Gangs are using increasingly sophisticated kit to steal cars

Techniques for nicking phones have changed, too

IMAGINE MEETING a seasoned British car thief in 2013. They would probably have cut a sorry figure. Every year of their career, the grind had got harder. The tools of their trade, such as a coat hanger or “slim jim” (a flat metal strip) for bypassing locks and strippers for manipulating ignition wires, had, slowly but surely, been rendered obsolete, thanks to improved security technology. Business had dried up.

Photo: AFP

Not any more. The recent boom in car theft offers a window into an ever-shifting battleground. On one side are manufacturers, who make and sell products. On the other are thieves, who try to nick them. As the technology for providing security, and defeating it, has become better, and cheaper, the battle has speeded up.

Modern cars are sometimes called “computers on wheels”. That brought benefits but also vulnerabilities that carmakers were slow to grasp. The first was “relay attacks”, which became popular in Britain in 2016 after manufacturers introduced keyless ignition. A thief stands on a street and uses a device to “bounce” the electronic signal from a house to the car.

Manufacturers have designed that out in newer models. Now thieves are more likely to get in by plugging a device directly into one of the car’s electronic components, which tricks the car into thinking it is being contacted by a smart key. Adam Gibson, a police officer at Felixstowe port, points to several cars he has recovered that have been broken into using this technique: one via the tail-light, another via a component next to the bonnet latch.

The kit for this can be easily bought online. Videos on YouTube even explain how to use it. Most thefts are carried out by organised criminal groups, which will invest as much as £20,000 ($27,000) on a single piece of equipment. A police force says that, when it confiscated such a device, it bought only a quiet couple of weeks.

One challenge for manufacturers is the speed of criminal innovation. The timeline for designing and making cars is long; once criminal groups have found an entry point, they might have years of easy business. Another is cost. At the top end of the market, companies invest heavily in fixing vulnerabilities, partly because they worry that a rash of thefts will hurt their brand. For mid-market cars, price competition is fiercer, and drivers are less likely to blame the manufacturer if their car is stolen.

Criminals have similarly had to adapt their techniques when it comes to phones. The introduction of biometric locking and face identification made it harder for thieves to get into locked phones, rendering them less valuable. The response was a surge in “snatch thefts”, whereby thieves yank an unlocked phone from someone’s hand, and then disable tracking before the victim can report it lost.

Manufacturers have, in turn, developed motion-based theft-detection measures (a phone will lock in response to a jarring movement) and stolen-device protection (it requires a passcode when moved to an unfamiliar location). Yet the security of any system depends on humans. Many phone users do not turn on such features. Criminals have become adept at phishing for the personal information needed to unlock a phone. If all else fails, a locked phone can always be sold on for parts.

Manufacturers are often accused of dragging their feet. MPs have argued, for example, that Apple could easily undermine the business model of phone-snatchers by introducing a “kill switch”, but it won’t because of “strong commercial incentives”. That oversimplifies things. Manufacturers design security around passwords and locks, and already allow users to remotely “kill” their phone when it is locked. Introducing a kill switch for a phone that appears to have been legitimately transferred to a new user would create a host of new problems. A second-hand seller could, for example, try to extort money from a buyer by threatening to kill a phone post-sale. Manufacturers would struggle to design an infallible process for distinguishing thefts from legal sales.

A fairer conclusion is that—because its costs are socialised, via higher insurance premiums—theft is often a problem that no one has a strong incentive to fix.