Research: Vehicle Control Infrastructure
The thesis: every system built for a legitimate safety purpose creates a control capability. The infrastructure is permanent; the policy constraints are temporary. This page documents the convergence of impaired driving prevention, remote disable, insurance telematics, and mandatory speed assistance — with full sourcing.
Status
Updated as NHTSA’s RIDE Act rulemaking progresses, new OTA-removal incidents surface, EU ISA enforcement data is published, and US state-level subprime starter-interrupt regulation changes. Citation discipline: every claim in this page should resolve to either a primary document (rulemaking, regulation, court filing, manufacturer statement) or a beat reporter who has the documents (Mozilla Foundation, Kashmir Hill on cars at NYT, Edmunds).
Where it appears in print: The Ratchet, Chapter 10 (“The Car”). The convergence-table framing is the chapter’s spine; the inline sources here are the documentary back-stop. Click 10 on ratchet-clicks is the self-assessment version.
The Convergence Table
| System | Stated Purpose | Control Capability | Status |
|---|---|---|---|
| RIDE Act (Section 24220) | Prevent impaired driving | Onboard system can prevent vehicle operation | NHTSA rulemaking in progress; ~2027-2028 deployment |
| OnStar Stolen Vehicle Slowdown | Recover stolen vehicles | Remote deceleration to idle; remote ignition block | Active; ~1,500 requests/month |
| Tesla OTA Updates | Software improvements | Remote addition/removal of vehicle capabilities | Active; demonstrated in 2020 Autopilot removal |
| EU Intelligent Speed Assistance | Reduce speed-related deaths | Camera/GPS speed detection with vehicle intervention | Mandatory for all new EU vehicles since July 2024 |
| EU eCall | Emergency response | Always-on cellular connection with location | Mandatory since April 2018 |
| China’s EV Monitoring Platform | Subsidy compliance | 61 real-time data points per vehicle to government centers | Active; 200+ manufacturers; 1.6M+ vehicles |
| Insurance Telematics | Risk assessment | Real-time driving behavior streamed to third parties | Active; 84% of car brands sell/share data |
| Starter Interrupt Devices | Loan collateral protection | GPS-based remote vehicle disable | ~2 million US vehicles; 25-70% of subprime loans |
| BMW/Mercedes Subscriptions | Revenue model | Hardware present, software controls access | Active for some features; heated seats abandoned 2023 |
The RIDE Act / Infrastructure Investment and Jobs Act (2021) — Section 24220
Requires all new vehicles to have “advanced drunk and impaired driving prevention technology” — systems that passively (no breathalyzer, no direct action from occupants) monitor the driver and “prevent or limit motor vehicle operation if impairment is detected.”
Implementation timeline: NHTSA published an Advance Notice of Proposed Rulemaking January 5, 2024. 18,000+ public comments received. The November 2024 deadline for a final rule passed without action. A 3-year extension is allowed with annual Congressional reports. Earliest real-world deployment: ~2027-2028. The DADSS breath sensor technology may be available for OEM licensing by end of 2025.
The “kill switch” debate: Rep. Thomas Massie (R-KY) introduced an amendment to block enforcement funding, calling it an “Orwellian automobile kill switch.” Failed 164-268.
The nuance: The law does not give the government a remote kill switch or remote access. It mandates that OEMs build onboard systems capable of preventing operation. The concern is about the capability this creates, not the current authorization. MADD estimates 10,100+ lives saved annually and states they “would not support a final standard that leaves consumers vulnerable to privacy invasions.”
Sources:
- NHTSA ANPRM (Federal Register)
- NHTSA Report to Congress 2024 (PDF)
- GovTrack: Massie Amendment H.Amdt.155 Vote
- Snopes Fact Check: Congress Kill Switch Law
- MADD: 10 Things to Know
- DADSS Program Overview
Existing Remote Disable Capabilities
OnStar (General Motors)
Stolen Vehicle Slowdown gradually reduces a vehicle to idle speed during police pursuit. Remote Ignition Block prevents restart when parked. ~1,500 stolen vehicle requests per month. Requires owner report, OnStar advisor, and law enforcement confirmation.
Tesla Over-the-Air Capability
A 2017 Model S sold at Tesla auction with Enhanced Autopilot and Full Self-Driving ($8,000 value) had both features remotely stripped via OTA “audit” after resale to a third-party buyer. Tesla claimed “incorrectly configured.” After Jalopnik reported the story, features were restored citing “miscommunication.”
The incident demonstrated Tesla’s ability to remotely add or remove vehicle capabilities post-sale. The hardware is in the car. The software controls access. The manufacturer retains remote control.
Subscription-Gated Hardware
BMW offered heated seats as an $18/month subscription in South Korea — hardware already installed in the car. After 87% of consumers said comfort features should be included in the purchase price, BMW abandoned heated seat subscriptions in 2023 but continues other software subscriptions. Mercedes charges yearly fees for EQ performance. VW offers power upgrades by subscription. Tesla charges monthly for FSD.
The business model is the precedent: hardware present, software controls access, manufacturer retains control.
Insurance Telematics — The Data Pipeline
Mozilla Foundation called cars “the official worst category of products for privacy that we have ever reviewed.” 84% of 25 car brands surveyed sell or share user data with third parties.
