The proliferation of the electric vehicle is undeniable. Two of the world’s biggest economies, China and the United States, both implemented categorical policy changes to encourage the sale of electric vehicles. By 2030, China will require 40% of all vehicle sales to be electric vehicles. Additionally, the U.S. Senate recently passed a $1.2 trillion bipartisan infrastructure package, which has a large share of the funds set aside to address electric vehicles, the electric grid and the power infrastructure. With rapid expansion comes increased risk. Public electric vehicle charging stations collect a wealth of sensitive personal data ranging from payment to precise location data.

What type of data does an electric vehicle charging station collect?

Inherent in the use of IoT devices is a transaction, providing personal data in exchange for enhanced, tailored services. Public electric vehicle charging stations and the companies that operate them are no different: they collect a wealth of sensitive data about consumers that use their charging stations. There are two distinct points of collection: the mobile application (or radio-frequency identification card) and the charging station. However, irrespective of the exact point of collection, most — if not all — of the data will end of up consolidated by the specific charging station operator.

In reviewing the public-facing privacy notices of the largest charging station operators in North America, they had several similarities. An app or RFID card is required to use most charging stations. These apps collect information typical of what you might expect a consumer to provide to use the service, including commercial information such as payment data or demographic identifiers like name and email address. Additionally, when using the app, charging station operators collect internet and network usage data such as IP address, online behavioral history, app identifiers or in extreme cases, browsing history.

The app or RFID card also collects sensitive data types during the transaction life cycle, including location data. Location data is particularly sensitive because it can be general (i.e., based on a specific mile range) or precise (i.e., exact GPS coordinates). This information is used for traditional purposes like helping consumers locate charging stations or low-risk promotional material (i.e., provide localized promotional content). However, it can also be used to predict driving patterns and overall daily routine. In the wrong hands, this information is not only creepy, but dangerous. It can be used to pinpoint a consumer’s exact location with incredible accuracy.

Charging stations collect information — shared to the overall network — every time the consumer uses the service. Most charging networks will collect information such as charging session date, start time, end time, duration, ID number, energy dispensed, charging port ID number, total fees associated with each charging session, pricing policy applied, RFID card number, power cycle patterns, current and voltage. Most of this may seem harmless; however, session data is akin to location information because it can be used to predict driving patterns and overall daily routine with surprising accuracy. The power cycle patterns, voltage data, and pricing policy applied likely won’t result in any physical danger to the consumer, but it may lead to economic and competitive disadvantages.

The trend of using charging station data is more aggressive outside of the United States. In 2020, the Shanghai Municipal Government announced the addition of 100,000 charging stations, aptly called Internet-of-Vehicle roadways, along with 5G base stations. In addition to normal functions, Internet-of-Vehicle roadways collect usage data and combine it with other unauthenticated data to build “user portraits.”

According to Sun Huifeng, president of CCID Consulting, the main intention of creating user profiles is understanding user habits, vehicle location trends, improving car batteries, and aid in making decisions about where to build out infrastructure. Building profiles on individual users is one of the most aggressive uses of consumer information because it requires making inferences about individuals based on characteristics and past behavior. This can be perceived as creepy, invasive and in extreme cases discriminatory. It should be closely monitored or scrutinized, especially as it makes its way into the United States.  

What are the privacy risks relating to charging stations?

Both environmental and technical features create privacy risks for charging stations. The length of time a consumer remains at the charging station is an environmental risk. At a gas station, the typical consumer experience lasts 5-10 minutes depending on the vehicle. However, electric vehicle charging stations take substantially longer. Keeping in mind the diversity of batteries and charging power, the approximate time to fully charge can be hours.

The considerable difference in the length of a typical consumer experience can result in vehicles being left unattended for hours. This creates opportunity for tampering, including physical interferences. Given the novelty and complexity of the charging stations, the average consumer is unlikely to detect the presence of malicious mechanisms. Industry experts worry that chargers will surpass traditional gas stations as the most inviting target for skimmer and shimmer fraud. This risk can be mitigated by the presence of physical security such as guards and surveillance systems; however, it is unclear if those will become customary or completely eradicate the issue.

Electric vehicle charging stations are a specialized electrical socket. However, public charging stations connected to a grid present more complex privacy issues, which depend on the network.

Closed networks, which tether to a specific set of manufacturers, consolidate consumer information to one specific business. This gives consolidated operative control to the business over all aspects of the charging universe: to secure, handle, update, process and delete consumer data at their discretion. With unrestricted control over personal data, companies can create user profiles (though it is unclear the extent this occurs in the United States), manipulate data for insights and predict consumer driving patterns. The average consumer likely won’t understand they are consenting to such aggressive data collection and use scenarios.

Open network grids connect charging stations from any number of manufacturers, so long as the stations meet set criteria. This limits risks associated with the consolidation of consumer data, but not without its own privacy risks. Open network grids allow more stakeholders access to the data flowing between the driver, charging stations and grid. This interaction means a single privacy or security vulnerability could lead to problems for the entire network, and the integrity of each unit becomes crucial to the success of the entire grid. Experts worry this could invite distributed denial-of-service attacks, ransomware or ID fraud. In extreme cases, this could jeopardize the integrity of the entire electric charging grid.

However, the fact that personal data is part of the value chain for vehicle charging doesn’t make the industry destructive at face value. The interconnectivity and data chain become an issue as more sensitive data types are shared broadly. With multiple stakeholders involved, it is important to adhere to the network’s guidance. Regular audits and stringent privacy controls are essential to maintain adequate protection of consumer information.

What is the path forward?

There is no clear answer to addressing all the privacy risks associated with electric vehicle charging stations. Their future is now, not tomorrow. We need to learn from past data breaches in other industries, which are now commonplace and, in most cases, not newsworthy unless egregious. Will this data platform be the new frontier for hackers? Will this be a battleground between saving the environment versus vulnerability of consumer privacy, or will there be common ground and compromise? Ultimately, legislators, regulators, vehicle manufacturers, charging station manufacturers and other industry experts need to communicate security issues and remediations, as well as develop better industry standards and collaborate on future goals. Who will take the first step?

The views reflected in this article are the views of the author and do not necessarily reflect the views of the global EY organization or its member firms.

Photo by CHUTTERSNAP on Unsplash