls On Drone Operators For Next “Gauntlet” Showdown

The Department of War has put out a request for service members with “FPV experience” to participate in testing events called “Gauntlets” and fly Category 1 drones in field training exercises to accelerate drone development and prepare the US for the next conflict, where drones, robotics, and automated kill chains dominate the modern battlefield.

“Are you an FPV pilot? We want to hear from you!” DoW asked on X on Friday morning.

“The Drone Dominance Program is recruiting service members with FPV experience who would like to be considered as pilots for future Gauntlets and related efforts,” the request said.

The Drone Dominance Program is the DoW’s answer to purchasing large quantities of drones across every category, from 1 to 5, and building out a domestic supply chain of components free from dependence on conflict areas and countries such as China, which can easily weaponize supply chains to hinder procurement.

Earlier this week, Defense Secretary Pete Hegseth revealed that Autonomous Warfare Command, dubbed “AutoWarCom,” is set to accelerate the DoW’s purchases across all categories of drones, robotics, and AI.

What’s key is that drone procurement will be a massive part of the rearmament supercycle and provide tailwinds to drone companies, such as heavily shorted Ondas, whose Ultra drone could very well see ramped-up orders by the military as it’s seen as an MQ-9 Reaper alternative for ISR missions. 

“Once we apply sustained budget to changed doctrine, we will outperform the world,” said Owen West, a former Marine, assistant defense secretary, and Goldman Sachs trader who has been tasked with leading the DoW’s Defense Innovation Unit. “And by snapping in AI, we will be ahead of the world, because we are the leaders in AI.”

Keep reading

Federal Judge Rules Warrantless Flock Search Unconstitutional After Deputy Pulls Month of Driver’s Travel History — Calls System ‘Indiscriminate Mass Surveillance’

A federal judge in Oklahoma just threw out a drug case after ruling that police violated the Fourth Amendment when they used Flock Safety’s automated license-plate cameras to pull a driver’s travel history for roughly a month, without a warrant, and without probable cause.

U.S. District Judge Sara E. Hill of the Northern District of Oklahoma ruled that Tulsa County sheriff’s deputy Freddie Alaniz conducted an “Unconstitutional Warrantless Search” when he queried Flock and other automated license plate reader systems on a Mazda SUV simply because it had a California plate.

According to 404 Media, the search returned more than 50 records of the driver’s whereabouts across the country. Hill suppressed the Flock records and everything that came out of the later search of the vehicle.

The defendant is Melisa Kyle, 46, of Crane, Missouri, charged with possessing methamphetamine with intent to distribute.

According to Law Commentary, the case began in May when Alaniz, who also served as a DEA task force officer, was parked along Interstate 44, saw the California plate, pulled onto the highway, and started following the SUV.

He later stopped Kyle for changing lanes without a signal, then used the Flock history to question her about her travel and to justify searching the car.

Authorities said they found about 91 pounds of methamphetamine packed in luggage, marijuana, and roughly $7,000 in cash. Hill ruled the constitutional violation happened earlier, when the deputy reached into the historical location database.

Keep reading

Chainalysis Used Ai To Trace The $387m Bitget Hack Back To North Korea

In a recent blog post, blockchain analytics firm Chainalysis attributed the $387 million theft from cryptocurrency exchange Bitget to North Korean state-sponsored hackers. The firm used a combination of its’ AI-powered cryptocurrency analysis and its’ traditional investigative methods to track the stolen funds, moving them across multiple blockchains. Importantly, although the firm used technology to enhance the analysis of the data, it was human investigators who ultimately attributed the theft and controlled the output of their analysis.

After the breach, the attackers had been using more sophisticated techniques for laundering the stolen assets, spreading them through cross-chain liquidity protocols, messaging platforms, instant swap services, as well as specialized laundering infrastructure. The scale of such attempts highlights the attackers’ high level of experience in managing a large-scale cybercrime operation and in evading detection by blockchain forensics experts, writes Decrypt.

Stolen XRP was handled differently by the hackers and after some time it was converted into Bitcoin through cross-chain liquidity protocol and then extracted from the pool on the other side of the trade. This cross-chain arbitrage was used by hackers not only to convert very traceable asset into something else but also to make it as anonymous as possible by hopping from one protocol to another. The activity of extracting tens of millions of dollars in assets through this method took approximately 36 hours.

We previously highlighted that the attack bore similarities to past attacks conducted by DPRK cyber crime operators, as identified by Bitget CEO Gracy Chen. Blockchain analytics firm Elliptic also assessed the involvement of North Korean cyber crime operators in the theft to be “highly likely”.

