Spies may be sitting not only in cars, but in boardrooms too

Anyone with something confidential to discuss should not do so in or around a modern car, according to the Dutch General Intelligence and Security Service (AIVD). The reason is the technology present in it: microphones, cameras and wireless connections.

That raises a follow-up question: where can such a conversation be held safely? The obvious place is the boardroom or the meeting room. Behind closed doors, with only the people who belong there. Yet that is precisely where much of the same technology now stands, the technology the AIVD warns about in modern cars.

In the publication ‘De moderne auto als mogelijke spion’ (the modern car as a possible spy), published on 30 September, the AIVD points out that microphones and cameras in modern vehicles can be switched on remotely. Cars also collect large volumes of data to which an entire chain of parties may have access.

The AIVD puts it cautiously: technically ‘possible’, parties ‘may’ gain access, which produces ‘risks’. That is not proof that cars are actually being abused on a large scale for eavesdropping. But adequate security does not require hard proof: ideally you recognise risks before abuse takes place.

Strikingly quiet

More interesting than the car itself is the way the AIVD looks at it. Which component here can hear, see or transmit? What is connected to the outside world? And who can reach it? Apply those same questions to a boardroom and the conversation falls strikingly quiet.

The average modern meeting room contains a conferencing system with microphones, sometimes cameras, connected to the corporate network and regularly to cloud services as well. On the wall hangs a display with an operating system of its own. There is equipment for wireless presenting. Around it lie laptops, phones and smartwatches, likewise fitted with microphones, cameras and wireless connections. Whether a microphone is actually off, moreover, is often determined by software and not by a physical switch you operate yourself.

The trust boundary of the meeting room therefore no longer lies at the door. For the car, the AIVD describes a chain of parties that may have access to data: manufacturer, dealer, leasing company, app developer, component maker and cloud service.

Seeing the whole

In the meeting room a comparable chain exists. The IT department manages the network, facilities manages the room and external installers manage the audiovisual equipment. Behind them sit suppliers of conferencing software, cloud platforms, videoconferencing services and firmware that can update systems, process log data or provide remote support. Everyone has sight of one part. The question is who has sight of the whole.

‘When we think of eavesdropping we think of a pen with a microphone, things with the pull of a spy film’

Many organisations invest in protecting confidential information with screening, document classification and access policy. All those measures assume the same thing: that what is discussed behind a closed door stays there.

Despite the possible dangers, it probably does not hold for many organisations that their boardroom is insecure. What does hold is that they cannot demonstrate how secure it is. They know which people may come in, but not necessarily which devices can listen along, which connections those maintain, and which external parties have technical access to them.

An unfilmic blind spot

The Dutch Trade Secrets Protection Act requires that reasonable measures have been taken to keep secret information secret. For organisations covered by the new Cybersecurity Act, managing cyber risk is now explicitly a board responsibility.

When we think of eavesdropping we quickly think of a hidden camera, a power strip or a pen with a microphone. Things with the appeal of a spy film. A less filmic blind spot is equipment the organisation bought itself, mounted neatly on the wall, and does not regard as a security question.

This does not call for drastic measures straight away. A board can begin with an exercise of the kind the AIVD applies to the car. Which components in this room can hear, see or record? Which of those are connected to other systems or to the internet? And who, inside and outside the organisation, has access to that equipment, to the software, or to the data it processes? There is one more question to add: who is responsible for the answer? If nobody at the table can answer those questions, that in itself is a finding.

Putting the car outside the gate does not solve the problem of confidentiality; it moves it. In the modern boardroom the trust boundary no longer stops at the door. As long as nobody can demonstrate where it does run, confidentiality remains an assumption.