Jason Carlton

In the current automotive ecosystem, the trend of pairing mobile devices to connected vehicles is gaining momentum, providing a vast number of benefits such as hands-free driving and remote vehicle control. However, along with these conveniences arises the issue of data accumulation, ranging from vehicle diagnostics to personal identifiable information (PII). The problem emerges when a consumer rents a vehicle, pairs their mobile device to the infotainment system, and neglects to remove their device prior to returning the vehicle. This oversight can potentially expose vulnerabilities with the current renter’s PII for subsequent renters to exploit. Research indicates that renters often overlook the deletion process prior to returning the rental vehicle and are unaware of whose responsibility it is to perform this task. In this survey, we investigated the experiences and perceptions of a group of consumers who have previously rented vehicles. We wanted to know if the participants were aware they were responsible for deleting their mobile device from the rental vehicle before returning it, the renters’ importance and tolerance for risk if they overlooked the deletion process leaving their shared data on the infotainment system for subsequent users, and if they were aware who was responsible for deleting their shared data. Lastly, we explored if the participants supported an automated solution to perform this manual deletion process. The goal of this paper is to demonstrate the significance of safeguarding PII in connected vehicles and advocate for the adoption of an automated solution to mitigate this privacy risk.

The integration of connected autonomous vehicles (CAVs) has significantly enhanced driving convenience, but it has also raised serious privacy concerns, particularly regarding the personal identifiable information (PII) stored on infotainment systems. Recent advances in connected and autonomous vehicle control, such as multi-agent system (MAS)-based hierarchical architectures and privacy-preserving strategies for mixed-autonomy platoon control, underscore the increasing complexity of privacy management within these environments. Rental cars with infotainment systems pose substantial challenges, as renters often fail to delete their data, leaving it accessible to subsequent renters. This study investigates the risks associated with PII in connected vehicles and emphasizes the necessity of automated solutions to ensure data privacy. We introduce the Vehicle Inactive Profile Remover (VIPR), an innovative automated solution designed to identify and delete PII left on infotainment systems. The efficacy of VIPR is evaluated through surveys, hands-on experiments with rental vehicles, and a controlled laboratory environment. VIPR achieved a 99.5% success rate in removing user profiles, with an average deletion time of 4.8 s or less, demonstrating its effectiveness in mitigating privacy risks. This solution highlights VIPR as a critical tool for enhancing privacy in connected vehicle environments, promoting a safer, more responsible use of connected vehicle technology in society.

With many Americans eager to resume travel after prolonged restrictions from the coronavirus pandemic, car rentals are on the rise. According to Auto Rental News, “2021 U.S. Car Rental Revenue Climbs 21% Year-Over-Year” (Brown, 2021). In conjunction with increased car rental, and associated travel, we can expect to see an increase in cyber security and data privacy attacks. In the digital age, enterprises have a responsibility to protect consumers’ personally identifiable information (PII). As it pertains to rental vehicles, when consumers connect their mobile devices to a rental vehicle’s Entertainment and Infotainment System or utilize the built-in navigation feature, they do so, unbeknownst to themselves that the information from their devices is transferring to the vehicle, where it will remain, unless properly expunged from the system. A large majority of consumers are blissfully unaware that their PII is being stored, and how easy it would be for an adversary to potentially breach their data security and privacy. To expand upon this hypothesis, I conducted a further investigation on the subject, by partaking in the rental of three different vehicles, each belonging to a different manufacturer (Nissan, Chrysler, and Maserati), from three different vehicle rental companies (Enterprise, Hertz and Turo). I then, as a consumer, tested my hypothesis to determine if, I was able to easily breach the prior consumers’ data security and privacy by viewing devices that had previously connected to the vehicle, as well as any of the previous consumers’ personal information. The results were undeniable; the PII of the previous consumers is not protected.

The integration of connected autonomous vehicles into the transportation system introduces significant enhancements in driving experience and convenience. Yet, it simultaneously raises important concerns regarding the security and privacy of passenger data. As individuals increasingly depend on these connected vehicles, particularly rental cars with advanced infotainment systems, safeguarding their personal information becomes a paramount imperative, presenting significant challenges that must be addressed to maintain user trust and comply with privacy regulations. This paper investigates risks associated with personal information stored in connected vehicle technology, emphasizing the importance of robust security and privacy practices. In the advent of cyber threats and the need for data protection, we examine a risk management framework (RMF) as suggested by NIST, which aims to address these quintessential concerns preemptively. Our research moves beyond the limitations of manual safeguarding methods, supporting the necessity for an advanced automated technical solution. To address these issues, we introduce and meticulously assess the efficacy of “Vehicle Inactive Profile Removal” (VIPR), an innovative technical solution conceived to actively eliminate the risks and potential oversights that stem from the prevalent tendency of renters to leave personal data unerased in the infotainment systems of rented connected vehicles. We provide a thorough evaluation of VIPR through various scenarios, including vehicle return to a rental depot, subsequent rentals, and ridesharing contexts. Our proof of concept includes an array of experiments to demonstrate how VIPR proficiently and autonomously removes previous renters’ “Inactive” profiles from a simulated infotainment system. The results highlight how VIPR constitutes a critical step towards enhancing the privacy and security of personal data, thereby promoting a safer, more responsible use of connected vehicle technology in society.

With many Americans eager to resume travel after prolonged restrictions from the coronavirus pandemic, car rentals are on the rise. According to Auto Rental News, “2021 U.S. Car Rental Revenue Climbs 21% Year-Over-Year” (Brown, 2021). In conjunction with increased car rental, and associated travel, we can expect to see an increase in cyber security and data privacy attacks. In the digital age, enterprises have a responsibility to protect consumers’ Personally Identifiable Information (PII). As it pertains to rental vehicles, when consumers connect their mobile devices to a rental vehicle’s Entertainment and Infotainment System or utilize the built-in navigation feature, they do so, unbeknownst to themselves that the information from their devices is transferring to the vehicle, where it will remain, unless properly expunged from the system. A large majority of consumers are blissfully unaware that their PII is being stored, and how easy it would be for an adversary to potentially breach their data security and privacy. To expand upon this hypothesis, I conducted a further investigation on the subject, by partaking in the rental of three different vehicles, each belonging to a different manufacturer (Nissan, Chrysler, and Maserati), from three different vehicle rental companies (Enterprise, Hertz and Turo). I then, as a consumer, tested my hypothesis to determine if, I was able to easily breach the prior consumers’ data security and privacy by viewing devices that had previously connected to the vehicle, as well as any of the previous consumers’ personal information. The results were undeniable; the PII of the previous consumers is not protected.