There was no allegation that Ford or the other carmakers directly accessed text messages or call logs, or that they stored the data in their own systems. The privacy concern comes from the fact that a company called Berla sells specialized data-retrieval products to law enforcement, which could use the products to obtain messages and logs from a car.
Berla’s website boasts that “having access to a suspect’s connected vehicle is the next best thing behind having the actual phone itself.” In a statement quoted in the plaintiffs’ complaint, Berla also says that if “a driver uses the infotainment interface to ‘delete’ their device, that device information often remains in unallocated space and can be recovered.”
“According to the Plaintiffs, Berla produces hardware and software capable of extracting stored text messages and call logs stored on a vehicle’s on-board memory,” the appeals court ruling said. “Berla products are not generally available to the public, and sales access is restricted to law enforcement, the military, civil and regulatory agencies, and select private investigation service providers.”
Law requires actual injury
The Washington State Privacy Act prohibits “any individual, partnership, corporation, association, or the State of Washington, its agencies and political subdivisions” from intercepting or recording any private communication transmitted by telephone, said the US District Court ruling that dismissed the Ford lawsuit in May 2022. The state law “requires an injury to one’s business, person, or reputation” in order for a lawsuit to proceed.
The class-action complaint contended that “text message and call log data copied onto the vehicle can be, and is, transmitted to users of Berla’s equipment without requiring any kind of password, biometric, or other security measure.” The complaint pointed to a 2017 CyberScoop report that quoted Berla CEO and founder Ben LeMere as saying his firm was working with carmakers to educate them on securing private data, but only “when it’s part of an agreement that they will allow law enforcement in.”
A Ford court filing said that making a vehicle containing an infotainment system does not create liability under the state law “any more than selling computers and smartphones to purchasers who make and record calls and store texts on their devices. Any recording in this case was done by Plaintiffs, or by the system itself, which resides in a vehicle they own or use.”