On Australian roads, a silent revolution is underway, and it is not simply related to environmental aspects. Changes brought about by electric vehicles are prompting discussions on privacy, surveillance and corporate security in a manner that the majority of people have not even begun to contemplate.
Those who have kept up with the developments in the counter-surveillance domain or occasionally have had TSCM vehicle bug sweeps performed in the corporate environment, know how drastically things have evolved in the last 10 years. But EVs? They’ve propelled the situation onto an entirely new plane.
The Problem with “Smart” Vehicles
Let’s face it nowadays vehicles are not really vehicles anymore. They are computers on wheels, and electric vehicles specifically are so packed with features that connect to the Internet that a traditional petrol car would seem like a tin can by comparison.
Just consider what a current-model EV is doing at any time of the day:
It is communicating with the manufacturer’s cloud servers. It is recording your location, the speed, the pattern of acceleration and braking. It is syncing to your smartphone. It is downloading software updates wirelessly. In certain models, it is even listening you (through voice control command systems). If you have used a third-party charging network, it is sharing data there as well.
For the average driver, most of this probably goes unnoticed. But if you are a top executive, a legal person, a corporate security officer, or someone who handles confidential information, it is a huge surveillance risk.
Why EVs Create New Risks for High-Value Targets
The people who most need a car TSCM sweep are often the same people driving the newest, most technologically advanced vehicles. There’s an irony there that doesn’t get talked about enough.
Here’s the thing: legacy bugging methods involved physically planting a device — a small transmitter tucked behind a panel, a GPS tracker magnetically attached to the undercarriage. A professional TSCM bug sweep would sweep the vehicle with RF detection equipment, physically inspect the chassis, and locate anything that shouldn’t be there.
That still matters and always will. But EVs introduce a new category of threat that doesn’t involve anyone physically touching your car.
The attack surface on a connected EV includes:
Telematics systems — Most EV manufacturers have a persistent two-way data connection with the vehicle. In some brands, the manufacturer can remotely access location data, camera feeds, and cabin audio under certain conditions. Who controls that access? Who can request it? These are questions worth asking.
OBD-II ports and charging interfaces — Even though EVs use different charging standards, the OBD-II diagnostic port is still present on most models. This port is a known insertion point for covert tracking hardware. On EVs, it’s no less vulnerable.
Infotainment system data harvesting — When you connect your phone to an EV’s infotainment system, you’re often handing over far more than music control. Contact lists, recent calls, message previews, and navigation history can all be stored in the vehicle’s memory — and potentially accessed later.
Third-party app integrations — Many EV owners use apps that interface directly with vehicle systems. Fleet management software, charging network apps, home energy integrations — each of these represents an additional data pathway that someone with the right access (or the right exploit) could potentially intercept.
Over-the-air update mechanisms — Software update pipelines are a known attack vector in the cybersecurity world. For EVs, a compromised update could theoretically enable persistent access to vehicle systems without any physical presence required.
What This Means for TSCM in 2025 and Beyond
Traditional TSCM bug sweep methodologies were originally focused on finding physical devices. Using the RF emissions, magnetic anomalies, and visual inspection of cavities and panels, these methods are still valuable and not going to be eliminated.
On the other hand, a comprehensive car TSCM sweep of a modern EV must encompass more than that.
Seasoned TSCM professionals are now being called upon to not only identify and mitigate the physical security risks of a vehicle but also to work on its digital attack surface. This could involve checking what telematics data is being collected, determining if third-party apps have unnecessary access, looking for unauthorised Bluetooth and Wi-Fi pairings in device histories, and in some instances, seeing whether the vehicle has undergone remote access events.
This is not about paranoia at all. It is simply acknowledging that the nature of threats has really changed.
Whether it’s a competitor, a foreign intelligence officer, or even an angry insider, they no longer need to physically get close to your vehicle. If you drive an EV and are a person of interest for someone technically capable, the data your car involuntarily produces could expose more to them than a conventional tracking device ever can.
Who Should Be Thinking About This Right Now
The short answer is: anyone whose conversations, movements, or business dealings carry significant value.
Corporate executives conducting sensitive M&A discussions. Legal teams working on high-stakes litigation. Journalists or investigators dealing with confidential sources. Government contractors. Security consultants themselves.
