Court to FBI: No spying on in-car computers

The 9th Circuit Court of Appeals said Tuesday that the FBI is not legally entitled to remotely activate the system and secretly use it to snoop on passengers, because doing so would render it inoperable during an emergency.

In a split 2-1 rulingthe majority wrote that "the company could not assist the FBI without disabling the system in the monitored car" and said a district judge was wrong to have granted the FBI its request for surreptitious monitoring.

The court did not reveal which brand of remote-assistance product was being used but did say it involved "luxury cars" and, in a footnote, mentioned Cadillac, which sells General Motors' OnStar technology in all current models. After learning that the unnamed system could be remotely activated to eavesdrop on conversations after a car was reported stolen, the FBI realized it would be useful for "bugging" a vehicle, Judges Marsha Berzon and John Noonan said.

When FBI agents remotely activated the system and were listening in, passengers in the vehicle could not tell that their conversations were being monitored. After "vehicle recovery mode" was disabled, the court said, passengers were notified by the radio displaying an alert and, if the radio was not on, the system beeping.

David Sobel, general counsel at the Electronic Privacy Information Center, called the court's decision "a pyrrhic victory" for privacy.

"The problem (the court had) with the surveillance was not based on privacy grounds at all," Sobel said. "It was more interfering with the contractual relationship between the service provider and the customer, to the point that the service was being interrupted. If the surveillance was done in a way that was seamless and undetectable, the court would have no problem with it."

Under current law, the court said, companies may only be ordered to comply with wiretaps when the order would cause a "minimum of interference." After the system's spy capabilities were activated, "pressing the emergency button and activation of the car's airbags, instead of automatically contacting the company, would simply emit a tone over the already open phone line," the majority said, concluding that a wiretap would create substantial interference.

"The FBI, however well-intentioned, is not in the business of providing emergency road services and might well have better things to do when listening in than respond with such services to the electronic signal sent over the line," the majority said.

In a dissent, Judge Richard Tallman argued that a wiretap would not create unnecessary interference with emergency service and noted that "there is no evidence that any service disruption actually occurred. The record does not indicate that the subjects of the surveillance tried to use the system while the FBI was listening. One cannot disrupt a service unless and until it is being utilized.

"The record indicates that the only method of executing the intercept order in this case involved activating the car's microphone and transferring the car's cellular telephone link to the FBI. This conduct might have amounted to a service disruption, had the subjects of the surveillance attempted to use the system, but there is no evidence that they did."

The majority did point out that the FBI cannot order the system to be changed so that the emergency functions would work during surveillance. Congress ordered telephone companies to do just that in the 1994 Communications Assistance for Law Enforcement Act, but current law does not "require that the company redesign its system to facilitate surveillance by law enforcement."

General Motors did not immediately respond to a request for comment on Wednesday. Its OnStar privacy policy says: "OnStar may disclose personal information if required to do so by law on (sic) in the good faith belief that such disclosure is reasonably necessary to comply with the legal process...OnStar cannot accept any responsibility for accidental or inadvertent disclosure, unauthorized access or for other disclosure as required by law or described in this policy."

The decision is binding only in California, Oregon, Nevada, Washington, Hawaii, and other states that fall within the 9th Circuit's jurisdiction. No other appeals court appears to have ruled on the matter.