Researchers find mountains of sensitive data on totalled Teslas in junkyards

Teslas are incredibly data-hungry, storing massive troves of data about their owners, including videos of crashes, location history, contacts and calendar entries from paired phones, photos of the driver and passengers taken with interior cameras, and other data; this data is stored without encryption, and it is not always clear when Teslas are gathering data, and the only way to comprehensively switch off data-gathering also de-activates over-the-air software updates for the cars, which have historically shipped with limited or buggy features that needed the over-the-air updates to fix them.

Tesla has a history of being secretive about the data its cars collect, fighting customer attempts to recover data from their cars, and selling a special cable needed to access limited car telemetry for $995. Tesla employees told CNBC that the company uses telemetry to secretly identify Tesla owners who tinker with or investigate their cars, and flags them for late software updates.

Two pseudonymous security researchers called GreenTheOnly and Theo recovered "hundreds" of wrecked Teslas from scrappers and junkyards and systematically investigated the data left behind on the cars. Much of the data that these junked Teslas store is not unique -- other manufacturers' "smart" car systems store mountains of driver data in the clear (this is especially a problem for rental and fleet cars, which harvest data from many different drivers). But Tesla does store more data than its rivals, and goes further than other manufacturers in disincentivizing independent security research through its alleged blacklisting system; the fact that Tesla also operates a robust bug bounty system reveals a deep ambivalence about independent scrutiny about its products. Read the rest