Researchers drove a NIO ES8 electric SUV deep into a Norwegian underground mine specifically to sever its external connections. The car kept attempting to reach servers, most of them located in China. These findings echo broader concerns about hidden data collection, similar to how a surveillance app was built to covertly target users without their knowledge.
That finding sits at the center of Project Lion Cage, a multi-year study initiated in 2022 by Tor Indstøy, a risk management and threat intelligence executive at Telenor Group. Indstøy purchased the NIO ES8 as a dedicated research platform.
The project arrives as Chinese EV brands expand across European markets with assurances about local data processing. Observed network behavior appears to contradict those assurances.
My Chev calls the US!
Why on Earth wouldn’t it keep trying? That’s how signals work. If my router goes down my computer is going to keep trying to connect to it even though it’s off. That’s not fucking news.
Thank you!!!
Yeah, I had the same thought when reading this
What a weird article
My assumption would be that they drove the car into the mine to see what would (or wouldn’t) work if the vehicle was cut off from the mothership. My hunch is they didn’t really find anything of interest so this is what gets reported.
Also all us cars do the same thing and I would much rather have my data in China than the US.
If I’m reading correctly, they specifically tried to stop it from doing so and even in what is essentially a faraday cage it keeps trying to link with Beijing to spill the tea, not exactly what you want if you “own” a product
Yeah, and that’s how connections work.
It doesn’t specify in the article if they toggled the WiFi switch off in the OS, one would assume they did before driving it into a mountain.
If so, not cool to keep calling home. If not, PEBKAC error
Somebody smarter than I will definitely delve into the guts of incoming Chinese EVs and figure out what part(s) to strip to stop this…
And if you’re in America and you have an EV, it’s statistically likely to be a Tesla. Tesla has starlink compatibility baked into their cars too and you’d better believe that sweet juicy data is being shared around.
If I was stuck with a Tesla against my will, I’d at least try the same thing for it, too.
Step 1: make a PiHole
Step 2: examine every thing the PiHole blocks from calling home
Step 3: research small holdings
Step 4: throw it all out and go farm Llamas
Seriously, I own a Firestick as a jellyfin client. It’s network access is limited to local only. Anyway, here’s one entry from that Firestick on one PiHole:
global.telemetry.insights.video.a2z.com 42590Number is the number of times my PiHole has smacked it down. One entry, from one stick, to one PiHole (I have a redundant one too).
My BMW checking if my bmw subscription is active when I’m trying to enable seat heater
I wonder what the security is like. I’d love to know how difficult it would be to set up a mock-service to just tell it you have everything.
You’d expect there to be encryption and some kind of certificate validation to check the response is trustworthy, but given what we now know about the CAN bus that many cars use, and how vulnerable it is to attack, it suggests the motor industry is way behind the times in terms of security.
It would just be easier to wire it directly to a switch.
Yeah, that’s the thing. It’s not like a transistor in a microchip or something; it’s a wire you can work with.
I bet BMW makes the disassembly needed an absolute pain, though.
The car kept attempting to reach servers
To the surprise of whom?
ANY device that relies on radio signal communication for any of its functionality, taken anywhere (underground mine, parking garage, Antarctica, Santa’s workshop, etc), and it’ll try to maintain it’s connections. That’s just what they do.
It would be extremely noteworthy if it stopped once it was out of range, because how would it know?
Okay, but China Bad
I would recycle all the CCP/PLA made buses until West Taiwan is Free.
Ah, because neither Google nor Apple track their users and would never, ever share said data with US (or other) agencies… right? RIGHT?
Sure. Don’t worry about this bad behavior, because others engage in it, and it’s not like anyone calls out US tech privacy issues. I struggle to imagine someone naturally reacting this way. Are you for real?
I agree it is something we should worry about and pay attention too, but just because something occurs doesn’t mean it was nefarious on purpose. Apple is better than many, but let’s say you have an iPhone. The iPhone is constantly reaching out and reporting it’s location to the findmy app that is only accessible by the users. If that phone is in a cave performing this test, it will be reaching out continuously similar to this car. Apple doesn’t sell that data, but where it becomes a breach of privacy is that if a judge gives a warrant, Apple has to turn it over. (So suddenly it isn’t only accessible to the user meaning verification is NORMALLY required to allow Apple to access the data, but they could bypass said verification.
So does that mean no one should ever enable find my on their devices… Maybe, but people weigh it against whatever they find useful about it.
I’d like to not be spied on. But if forced to choose, I would rather be spied on by a foreign goverment than a domestic one.
Why not both? You’re only choosing your data broker.
Why? At least with a domestic government you can vote and lobby for data controls. GDPR, etc.
I have Chinese manufactured IP cameras. they do not connect to the internet. yet, they still attempt to connect to Chinese servers at least once a minute.
this has been going on for at least 15 years.
I have an Chinese manufactured American developed phone. It connects to an American server frequently.
difference is, China has been caught multiple times creating backdoors into their hardware through software.
I guess that means America is just better at foreign espionage than China 🤣
they do not connect to the internet. yet, they still attempt to connect to Chinese servers
Via?
Can’t this be solved with legislation? I mean, all they have to do is say “no vehicles may be sold within our borders if they attempt to communicate with any servers.” Vehicles never did this 15 years ago and it’s insane they operate like massive phones with wheels now.
that would be the only sensible approach, but we all know it will never happen
China isn’t the only one
With all our formidable intelligence and NSA capability and massive massive funding, no one can tell whats in those communications after all this time huh. We even have physcial access to the devices and we still cant figure it out. Next time we are told the government needs to remove citizens constitional rights to privacy or needs us to use insecure encryption keys, we should all question what the hell for. And next time I hear “Israel helps us with our intelligence” I want to hear what they came up with in understyanding what chinese devices are sending home, or they can shut the hell up. So far all we seem capable of is spying on our own citizens, IF we all use insecure communications and allow our every movement in public to be videoed. I am not impressed.
or needs us to use insecure encryption keys
look up QWAC
And this is exactly why runor has it military installations in my country don’t allow EVs to enter at all.
No shit? A communist country that has more camera than people, tracks all communication, and blocks the Internet/all major apps from their entire countrys cars they manufactured track everything you do… I’m so shocked /s
These people that cry about wanting Chinese EVs in the US are the same people that cry when they have thermal runaway, no warranty, and are built cutting every corner possible. I fucking hate Trump, but in case in hate to say he’s right.
All of that has nothing to do with communism. China isn’t even communist.
Can we please stop telling tge rest of the world about what the PRC actually does. You are giving the rest of the governance in the world ideas.
