Audio version narrated by an AI voice.
Need To Know
Chinese EVs are becoming too good to dismiss simply because they are Chinese. Cameras, microphones, location data and permanent connections also make modern cars remarkably capable mobile sensor platforms. Australia needs to settle who can see, hear and reach into them before these cars become ordinary daily drives.
———
Compelling cars, clever technology and one nagging question about who might still be connected.
⸻
I’m warming to Chinese electric vehicles, but one niggling doubt refuses to leave me alone: could the terrific new daily drive in my driveway also become a bloody capable mobile spy station if the wrong people ever gained access to it?
Chinese manufacturers are making that uncomfortable thought harder to avoid because some of their cars are seriously tempting. BYD and XPeng have caught my attention, while the Deepal E07 Multitruck in particular shows just how differently Chinese manufacturers are thinking about what a vehicle can be.
Sharp prices got our attention, but increasingly the attraction is clever technology, generous equipment and vehicles that deserve to be judged on what they actually offer. Monday night’s ABC Four Corners Asleep at the Wheel did not suddenly alert me to the security question because I have been worrying and writing about it for some time.
Four Corners instead put fresh evidence around an old concern just as Chinese EVs are becoming harder for people like me to resist.
Cybersecurity expert Dan Hreszczuk hacked a BYD Shark 6 and remotely messed with several vehicle functions, although he could not control critical systems such as the brakes. More revealingly, an XPeng insider did not need to hack anything because authorised access let him see live information from a vehicle in Australia. Four Corners also obtained logs showing software packages being pushed from China to XPeng vehicles here, which exposed something much bigger than another story about hackers.
Your car can talk to them, and they can talk back to your car.
Mostly, that is exactly what we want because the connection gives us clever features, remote controls, vehicle tracking and software updates. Australian cyber-security guidance says connected vehicles can collect and transmit images, audio, location and other data, while connected services can remotely access cameras, microphones, locks, engines and vehicle information.
A hacker has to find a way into those systems, while somebody legitimately administering them may already have access by design. Cybersecurity worries about somebody breaking through the window. My national-security niggle starts with asking who already has a key.
Buying the car does not necessarily end the manufacturer’s relationship with it.
I have been pulling at different parts of this problem for some time, from Chinese EVs turning price into a security test and the national-security implications of connected Chinese vehicles, to the wider fight over Australia’s EV transition and the second price behind the Chinese-car bargain. Four Corners did not change my question, but it helped make the machinery underneath it easier to see.
Home Affairs already has a framework for looking at foreign ownership, control or influence over technology vendors. Its guidance recognises that foreign governments can potentially use ownership, domestic laws or other influence to compel vendors to act against Australian interests. None of that proves BYD, XPeng, Deepal or another Chinese carmaker is doing anything nefarious, but it does mean wondering who sits at the other end of the connection is hardly tin-foil-hat territory.
Scale makes my niggle harder to shrug off because one Chinese EV sitting in a driveway is somebody’s new car, while hundreds of thousands of them become cameras, microphones, location sensors and computers moving around Australia. Many may still depend on common software, cloud services and manufacturer systems somewhere else.
Software adds another twist because the car you buy today does not have to remain exactly the car you bought. Remote updates can change features after it leaves the showroom, so Australia needs to understand not just what rolls off the ship but what the connection behind it can see, send, receive and change later.
Four Corners also stumbled across an almost absurd example of how easily our old labels can fool us.
Chinese-made Dahua surveillance cameras were removed from Commonwealth sites after security concerns, yet Four Corners found Dahua cameras inside Leapmotor vehicles. I came at the same problem from the opposite direction when I wrote Your Security Camera May Be Pointing Both Ways.
A security camera is no longer just a lens under the eaves, and a modern car is no longer just wheels, seats and a steering wheel. Put a Chinese camera on a sensitive government building and people immediately see a possible security issue. Put cameras, microphones, location tracking, internet connectivity and remotely updateable software inside a shiny new car and most of us start comparing range, leather seats and cupholders.
Same digital-age problem, different box around it.
I don’t want Chinese EVs banned or demonised because somebody mutters “China”. I want Australia to find out exactly what these cars can collect, where that information goes, who can get at it and what they can remotely control.
Good answers might actually make me more comfortable buying one because connected-car risks are not uniquely Chinese. Sensible scrutiny beats both hysteria and pretending there is nothing worth worrying about.
I’m warming to Chinese EVs because some are becoming bloody compelling daily drives, but I want that niggling mobile-spy-station doubt properly answered before millions of Australians park one in the driveway.
Could you comfortably buy a Chinese EV today, or does the national-security niggle still bother you? Tell me what would settle it in the comments.
My writing stays free. If you’d like to help keep it going, you can support it here.