Your car's hidden 'black box' and how to keep it private

Most commercial airplanes have an indestructible flight recorder known as a "black box” — even though the casing is actually bright orange — that records information from the flight computers. Another box records cockpit audio and other sources around the plane. In the event of a crash, investigators can recover the black boxes and find out exactly what happened.

Cars can have black boxes, too. In fact, it's a good bet your current car has one. And if it doesn’t, your next new car certainly will. That's why you should know exactly what that black box is recording, who can get the information and how you can stay in control.

A bit of history

Black boxes in cars aren't a new thing. They were installed in cars from Cadillac, Buick, Chevrolet and Pontiac in 1994 to help General Motors manufacturers learn how their cars performed in crashes.

Since the early 2000s, the National Highway Traffic Safety Administration has been collecting black box information to get a better picture of the circumstances surrounding accidents. Last year, 96 percent of new cars sold in the United States came with a black box. As of Sept. 1, 2014, every new vehicle must have one.

Black box data have been used in a few high-profile investigations. In 2011, Massachusetts Lt. Gov. Timothy Murray totaled a government car. He claimed he was driving the speed limit and was wearing a seat belt. Investigators used his black box data to show he was driving 100 mph and wasn’t buckled in at the time of the crash.

Wondering if your car has a black box? This site lists the year, make and model of nearly every car that has one. You can also check your car's manual. If you're buying a car from a dealership, it has to tell you if the car has a black box.

What do black boxes record?

While the first-generation event data recorders did little more than track whether the car's airbags deployed, recording and sensor technologies have become smaller and much more powerful. The NHTSA has mandated that every new recorder must track 15 variables, although older recorders might not have all of them.

The information includes vehicle speed, throttle position, airbag deployment times, whether the brakes were applied, whether seat belts were worn, engine speed, steering angles and more. Manufacturers may include up to 30 additional data points if they want, but they say they don't include GPS location, video or audio. Also, the black box stores information only for 20 seconds around the crash.

Still, many privacy advocates worry that the recording length might eventually increase and include more identifying information. That raises the question of who can access the data in the first place.

Who can pull the data?

Getting your hands on black box data requires professional training and a Crash Data Retrieval system that starts at $2,000 and can cost up to $20,000 with accessories. The CDR system plugs into the on-board diagnostics port under the dashboard on the driver's side and transfers the information to a special computer program.

Obviously, car manufacturers have the equipment. The NHTSA and law enforcement have the resources to get the information either directly or through specialized third parties. Third-party shops often pull the data as part of an accident reconstruction service. Insurance companies and law firms may also use third parties to get data for accident investigations or court cases.

Then there's the group everyone worries about — hackers. In most cases, I doubt hackers want your black box data. It would need to contain a lot more data on you to make it worth their while.

Hackers are more interested in hacking cars so they can take control of them from a distance. Unfortunately, they're getting good at it, and it's getting easier as cars become more and more computer controlled. Do you own one of the three most hackable cars in the world? Click here to find out.

That's the technical side of downloading black box data. There's a legal side as well. As of this writing, 15 states — Arkansas, California, Colorado, Connecticut, Delaware, Maine, Nevada, New Hampshire, New York, North Dakota, Oregon, Texas, Utah, Virginia and Washington — have passed regulations regarding who can pull the information with and without the car owner's permission.

You can find an up-to-date list of the states and their rules at the National Conference of State Legislatures site. In general, however, no one can pull data without your permission or a court order. Insurance companies can't use the data to set your rates unless you opt into a program, and those programs usually use another tracking unit. The rules are much less clear in states that haven't passed any legislation yet.

Can you keep your data private?

Still, anyone with a court order, or just the right tool and a little time, can get at your black box information. There's no way you can delete the data or disable the black box.

Fortunately, there is a simpler option. Products like AutoCYB, OBD Lock and OBD Saver put a lock on the diagnostic port so no one can plug anything into it without your permission. That keeps people from resetting information, extracting data or falsifying records that could be used against you.

Whether a court order would require you to hand over the keys to the lock is another story. I'll leave that one for the lawyers to decide. But you can at least make sure that nothing short of a court order lets someone get your data.

On the Kim Komando Show, the nation's largest weekend radio talk show, Kim takes calls and dispenses advice on today's digital lifestyle, from smartphones and tablets to online privacy and data hacks. For her daily tips, free newsletters and more, visit her website at Kim also posts breaking tech news 24/7 at