Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Volkswagen tracking firm sued for refusing to find stolen SUV with kidnapped boy (wgntv.com)
49 points by likeabatterycar on Nov 16, 2023 | hide | past | favorite | 40 comments


> the deputy was informed that the vehicle’s free trial period for the Car-Net services had expired and that a subscription of $150 was required before the location of the vehicle could be provided.

> In a statement released last February, Volkswagen said it has a procedure in place with a third-party provider for Car-Net support services to help with emergency requests from law enforcement.

> “Unfortunately, in this instance, there was a serious breach of the process,” the statement read. “We are addressing the situation with the parties involved.”

So the refusal was at a first glance a humam error rather than company policy regarding sharing of private data with authorities.


A policy does not exist if you don't build and maintain the systems to effectively follow it.

Multi-billion dollar companies need to be held to higher standards than "we got a piece of paper around here that says we won't do that"


Seems like that's how we get Google, though. They've eliminated human error by eliminating humans who can make decisions. I can't say for certainty that's any better.


I lost my Jeep a few years ago downtown after a parade. Wandered for blocks and blocks looking for it down streets that looked exactly the same.

Had an epiphany, opened my Uconnect app and called to restart my GPS service and they wouldn't do it. Or they said if they did it wouldn't find it that night or something. I forget exactly what it was, maybe the Jeep had to be turned on or it was just a 24 hourish delay. I just remember getting annoyed and walking for another 45-2hrs until I finally found it.

This was before google/apple maps had the parked here feature.


The flip side of this story is someone like an abusive spouse social engineering a car tracking firm with a story like this and then using the data to track the car's occupant with tragic results.

You just can't win.


The only way to win is to not play.

Stop putting tracking devices that you control in other people's vehicles, if you don't want the liability of it.


If there is no tracking then doesn't the boy being kidnapped lose?


No. There wasn't tracking in this case.

This is the same sort of argument used to get rid of encryption, among many other privacy invasions.

If you want to put a tracker in your car, that's up to you. Should the federal government mandate trackers in every car so they can always find any vehicle?

"Think of the children!"

I am thinking of the children. Having some semblance of life outside of Big Brother's watchful eye is essential for the children.


> Should the federal government mandate trackers in every car so they can always find any vehicle?

This is a red herring. The federal government doesn't mandate this. You said "if you want to put a tracker in your car, that's up to you." People are choosing to put trackers in their cars.

Honestly, as someone who is fairly strict on matters of privacy, I'm fine with a tracker in my car. I don't drive it that often. And when I do, it's around town.


No. They aren't. VW is. And VW, not the owner of the car, is controlling that tracking.

I'm arguing against a comment that implied tracking is good, even if it is controlled by others, because it might save a child. The best version of such a system is if it is owned by the government, not some company trying to make money off of it, so that's the version I decided to argue against.

That's not a red herring. It's steelmanning.


> They aren't. VW is.

A private company. From whom a person decided to buy a car. Hyundai, Kia, Mazda and Nissan make cars without trackers or even GPS. That's obviously not most consumers' preference.

> best version of such a system is if it is owned by the government

I strongly disagree. That said, if someone wants to install a government tracking device on their car, I suppose I'm not against it. (Didn't you start by arguing against mandated surveillance?)


Kias get stolen so often you can't insure them in some places; hyundai's have that "catch on fire spontaneously" controversy, and that steel shavings in the engine problem; nissan has their infamous CVT transmissions. I don't know much about mazda.

It's hard to find a reliable car. Last time I dug into the subject it was a stress-nightmare


Honda and Toyota are the canonical reliable cars, I thought that was well-known, so not sure how finding a reliable car is difficult. I associate Kia and Hyundai with inexpensive, so that wouldn't be my first choice for reliable. (My two Hondas have been fantastic. I bought my Honda Fit used, and from 75k miles to 150k miles I have had no problems at all, no maintenance required besides oil changes. (I suspect the clutch is going to need to be replaced soon, though.)


> Didn't you start by arguing against mandated surveillance?

Yes. That’s the point of steelmanning. Put forward the best argument of your opposition. Then tear it down.


Just require police presence. Pretty easy to get around. Use third party aka police to verify validity.

The firm involved in this should have its board thrown in jail (vw and their contractor). Holding investigative information related to a crime hostage to a fee is criminal enough. Board members and managing directors should cop jail time. Basically anyone from the point of command who said "no! pay up" north. jailtime.

But provisions protecting consumers from companies is weak so unlikely to happen.


In the article:

> the family claim Volkswagen refused to assist authorities

An abusive spouse wouldn't usually ask the police to track someone down. I also assume the request was off the back of an official missing persons/kidnapping charge.