The money laundering activity is very transparent and is being carried out on public blockchains. The attacker moved parts of the funds to Zcash’s shielded pool in order to use the privacy features. However, how swap services react to these transactions varies greatly. Near Intents for example rejected over $50m in hacker-linked transactions. They got hacked days later though. Thorchain on the other hand continued to process the suspect transactions.

However, stablecoin issuers such as Circle and Tether were able to prevent $318,000 in stablecoins that were siphoned off in the hack from entering circulation. The move highlights the power of centralized control of widely held stablecoins even as the broader decentralized trading environment continues to facilitate hacker activity.

Keep reading

‘Session Keys Stolen’ – Hackers Steal Claude Tokens From Paying Subscribers

Hackers have been ‘draining’ usage tokens from the accounts of Paying Subscribers of Anthropic’s Claude AI large language model by hijacking their login sessions to the platform, reports TechCrunch.

The phenomenon came to light when independent AI consultant, Grant De Swardt, noticed that although he had not been using Claude (on a paid-for ‘Claude Max 20x’ plan) on a particular day, his token usage had increased on that day. He notified Anthropic of the issue the following day and, after the company had suspending his paid-for account and, in the words of De Swardt, ‘invalidated all sessions and server-side Claude Code tokens’, issued a partial refund of £44.49 (half of the remaining portion of the subscription cost of $200 per month for Claude Max 20x).

De Swardt was advised by the company that, after investigating the unusual activity, that a compromised Claude session key had been used to generate ‘unauthorized Claude Code OAuth tokens’. In essence, his Claude account had been used by an ‘unauthorized third-party service’ that happened to have been processing activity for other people as well. De Swardt, who raised the issue on Reddit, was unable to establish how the ‘hacking’ had taken place although the evidence was consistent with either ‘stolen credentials or session data’ or ‘connection to an external service’. In the interim, other users came forward on the same Reddit thread to report similar issues with Claude.

One reported that his account had been ‘auto-upgrade[d] without consent’ and ‘charge[d]’ in the process – with the resulting usage suddenly jumping from 0% to 100%. Another reported that, within 12 minutes of using Claude to enter a few prompts and then conducting a simple web search, his account’s usage had suddenly shot up from 0% to 49%. And a third – who had found that his account had ‘exhausted its maximum daily tokens for three consecutive days with no activity’ – raised the matter via a GitHub issue.Anthropic eventually sent an email to some of the affected users – including the party who had discovered that his account had ‘sprinted’ through its maximum daily allowance of tokens over three consecutive days while he was doing nothing with the service – warning that a ‘bad actor’ was using ‘infostealer malware’ to ‘steal logged in Claude sessions from user computers and then drain tokens from their accounts’.

The company emphasized that the malware in question does not come from Claude itself and can be contracted from a variety of online sources including, by way of example, via ‘downloader[ies] infected with the malware’ and ‘ads infected with the malware’. In those circumstances, Anthropic explained that, in order to protect the affected users, it had signed them out of Claude, ‘Rejected all Authorizations for those sessions’, and issued refunds to those users deemed to have been affected.

Keep reading

Far-left French mayor says ‘violence can be legitimate’ as schools burn

At Lycée Léonard de Vinci, a high school in Roubaix, the front door burned while teenagers filmed on their phones. In Nantes, the entrance hall of Lycée Nelson-Mandela was gutted. In Lille, masked men in black kicked a chemistry teacher in the back and chased him down the street. In Marseille, Reuters reported, the principal of Victor Hugo high school was doused in petrol.

On Wednesday, Sept. 30, alone, 356 high schools were blockaded. Police made 625 arrests, about two-thirds of them minors. Eighty-three police officers and gendarmes were hurt, along with 119 students and staff. Île-de-France put school damage near €1 million, including more than €100,000 at Lycée Paul-Éluard in Saint-Denis.

There are real grievances about schools in the region. In the Créteil school district, classes have 32 to 35 students, and teachers go missing. But overcrowded classrooms do not explain masked operators moving from school to school. Interior Minister Laurent Nuñez described troublemakers travelling between campuses to incite violence. And yet Jean-Luc Mélenchon, leader of the far-left La France Insoumise party, called the students “harmless.”`

The unmasked face of the week was Bally Bagayoko, 53, mayor of Saint-Denis, elected in March with 50.77 percent for La France Insoumise. He showed up at the gate of the blockaded Lycée Paul-Éluard beside a burning dumpster, laughing and handing out high-fives as teenagers cheered. Since then, he has denied lighting anything and calls the viral framing “fake news.”

