Connected vehicle data ‘can have intelligence value’ to adversaries: federal document

OTTAWA — Data from an advanced electric vehicle that falls into the wrong hands could be used to track people or carry out surveillance, an internal government document warns.

The Public Safety Canada memo, prepared to address concerns about Chinese vehicles, urges Canadians to be mindful of the security and privacy risks of the digital devices they buy and use.

Earlier this year, Canada pledged to reduce its 100 per cent tariff on Chinese-made electric vehicles to 6.1 per cent — with an annual cap of 49,000 vehicles — in exchange for lower tariffs on Canadian agricultural products.

The memo says Canada has to expand its economy in response to a changing geopolitical environment — a necessary step to ensure economic sovereignty.

“At the same time, opening our markets to new players can amplify the presence of high-risk vendors. Connected vehicles, similar to other smart or internet-connected devices, collect significant amounts of data on Canadians, which can have intelligence value,” it says.

“For example, unauthorized access to data and connected vehicle systems could be used to establish patterns of life or conduct surveillance on sensitive sites.”

The Canadian Press used the Access to Information Act to obtain the memo, which includes key messages as well as questions and answers about the issue.

It points out that companies in Canada must comply with federal privacy law, or provincial equivalents, that set out rules for collecting, using and disclosing personal information.

The memo adds, however, that it’s important to remember the national security laws of certain countries, like China, can compel manufacturers and suppliers to share data with their home government or police.

“The risk that Canadian data collected by connected vehicles are accessed and exploited increases when these data are sent to — or transit through — foreign jurisdictions with more permissive data management frameworks.”

Vehicles manufactured in China and intended for sale in Canada are subject to the same regulations as cars and trucks made in other countries, and the manufacturer must certify that each vehicle complies with the safety standards set out in Canada’s Motor Vehicle Safety Act, the memo says.

“However, there are growing security threats presented by connected vehicle technologies, including along the supply chain, which the government is assessing to determine the need for additional tools.”

The document says there are security risks associated with a range of other connected devices, mobile phones, networking equipment, video cameras and drones.

There are important guardrails — some already in place, others requiring further development and implementation — to minimize or manage these risks, the memo adds.

“Each Canadian must also consider the cybersecurity, privacy implications, and trustworthiness of the devices they purchase and use,” it says. “As threats evolve, so too must our tools.”

Emerging technologies, such as artificial intelligence, are increasingly integrated into connected devices across Canada, including in the auto industry, enhancing the potency and reach of malicious actors in cyberspace, the document says. It warns that if these technologies are introduced without built-in safety and security throughout their life cycle, Canada could become less capable of fending off threats.

In addition, foreign ownership of the infrastructure — such as the digital cloud — that supports the connected devices can pose a risk to privacy and cybersecurity, the memo says.

The Canadian security and intelligence community assesses and advises on measures to address threats, including “warnings about certain high-risk vendors,” it adds.

Public Safety spokesperson Louis-Carl Brissette Lesage said Transport Canada has worked with various government players, manufacturers and other countries to develop guidance and tools on vehicle cybersecurity that set out best practices for industry.

For example, Transport Canada published Canada’s Vehicle Cyber Security Guidance in March 2020, which provides a set of technology-neutral guiding principles to support industry, he said in an emailed response to questions.

The Transport Department is also performing research on emerging vehicle technologies and is actively working with international counterparts through the United Nations Economic Commission for Europe to develop global regulatory standards for automated driving systems, including considerations for vehicle security, he said.

This report by The Canadian Press was first published June 1, 2026.

Jim Bronskill, The Canadian Press