The GM/LexisNexis scandal: A GM customer received a 130-page LexisNexis report detailing 600+ drives over six months — start/end times, distances, speeding, hard braking, sharp accelerations. Data came from OnStar Smart Driver enrollment. Hyundai shared data from 1.7 million vehicles with Verisk, which paid Hyundai $1,043,315.69 (61 cents per car). GM terminated partnerships with both brokers as of March 2024 after the NYT reported the story.
Insurance telematics currently only observe. But the data infrastructure — real-time driving behavior streamed to third parties — creates the feedback loop needed for control. The technical gap between “raising your premium” and “limiting your speed” is a policy decision, not a technical one.
- Mozilla Foundation: Your Driving Data for the Price of a Gumball
- Edmunds: GM Got Caught Selling Driver Data
- Consumer Federation of America: Auto Insurance Telematics White Paper (2021, PDF)
EU: Intelligent Speed Assistance and eCall
ISA mandatory for all new EU vehicles from July 7, 2024. Uses cameras and/or GPS to detect speed limits and intervene. Currently overridable by the driver. Expected to reduce collisions by 30% and deaths by 20%. Making it non-overridable is a firmware update away.
eCall mandatory since April 1, 2018. Always-on cellular connection, automatic location reporting in crashes. Privacy safeguards added after concerns: data transmitted only during emergencies, no continuous tracking. But the hardware — an always-on cellular modem with GPS — is in every new car sold in Europe.
- European Road Safety Charter: ISA Mandatory Across Europe
- ETSC: Intelligent Speed Assistance
- Your Europe: eCall Overview
China’s National EV Monitoring Platform
Mandatory real-time monitoring for electric vehicles since 2017, operated by Beijing Institute of Technology. 200+ manufacturers — including Tesla, VW, BMW, Ford, GM — transmit data to government-backed centers. A single EV provides up to 61 data points in real time, including location. 1.6M+ EVs on the platform. Data collection generally happens without car owners’ knowledge. Data transmission was a prerequisite for EV subsidies.
US Commerce Secretary Raimondo raised concern that Chinese-made modules could be “manipulated to disable vehicles remotely.” No public incident has confirmed remote disable via the platform. The infrastructure exists; its weaponization is not yet documented.
The social credit system restricts blacklisted individuals from purchasing luxury cars, high-speed train tickets, and first-class flights. These are purchase/access restrictions, not remote disable — but they demonstrate the policy framework for using transportation as a control mechanism.
- Quartz: How China’s Electric-Car Surveillance System Works
- CNBC: U.S. to Investigate Security Risks from Chinese Vehicles (Feb 2024)
- Merics: China’s Social Credit Score — Untangling Myth from Reality
Starter Interrupt Devices
Roughly 2 million cars in the US have GPS-based starter interrupt devices — about one-quarter of subprime auto loans. Between 35% and 70% of vehicles financed by subprime lenders have them. Leading manufacturers: PassTime, Ituran.
Documented harms:
- Vehicles disabled while driving on freeways
- Vehicles disabled when borrowers were days late on payments
- A domestic violence survivor’s vehicle tracked and repossessed after fleeing to a shelter
- Vehicles disabled at traffic lights, in dangerous neighborhoods, during medical situations
The FTC issued civil investigative demands to Credit Acceptance Corporation and DriveTime Automotive Group. EPIC filed a complaint with the CFPB regarding CAG Acceptance and PassTime USA.
The pattern: the people with the least financial leverage get the most invasive control technology installed in their vehicles.
The Ratchet Pattern
Each row in the convergence table was built for a legitimate purpose. Impaired driving prevention saves lives. Stolen vehicle recovery works. Speed assistance reduces fatalities. Emergency calling rescues crash victims.
But each system also creates a capability: the ability to monitor location, track behavior, limit speed, prevent operation, or disable a vehicle remotely. The safety justification gets the hardware installed. The hardware outlasts the policy. And the policy constraints — which are regulations, not physics — can be changed by the same governments that mandated the hardware.
The technical gap between “detecting impairment” and “preventing travel” is one software update. The gap between “reporting emergencies” and “continuous tracking” is one policy change. The gap between “raising your insurance premium” and “limiting your speed” is one data-sharing agreement.
Every system built for safety creates a control capability that only tightens. That is the ratchet.
Bridges
- ratchet-clicks — click 10 (“The Car”) is the self-assessment version of this page
- convergence-table — vehicle control sits inside the broader infrastructure stack (biometric collection, payment freezing, behavioral scoring all interact with the connected-car data layer)
- twitter-files-index — same ratchet structure at the moderation/platform layer
Sources for Starter Interrupt Devices
The starter-interrupt section above relied on figures that warrant their own primary citations:
- NYT: Miss a Payment? Good Luck Moving That Car (Sep 2014) — the original report on starter-interrupt-and-track devices in subprime auto loans; source for the “2 million vehicles / 25-70% of subprime loans” range.
- EPIC complaint to CFPB regarding CAG Acceptance and PassTime USA — primary document.
- FTC investigation announcements re: Credit Acceptance and DriveTime — search “Credit Acceptance” for the active record.
- NCLC: Stop the Debt-Collection Car Repossessions Industry (report) — National Consumer Law Center primary research.