Also, parents of a child would have rights to the location of their children a spouse or partner wouldn't, outside a missing persons report.


There are people who register domains like polizei-dortmund.nrw, set up a reverse proxy to a real police site, and set up a email server. Then, they send an official looking mail to discord.com‘s support with some made up emergency, like the person behind account X is a suicidal, depressive teen and one of their online-only friends reported to us (the police) that he intents to end his life. Then, discord instantly gives us the IP and even address (if they had purchased nitro), and we got that person doxxed.

This is a service available on the obvious scene boards. It’s classic social engineering, and I bet it works for these car tracking services too.


That's called impersonating an officer and is wholly illegal af. Those services whilst available are asking for a knock on the door from folks way nastier than your local cop shop. Rip. That's got state entity attraction written all over it.


Process to verify law enforcement officials are easy to create and use if people are competent.

The main issue I'd be concerned about are LEOs (or other government actors with access to LEO databases) abusing that system.


Failing to work with police is a bit different. To be fair VW say they have a process and it wasn't followed (by them), which may well make them liable or not.


Holding information that is integral to a criminal investigation hostage to a fee. That's criminal af.

Jailtime should be the only answer.

Legit I'm gonna crack a bottle of champagne the day that holding companies criminally liable for their criminal acts becomes the norm. Remember if it's punishment is only a fine not jailtime its a law for the poor.


“Unfortunately, in this instance, there was a serious breach of the process,” the statement read. “We are addressing the situation with the parties involved.”

I'm very curious what the process is. Can anyone call up the main support line and say they are law enforcement? Or is there some special number and then some way the caller can identify themselves as law enforcement. e.g provide a one-time code that is pulled up from some app in their squad car.


Usually when I have dealt with these sorts of requests, the way we verified they are legit law enforcement was by asking what department they work for, and then independently finding the number of that agency and verifying their badge number. It added time to the process but we wanted to protect our users as much as possible.


So anyone with a name and badge number of an officer could impersonate one?


Only if they could also control the phone number we would find for that law enforcement agency. We would call them back through the number we found independently by calling the switchboard and asking for that officer/badge number.


Normally there's a "call back" procedure, where someone can verify the law enforcement number and hang up and call back, or similar.

In reality social engineering is a thing. Likely you need to get past the first-line support to someone who has authority.


https://archive.is/5tCup

article not available in VW country


> Attorneys for the family claim Volkswagen refused to assist authorities in tracking the car until payment of their tracking system was paid and activated.

Considering all news is engineered for maximum outrage, I wonder what the reality of the situation is from VW's side.

Did Volkswagen refuse to assist, or was compliance not possible because the tracker wasn't active due to nonpayment?

If the tracker wasn't active, it's unsettling that it could be activated with an exigent-circumstances request. Those don't even need a warrant.

But if they had the data and refused to share it, VW was rent-seeking during a fucking hostage situation involving a baby. I don't put anything past anybody but that seems too monstrous to believe.

VW continues to eat shit for the emissions scandal, but the media has historically been way more dishonest than VW.


That's what I thought. For my car, I had to take it to a dealer to activate tracking. I paid online that gave an activation code but it needed a dealer to physically enter the code and activate it. Remotely activating it when tracking is disabled seems scary really.


VW ended up making Car-Net free for 5 years in response to this incident in March - https://electrek.co/2023/03/07/vw-car-net-free-for-5-years-c...


Not quite compatible with the Unfortunately, in this instance, there was a serious breach of the process. Why just not fix the breach, unless there wasn't a breach in the first place.


> Volkswagen said it has a procedure in place with a third-party provider for Car-Net support services to help with emergency requests from law enforcement.

> “Unfortunately, in this instance, there was a serious breach of the process,”

Outsourcing support to third party call centers is a bad idea for anything important.


No, it's great! That way when something terrible happens, it's not VW's fault.


Judge: "So any errors would not be my fault, if I outsourced my decisions on this case to the Plaintiff's law firm?"


Have you seen VWs in car software? They should definitely outsource.


It is pretty bad, I suppose a third-party call center might be able to make better software.


Before I could even finish reading the final paragraph of the article it seems like some kind of javascript noticed I'd scrolled to the end and promptly loaded an entirely new article automatically.

Christ.


It's the classic problem: you have a system that's useful in the 1% case but not in the 99% case. Over time, normalization of deviance causes you to extract functionality from the system so that it responds to the 99% case 100% of the time. When that 1% occurs, your thing breaks.

Obviously the call center did this. Pretty typical.

In any case, I have an Airtag in my car. It's pretty good. Maybe I should just wire in an old iphone on a data SIM.


Perhaps it will be good that vehicle manufacturers consider the risks of putting tracking devices in cars that only they can control.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: