BYD investigating hacking concerns as it calls for new connected vehicle legislation in Australia

BYD Australia has confirmed it's actively working to address concerns over the security of its vehicles, following recent reports documenting vehicle hacking and the in-car security protocols of Chinese manufacturers.

"BYD Australia takes vehicle security very seriously for its customers and all road users. We are taking full and immediate action in reviewing alleged claims made in the Four Corners program relating to unauthorised remote access of certain non-critical vehicle control functions," said BYD Australia chief operating officer Stephen Collins in a statement to CarExpert.

"We will respond in detail once we have completed our investigation. The safety of our customers and all road users is our absolute priority.”

BYD's internal investigation comes after a report from the ABC’s Four Corners program, which exposed the vulnerabilities of modern connected vehicles. It made an example out of BYD and Xpeng, given their recent rise as part of an ongoing onslaught of Chinese manufacturers in Australia.

On the program, a cybersecurity expert demonstrated how he could remotely access a BYD Shark 6 while it was being driven and eavesdrop on phone calls, track its location, and even turn off its headlights.

However, it should be noted that this was done after the expert had spent two weeks hacking the plug-in hybrid (PHEV) ute; he had not gained remote access spontaneously.

The Four Corners report also raised concerns over the protection of customer data.

“An electric vehicle made by a company headquartered in China is subject to the laws of China, and particularly the national security laws, which oblige them to assist China's intelligence agencies,” Shadow Minister for Defence James Paterson told Four Corners.

“So, a connected EV vehicle from China is the highest-risk product in the marketplace, and right now there's nothing that says to that brand what data you can collect on Australians, how it can be stored, when it can be transmitted.”

In response, Mr Collins said, “BYD Australia notes concerns raised about connected vehicle data security in Australia. Personal data generated by BYD vehicles in Australia is stored on Australian servers."

"We have publicly called for purpose-built connected vehicle legislation in Australia – a clear, enforceable standard applying equally to every brand in this market.

"We welcome that scrutiny and would comply fully with any such framework.”

BYD Australia says it won't offer any further comments on the matter until its internal investigation is complete.

Until a recent update to its privacy policy – which the ABC says was made within hours of the company responding to its questions – BYD’s fine print said: “We may collect, hold, use and disclose your information for the following purposes: through surveillance activities undertaken to assist in the protection of people, property and company assets and resources (including ICT assets), information which may also be used to gather operational data, in connection with suspected illegal or improper activities and as part of disciplinary investigations.”

The privacy policy on BYD’s website was subsequently replaced with a more limited one covering only customer data transmitted via the BYD website, and not via the vehicles themselves.

MORE: 'Urgent' calls for greater transparency on data collection following report on Chinese car hacking
MORE: Explore the BYD showroom