Last night, ABC's Four Corners program aired "Asleep at the Wheel", and I want to start by giving credit where it's due. Reporter Angus Grigg did the thing most journalists refuse to do when it comes to technology: he stopped talking about risk in the abstract and went and proved it, on camera, in a moving car. Bravo. The cyber specialist he worked with, Dan Hreszczuk from Fortify Labs in Canberra, turned a fortnight with a vehicle into a very persuasive security demonstration. Bravo again. And Michael McLaren on 2GB this afternoon kept the pressure on, connecting the dots (as best he could) between consumer subsidies flying out the door and oversight that never left the driveway. Bravo. This is what public-interest work looks like when everyone does their job.
The front door was wide open
The canary in the coalmine was a BYD Shark 6 - the best-selling Chinese plug-in ute in the country. Over 12,000 versions of the Shark 6 have found homes in Australia this year according to the FCAI. I've driven most of these new EVs, Chinese and otherwise, and I'll happily say: the Shark 6 is attractive, well specified, the price is sharp compared to its ICE competitors, and I understand exactly why families and business owners (including the NSW Government) are buying them by the boat-load. That's the whole problem. The convenience is real. The price of that convenience, however, is ignorance.
Grigg drove the 2.6-tonne ute at about 30 km/h down a dark country road outside Canberra. Hreszczuk sat on the roadside with a laptop and, with a keystroke, killed the headlights - plunging the driver into total darkness at speed. He triggered the wipers and turned the Shark 6 into a mobile lighting rig for a rave. In another example, Hreszczuk enabled the cabin microphones and listened to private conversations in real time.
Watch the full Four Corners episode here:
The toaster paradox
So how does the government respond to 2.5-tonne connected supercomputers rolling around every suburb? It doesn't. Not yet.
Under the Cyber Security Act 2024, Australia now mandates security standards for smart home gadgets - no default password on your router, your smart TV, your connected fridge, or baby monitor. Good. Sensible. But cars are exempt. The consultation on automotive cyber standards only started in mid-2026, and binding rules are years away.
Minister Tony Burke defended this on Four Corners, arguing you "first regulate where you will get the fastest uplift" and where "the cyber attacks have principally been." Read that back slowly. The government's position is that it will secure your kitchen appliances before it secures the machine your family rides in - the one with cellular connectivity, cameras, microphones, LiDAR and continuous location tracking. Almost every new car sold in this country is now connected. ICE, PHEV, or EV. Location, diagnostics, telematics, remote access - it's all live, all the time. Regulate the toaster, wave the mobile-supercomputer through. That's not a strategy. That's a category error dressed up as prioritisation.
All this as the Tesla fan-boys and girls are giddy about the Cybercab coming to Australia one day soon. Good luck with that legislation.
Asleep at the wheel, literally
The title wasn't just a metaphor for policy drift and social media clicks. The Ministers are, by their own conduct, the case study.
Climate and Energy Minister Chris Bowen - who sits on the National Security Committee of Cabinet - drives an XPENG G6. Four Corners pointed out to Mr Bowen that real-time telemetry and his home address were available to XPENG. When Grigg put it to him, Bowen was dismissive. He sees an EV as an energy-transition asset, not a potential surveillance node.
Trade Minister Don Farrell owns the very BYD Shark that got hacked on screen, and once called it the "best ute I've ever owned" - this despite standing ASIO advice warning ministers not to conduct sensitive business in connected foreign vehicles. And Burke, the Cyber Minister himself, is out there defending appliance-first triage while the attack surface keeps growing. It isn't one bad call by one Minister. It's a whole front bench treating the risk as somebody else's department.
And whilst these Chinese cars disclose these security weaknesses, keep in mind that most modern cars have some form of connectivity. A six year old BMW has the same level of connectivity as the latest Toyota. Any vehicle (car, truck, tractor) that offers Over-the-Air (OTA) updates will have an active 4G connection supplied and paid for by the manufacturer.
Nobody in the room builds cars
Here's the part that actually boils my blood, and it's structural, not personal.
Look at who advises the Government on security. The 2023–2030 Cyber Security Strategy was shaped by an Expert Advisory Board chaired by Andy Penn - former Telstra CEO, an accountant by trade - alongside senior ex-military and bureaucratic figures. The Executive Cyber Council is stacked with legacy ASX C-suite: banks, telcos, airlines, supermarkets. These are capable people. They are also, almost to a person, generalists whose knowledge base was built for a different problem, and it's ill-suited to the needs of today's Australian consumer.
Count the specialists actually needed here and see how many are in the room: automotive cyber researchers, embedded-systems engineers, firmware vulnerability analysts, hardware teardown people. The answer is roughly none. So the entire agenda drifts to what that room understands - enterprise IT reporting, ransomware disclosure, appliance labelling - and the hard stuff, CAN-bus segmentation and firmware-over-the-air validation, never gets touched. Alastair MacGibbon, who used to run the national cyber shop, has been making this point for a while: policymakers treat cyber as an administrative paper exercise, when it's actually the physical attack surface of a rolling sensor suite. When your advisers can't read the schematic, you get policy that regulates paperwork and ignores the wiring.
For contrast: the EU has mandated proper vehicle cybersecurity and software-update management systems - UNECE R155 and R156 - for every new car since July 2024. The US has moved to ban Chinese and Russian connectivity software from connected vehicles. Australian consumers get a consultation and a shrug of the shoulders. That gap is why Australia risks becoming the soft market where unsecured software gets dumped.
Taking control
Here's where I climb down off the policy soapbox, because we know we can't wait for Canberra, and you don't have to. This isn't only a China story either - Mozilla reviewed 25 major brands from Detroit to Munich to Seoul and called the automotive sector the worst product category for privacy it had ever assessed. Every connected car is watching. So the useful question isn't "which badge do I trust." It's "what can I do today."
More than you'd think. There are relatively simple steps anyone can take to cut their risk dramatically, whatever the device.
A password is not security. Someone - or something - set that default, and its pattern is known. Did we learn nothing from the Leveson Inquiry into messagebank hacking in the UK? The BYD gateway had no password at all, and that's the extreme version of the same disease that lets attackers walk into millions of homes.
So: always change default passwords, on everything, the day it arrives. If you have the wherewithal, set up a separate WiFi network in your home for IoT devices so they cannot connect to your PCs or Smartphones. Turn on two-factor authentication (2FA) everywhere it's offered; it's the difference between one stolen secret and a stolen life - or life-savings. And use a password manager - I use and highly recommend 1Password - so every login gets a long, unique password you never have to remember or reuse.
None of that secures your car's gateway; only the manufacturers and, eventually, regulators can do that. But these simple changes harden everything else in your orbit, meaning that when your car's stereo tries to impersonate you to your own phone, there's a lot less sitting there to steal.
Grigg and Hreszczuk did the country a real service last night. The least we can do is stop leaving our own front doors open while we wait for the government to notice cars have them too.