New car technology worries US privacy advocates

NEWS General Motors will begin installing new sensors and communications systems into vehicles next year that could save lives but might raise privacy concerns. At a news conference Wednesday, emergency medical doctors and highway safety advocates praised the GM's Advanced Automatic Crash Notification (AACN) as a life-saving system by the giant automaker. AACN is one of the car industry's most high-profile attempts to use telematics -- the emerging field of dashboard-embedded communication devices -- to help emergency dispatchers better understand the nature of an accident and determine what equipment or procedures medics might need to administer. "Imagine the outrage if a jetliner with between 100 and 200 people crashed every day," said Dr. Richard Hunt, president of the National Association of EMS Physicians, during a conference Wednesday at the New George Washington University Hospital in Washington. "Every day, that number of people die in car crashes, and this system holds the promise of decreasing that number. We look forward to working with GM to save lives." But privacy advocates and attorneys question whether the powerful system could become an agent for continual surveillance. Although drivers must agree to have the hardware installed and must pay $16.95 (£10) per month for service, privacy advocates worry that the data GM collects could fall into the hands of third parties that range from police or government agents to research firms trying to track consumer habits. Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, applauded GM for its effort to reduce car-related casualties. But he also said the technology could fall victim to "function creep" -- eventually morphing into a 24-hour surveillance system for authorities. "This represents a very significant opportunity to track people in their cars," Tien said. "I'd be concerned not only that GM could have to turn in historical data it has collected under a court order or subpoena, but also whether eventually cops could use this technology to tap into a car's signal in real time." GM executives insist that lawyers have carefully vetted AACN and they're betting that safety advantages will trump privacy issues for most consumers. Although the lustre has worn off the telematics concept since it was introduced in the late 1990s, GM has more than two million customers of its OnStar communication services, and the auto industry still perceives the niche as a lucrative source of new revenue. The first vehicles that will feature AACN as a standard feature will be higher-end models of the 2004 Chevrolet Malibu and TrailBlazer, GMC Envoy and Oldsmobile Bravada, which will hit showrooms in the US in the late summer or early autumn of 2003. GM will offer it as an optional feature on less expensive versions of those 2004 models. It also plans to offer AACN on the 2005 Saturn VUE sports car and the Chevrolet Cavalier. In the 2006 model year, GM will provide it as a standard feature or option on all of its models. GM, which provides OnStar service for Lexus, Acura, Audi and Subaru brands, will also offer AACN to other manufacturers as an option or standard feature. The technology hinges on a small computer embedded in the dashboard between the driver and passenger seats and called the Sensing Diagnostic Module -- what GM engineers call the "brains" behind AACN. SDM receives input from other sensors throughout the vehicle, including those in side panels, seats and the engine area. It also records the number of occupants in the car at any given time, the vehicle's speed and the region of the vehicle that may have been hit. In case of an accident, the SDM crunches an algorithm to determine the severity of impact, using a standard scale developed by the National Highway Traffic Safety Administration. The SDM then relays that information to an OnStar adviser, who may then phone an emergency medical technician, local hospital or 911 dispatcher. Eventually, GM hopes to automate the data transmission by linking directly to hospitals or emergency centres, said Robert Lange, executive director for structure and safety integration at GM. At the heart of the SDM is a sophisticated accelerometer that measures the change in the vehicle's velocity over a short period of time, a statistic engineers call "Delta V." A sudden change in velocity -- for example, from 50 miles per hour to zero in two seconds -- is the single biggest indicator of the severity of a collision. The SDM also includes a gyroscope to determine where a vehicle has been impacted in a collision, said Jasmin Jijina, lead engineer for the AACN project. For example, the SDM could determine that a car has been severely impacted in its front passenger-side door. But the SDM, which receives information from sensors embedded in front car seats, could also determine that no one was in the passenger seat at the time of the crash. So although the crash was severe, the likelihood of a fatality might be low. The SDM could also help medics determine what kind of equipment to bring to the crash scene. For example, if a crash is so severe that fatalities are likely but the crash happened in a remote location, the dispatcher might immediately request a helicopter to transport victims to a trauma hospital in another state. A dispatcher might also warn medics that one or more occupants were children, who often require different-sized clamps or paddles in emergency procedures. Most new vehicles already have so-called suppression sensors in the seats to determine the weight of the occupants, chiefly to shield smaller occupants from the full force of an airbag release. In GM vehicles, people less than 90 pounds are considered to be children, and passengers more than 90 pounds are considered as adults. "We were already using suppression sensors to determine whether to suppress the front airbag," Jijina said. "This is a great secondary use." Although few people doubt GM's intentions to help save lives, privacy advocates say the technology could have negative consequences. Lawyers say AACN could spark a number of interesting legal debates. For instance, could a crash victim get the data to prove that he or she was driving within the speed limit -- but that the person who struck the car was driving too fast? If the data showed that a person frequently parked the car outside bars or off licences, then drove away at extreme speeds or swerved erratically, could that person be accused of drink-driving -- even if that person wasn't stopped by the police at the time? David Sobel, general council for the Washington-based Electronic Privacy Information Centre, also had concerns about the nature of AACN registration. The feature is one of many services offered by OnStar, including automated stock quotes, driving directions and concierge services for ticket buying and restaurant reservations. Sobel said many people might opt for AACN because of safety perks but not be aware of the tracking function. "Many people are likely to give consent in case of an accident, but the point is to make sure that the driver understands what data is being collected, what triggers the data collection and where it's reported," Sobel said. GM executives said Wednesday they have no intention of selling the data collected by OnStar, or using it for nonemergency purposes. But Lange acknowledged that the data could leave GM if the company were subpoenaed. "We do not release any information we collect, absent a direct, written authorization with the owner or some kind of court order to which we must respond," Lange said. "But privacy and integrity is very important to us." GM executives also concede that they have not finalized some key details of AACN, and they considered Wednesday's launch the opening of a "reasonable public policy debate" about how to best use the technology. In particular, GM executives want input from emergency dispatchers and other first-response workers to determine the volume of calls that might eventually flow automatically from the vehicle to the emergency call centre. Currently, the release of a vehicle's airbags results in an alert to the OnStar adviser, but GM is weighing whether to change that threshold to a 20mph or 16mph sudden decrease in speed or to use another parameter. "We don't want to inundate emergency response sites with collision notifications that require no response," Lange said. "There needs to be a pretty sophisticated test, study and debate about how we go about this and the appropriate level of data transfer." Advocates say that the technology could prove especially useful in rural areas of the US, which accounts for 60 percent of fatal automobile accidents. Rural roads have fewer streetlights and more narrow shoulders than in cities, and rural drivers often travel at faster speeds. It can take emergency medics an hour or more to drive to the scene. "People can lay unnoticed for a long time before they're discovered and cared for," said NHTSA administrator Dr. Jeffrey W. Runge, who spoke at the conference. "The goal is to get the right resources to the right people, right when they need it. I'm here because I really believe AACN will close a gap that's been there in our efforts to help save lives."

---