What he said on camera the next day is not in dispute, and prosecutors are now investigating it: “Violence can be legitimate, but whenever you can avoid it, that is better.” He called the students children with a right to make mistakes, then told a reporter, “If I slap you, you’re going to react.”

The same day, students surrounded a BFMTV crew, roughed up two journalists and forced the crew out under escort. A girl on camera called BFM a “racist” outlet. The mayor posted three words: “Elle a raison !” She’s right.

Paris police prefect Patrice Faure referred Bagayoko to prosecutors under Article 40 for incitement to commit a crime. Emmanuel Macron said no politician may legitimize violence. Nuñez said violence is never legitimate. Valérie Pécresse said she would send Paul-Éluard’s repair bill to the mayor’s city.

Keep reading

Burchett Plans to Block Socialist Chevalier from Congress over Flag Desecration Post

Rep. Tim Burchett (R-TN) said he plans to block New York Democratic Socialist Darializa Avila Chevalier from being seated in Congress if she wins the Nov. 3 election, citing a resurfaced post in which she said she wiped her hand on an American flag.

Burchett told the New York Post he intends to make the move when the new Congress convenes in January, using a simple-majority vote to prevent newly elected lawmakers from being seated before they take the oath of office.

The Tennessee Republican argued the flag comment is disqualifying for anyone about to swear the oath.

“You take an oath to uphold the Constitution, and and [sic] you’re pretty much disavowing it right there. I just think we’ve lost our compass,” he said.

Burchett called the comment an affront to his own family’s military service. His father was a World War II Marine, and his maternal uncle, Roy Hicks, was wounded shortly after D-Day battling German forces in the Normandy hedgerows. The congressman keeps the flag that covered Hicks’ coffin in his Knoxville office.

“I’m looking at a 48-star flag that hung on my uncle’s casket and [he] died fighting the Nazis, and then see somebody going to get elected to Congress in New York who said they use that flag for a napkin,” he said.

Burchett said he will offer the motion whether Republicans hold the House or fall into the minority. The congressman flew with President Donald Trump on Air Force One to Tennessee last week.

Chevalier, who faces Republican Jomo M. Williams in the general election, made the comment in a December 2019 post on X that has since been deleted: “I forgot to get napkins so I just wiped my hand on the American flag behind me.” She later said she regretted it.

The 32-year-old Democratic Socialist upended five-term Rep. Adriano Espaillat in the primary for the 13th Congressional District, covering northern Manhattan and the western Bronx, after an endorsement from New York Mayor Zohran Mamdani. She co-founded a group that once described itself as “fighting for the total eradication of Western civilization,” and maintained a deleted account that hyped communism and Marxism. Asked whether she is a communist, she said, “I’m not. I’m a democratic socialist.”

The plan faces long odds. GOP operative John Feehery, a former senior House leadership aide, said the chamber could not function under such a standard.

“If we refused to seat folks in Congress who said things that we strongly disagreed with, nobody in the House would be seated,” Feehery said.

The Constitution makes each chamber the judge of its members’ elections and qualifications. The Supreme Court ruled in 1969 that the House had exceeded its authority in excluding Rep. Adam Clayton Powell (D-NY), who had been duly elected and met the constitutional qualifications for office.

Keep reading

California Man Accused Of Routing More Than $300 Million In Restricted Servers To China

A California man has been arrested on federal charges accusing him of helping route more than $300 million in export-controlled computer servers to China through Malaysia and Singapore.

Greg Lui, 38, also known as Yiu Kong Lui, of San Gabriel, was arrested Oct. 1 after a federal grand jury returned a three-count indictment two days earlier.

Lui was the chief executive officer and owner of Earthmade Computer Inc., a company based in City of Industry, California, and established in November 2023. He was also the registered agent of another company, Coindigger, that did business as Earthmade.

Earthmade has not been charged in the case. The company did not respond by publication time to a request for comment.

Lui is charged with conspiracy to violate U.S. export-control laws, outbound smuggling, and conspiracy to commit money laundering. Prosecutors allege payments from Malaysia flowed into Earthmade’s U.S. bank accounts and were then used to buy restricted servers from American manufacturers.

Prosecutors allege the conspiracy began no later than October 2023 and continued through at least Aug. 12, 2026. The indictment’s detailed transaction examples are concentrated in 2024, when Lui and others allegedly bought high-end computer servers and graphics processing units, or GPUs, from U.S. manufacturers and routed them through Malaysia and Singapore before they ultimately reached China.

Keep reading