Dutch forensic lab says it has decoded Tesla's driving data

Could be used to calculate the price of your car insurance.

If the data is distinct enough, it could be used to identify the driver (with some degree of probability). It then could be shared with car insureres / law enforcement agencies / private investigators / random concerned citizens.

I'm not sure folks understand the comm arch in a Tesla. CAN probably still is the main way data are slogged around between ECUs (this info is five years old). CAN works by broadcasting data values at some periodic rate (1 PPS, 10 PPS, 100 PPS usually) and there is no 'publish/subscribe' except that all data are 'published' and any ECU can listen. What the other ECU does with the data, the originator doesn't know. If one of those ECUs listening is the 'gateway' then it can pluck off the main CAN bus anything it likes, and store it for as long as it likes, and upload whatever it wants. New GW FW can be OTA loaded to save and upload different types of data.

In Teslas, there are two main CAN busses: the regular one and the 'secure' one that does the brakes and other safety stuff. There is NO connection between the two; but there is a secured path where the gateway can listen & get data from the secure one. The point here is that vehicle safety CAN bus is likely unhackable remotely, as there simply is no RF path writing onto that bus. (all bets are off if you have the vehicle, physically). I believe all previous exploits have been fixed.

And one more thing: ECUs have some amount of on-board flash that is used during a crash/power loss scenario. The "dump important stuff to flash" CAN command causes the ECU to take an NMI-style interrupt and do it. Also, if the ECU's own power monitor notices the ECU is about to lose power, there is enough energy storage on board to operate for maybe a few hundred ms. The important stuff is saved.

Every ECU must have a way to OTA its code. E V E R Y O N E, including some door lock or whatever (essentially LIN to CAN gatewaying). There are no, as in ZERO, exceptions to this rule. (or, there weren't as of five years ago, ymmv)

Claim "legitimate interest", wait for someone to bother with a lawsuit, profit in the meantime for many years while the fine can be at most a few % (I think max 4%?) of turnover in a single year, and that's only if you lose badly.

Not saying this is actually illegal, just if it is then this is probably the reasoning. One could design a drinking game around illegal things that just nobody bothers to enforce. Related: https://en.m.wikipedia.org/wiki/Possession_is_nine-tenths_of... (basically it's up to the victim to bother with legal work and proving things)

No, stored data cannot be later used for any purpose.

In recent years there have been numerous laws and regulations passed concerning data rights and privacy. If you get consent for data usage in one way, but then use it in a way that differs with what the user consented to, that isn't in compliance with the law.

It would be fairer to say that even if the original company desperately had the desire to do so the legally required privacy compliance officer would reject their ability to do so. This is especially true at the bigger tech companies wherein they have things like external audits of their privacy compliance policies.

So why is it that so much of Hacker News as a community seems convinced that things aren't like this?

In the book Factfulness by Hans Rosling he talks about ten reasons that people get things wrong. One of them is that people assume that things stay the same rather than changing over time. One of the examples that he used for this is the widely held incorrect belief of a sharp distinction between third world and western countries. While there was once a sharp divide, the actual disparity greatly diminished. However, the legacy of that disparity continued to exist in the minds of people who weren't aware of the shifting distributions. As a result of these sort of shifting distributions one of the things he encourages in the book is regularly refreshing knowledge on a subject. I think something similar is happening here. A kind of nhilistic worldview in which things don't improve leads to people not updating their understanding of the world that changed in response to their frustration.

> How would it feel if there was data about a crash you were involved in that you could not get access to?

I'd be angry that data was recorded in the first place. No data should be recorded without the driver's explicit consent.