Defense: Federal Office for the Protection of the Constitution warns of espionage through Tesla cars

Due to concerns about espionage, the Bundeswehr is restricting the access of networked cars. Security experts are calling for the measures to be expanded to other security areas.

Thuringia's Office for the Protection of the Constitution, Stephan Kramer, warns that manufacturers from allied states should not be given a leap of faith when it comes to safety tests.

The Bundeswehr bans connected vehicles, including Tesla and BYD, from entering certain military security areas due to espionage risks.

Marc Henrichmann, Chairman of the Intelligence Control Board, emphasizes that security measures must be based on technology rather than on the basis of country of origin.

The Green Party politician Konstantin von Notz refers to studies that, according to him, point to relevant safety concerns with connected vehicles.

Berlin. The Thuringian Office for the Protection of the Constitution, Stephan Kramer, warns of espionage risks from vehicles from the US electric car manufacturer Tesla. Manufacturers from allied countries are also unlikely to receive an advance of trust in safety tests. “We shouldn’t rely on friends not spying,” Kramer told Handelsblatt. “The same testing standard should apply to Tesla and all other manufacturers.”

In addition to Chinese car manufacturers such as BYD, Elon Musk's US company is also moving into the focus of the security debate. The background to this is stricter Bundeswehr regulations.

Due to concerns about espionage, modern vehicles connected via the Internet are no longer allowed to enter certain military security areas. The restrictions apply regardless of the manufacturer and therefore also affect Tesla.

What is crucial is “what data the vehicle collects, where it is transferred and who can access it,” explained Kramer. The possibility of unauthorized access must also be taken into account in the security assessment.

According to the Federal Office for Information Security (BSI), the majority of new vehicles offered in Germany offer the technical possibility of recording data generated while driving - location, camera and other sensor data - and forwarding it to the manufacturers' background systems. This is done, for example, to offer vehicle users additional services or to further develop products, explained the BSI. There is currently no concrete evidence of espionage by such vehicles.

According to EU type approval law, manufacturers are obliged to “adequately protect vehicles against cyber attacks and prevent access to vehicle data by unauthorized persons”. However, the specific scope of the data generated and its transmission is often not transparent for customers, according to the BSI. When contacted by Handelsblatt, the two car manufacturers mentioned, Tesla and BYD, were initially unable to respond to the espionage allegations.

“Technology is similar for all connected vehicles”

Thuringia's President for the Protection of the Constitution, Kramer, believes that the Bundeswehr's stricter rules are justified. “Connected car cameras and tracking systems capture sensitive information,” he said. “In the case of the Bundeswehr, it’s about military installations, operational processes and people.” If the local risk analysis reveals a danger, access restrictions are “strongly recommended and therefore appropriate”.

The chairman of the intelligence control committee in the Bundestag, Marc Henrichmann (CDU), also supports the Bundeswehr's measures. “Anyone who allows such systems to be driven into sensitive military areas without being checked opens a window for foreign intelligence services,” he told the Handelsblatt. “Modern vehicles have long been equipped with cameras, radar devices and permanent data connections,” said the CDU politician.

Henrichmann expressly warns against basing the safety assessment solely on the origin of a manufacturer. The legal situation for companies from partner countries is “largely different” than in China. However, the technical risks remained comparable. "The way technology is installed is similar in all connected vehicles. That's why the protection of sensitive areas must be based on technology and not just on the country of origin."

The Bundeswehr's decision could therefore have far-reaching consequences for how it deals with Tesla and other connected car brands. Even outside military installations, vehicles with cameras, microphones and tracking systems are parked in parking lots that directly border security-relevant buildings.

Kramer is therefore calling for appropriate protective measures for “particularly vulnerable areas of government buildings, police, intelligence services and other security-relevant facilities”. Operators of critical infrastructure would also have to examine possible risks.

“Don’t talk about confidential things”

The CDU politician Henrichmann also advocates expanding appropriate security measures. “What applies to barracks must apply even more to intelligence services, security-relevant government areas and critical infrastructure,” he said. “It’s not about a blanket driving ban in front of every ministry, but about clear rules.”

Kramer doesn't think a general driving ban is necessary everywhere. “Depending on the location, adequately spaced parking spaces or targeted access restrictions may be sufficient,” he said. Companies and research institutions should also carry out appropriate risk assessments.

The President of the Office for the Protection of the Constitution warns particularly urgently about possible risks of interception. “Servants and employees should be made aware, for example not to talk about confidential things in the vehicle,” he said. “It’s not just about film footage and photos.”

The digital policy spokesman for the SPD parliamentary group, Johannes Schätzl, also calls for cross-manufacturer security checks. These should apply to all connected vehicles whose manufacturers may be subject to government production orders. “In the future, when purchasing vehicles for members of the government, secret services and the military, questions about geopolitical risks and security risks must always be taken into account,” said Schätzl to the Handelsblatt.

However, security politicians express particular concerns about Chinese manufacturers. Kramer points to the legal obligations in the People's Republic to cooperate with intelligence services. “This is an additional risk factor at BYD,” he said.

Henrichmann also referred to Chinese law, which obliges companies to cooperate with their own intelligence services. Where vehicle data is processed in China, it cannot be ruled out that “state authorities will access it”.

Schätzl warned about vehicles from the Chinese company BYD, which are highly networked and have sensors, microphones and 360-degree cameras. “These cars are black boxes, we don’t know exactly what data is being collected and who has access to it,” he said. “The risk should not be underestimated, especially in sensitive military areas.” The Bundeswehr measures are therefore “absolutely appropriate”.

The Green parliamentary group vice-chairman and deputy chairman of the secret service control committee, Konstantin von Notz, expects consequences beyond the Bundeswehr. He assumes that “other security authorities and emergency services organizations will follow suit,” he told the Handelsblatt.

Von Notz sees the connections between Chinese car manufacturers and the Chinese government as a particular risk. “The legal framework applicable in China allows the government to have direct access to practically all data and information available in a company.” This “of course arouses corresponding desires”.

According to the Green Party politician, “there have long been concrete suspicions that data from vehicles is being systematically read out and used for various purposes.” Von Notz referred to studies by the Central Office for Information Technology in the Security Sector (Zitis) and the Federal Office for the Protection of the Constitution. Their results are not public. In view of the recent Bundeswehr decision, it can be assumed that “there are definitely relevant indications of existing security concerns on the part of the authorities”.

The warnings are increasingly affecting all connected vehicle technology. Henrichmann sums up the danger in a succinct formula: “We must not be naive: today, espionage no longer only takes place through agents, but also through technology that we ourselves provide.”