If you’re already in an environment where you have regular devices swept for listening devices, where your phones are checked and your meeting rooms are assessed, then your vehicle — especially if it’s a connected EV — deserves the same level of scrutiny.
Fleet operators managing multiple EVs also need to pay attention here. Corporate fleets using EVs for executive transport may assume that because they own the vehicles, they control the data. That assumption is worth challenging. Data generated by those vehicles often flows through manufacturer servers, third-party fleet management platforms, and charging network providers — all of which represent potential exposure points.
Practical Steps Worth Considering
The first step in taking EV security seriously is a thorough car TSCM bug sweep done by a qualified professional. In fact, this should only be a starting point for your EV security efforts. Besides the physical inspection that any competent TSCM bug sweep involves, there are also other things that you can incorporate into your overall security posture:
Go over your vehicle’s privacy settings and data-sharing agreements very carefully. Most individuals don’t read the terms and conditions, but for a high-value target, the terms also determine who your vehicle is in communication with.
Restrict smartphone integrations only to absolutely required ones. Each app that you allow to interact with your EV’s systems presents another possible channel of your data to be accessed by others.
Find out your manufacturer’s policies on data retention and remote access before the purchase. Various brands have drastically different postures on this, and it is something you should be aware of beforehand.
It might be worth wondering if sensitive discussions should happen near connected vehicles at all. The interior of a modern EV, with its microphones and constant connectivity, is probably not as private as one might think.
Hire TSCM experts who have revised their techniques so as to deal with digital threats besides the traditional RF and physical inspection type threats.
Conclusion
Electric vehicles are genuinely impressive technology. The performance, the efficiency, the reduced running costs — there’s a lot to like. But the security and intelligence communities have learned, repeatedly, that new technology creates new vulnerabilities before it creates new defences.
The connected car represents one of the most significant expansions of the personal surveillance surface in recent memory, and electric vehicles sit right at the centre of that shift. Understanding this isn’t about being anti-EV. It’s about approaching the technology with clear eyes.
If you’re operating in an environment where privacy and security matter, then a car TSCM sweep needs to evolve alongside the vehicles being swept. And for anyone serious about counter-surveillance, the conversation around EVs has only just begun.
Frequently Asked Questions
Q: What is a TSCM bug sweep and why does it matter for electric vehicles?
A TSCM bug sweep is a professional inspection that detects covert listening devices, trackers, and surveillance hardware. For EVs, it matters because their built-in connectivity creates physical and digital channels that can be exploited to monitor movements, conversations, or business activities.
Q: Can a modern EV be used to spy on someone without planting a physical device?
Yes. EVs continuously transmit location history, driving behaviour, cabin audio, and synced smartphone data. Depending on who has access to that data stream, your vehicle can become a passive surveillance tool without anyone physically touching it.
Q: How is a car TSCM sweep on an EV different from a sweep on a regular vehicle?
A conventional car sweep focuses on physical detection — RF bugs, GPS trackers, covert cameras. An EV sweep needs to go further, covering active Bluetooth and Wi-Fi pairings, telematics settings, OBD-II port integrity, and third-party app access to vehicle systems.
Q: Who is most at risk from EV-related surveillance threats?
Executives, legal professionals, government contractors, and anyone involved in sensitive commercial matters. If your office and devices are regularly swept, your vehicle deserves the same scrutiny — especially if it’s a connected EV.
Q: Are EV manufacturers allowed to access my vehicle’s data remotely?
In most cases, yes. Many manufacturers reserve the right to access telematics data and in some circumstances, cameras or audio. The specifics sit in the privacy policy most buyers never read — and for anyone in a sensitive role, those terms matter.
Q: How often should a corporate EV fleet be swept?
Quarterly as a baseline, plus sweeps before sensitive travel, after unattended periods, following servicing by third parties, or after any suspected security incident.
Q: Does charging at a public station create security risks?
Potentially. Public chargers exchange data with the vehicle, and extended dwell times at charging locations also give opportunists time to physically access a car for device placement. It’s a low-to-moderate risk worth factoring in.
Q: What should I do if I suspect my vehicle has been compromised?
Don’t touch anything. Contact a professional TSCM service immediately, avoid using the vehicle for sensitive conversations or travel, and document anything unusual — unexpected battery drain, unfamiliar Bluetooth pairings, or changed settings — to share with the sweep team.