Waymo has opted not to respond to WIRED’s inquiries regarding the specifications of its vehicle cameras, the duration for which footage is stored, or whether any recordings have been provided to U.S. federal law enforcement or military bodies. However, a representative from Waymo, Karp, highlighted that the engineering team utilizes data from a variety of sensors, encompassing video footage, for simulations designed to enhance their technology. Additionally, Karp reaffirmed that there are strict controls in place governing data access and retention timelines.
Waymo currently operates its robotaxi services in the Phoenix metropolitan area as well as select parts of San Francisco, Los Angeles, and Austin. Despite its relatively short operational history within these regions, the company has demonstrated a readiness to cooperate with law enforcement requests for video footage.
Since 2016, police departments in Mesa and Chandler, Arizona, have been utilizing Waymo’s footage for criminal investigations, a practice that has persisted since the vehicles were first introduced in those municipalities. Police sources reported that video data played a critical role in several cases, including one involving alleged road rage, where the accused ultimately pled guilty to disorderly conduct.
In May 2022, following the initiation of limited robotaxi operations in San Francisco, it was reported that a training document issued to local police explicitly indicated that footage from autonomous vehicles could be beneficial in generating investigative leads. The police were informed that this technology could serve as mobile surveillance tools during investigations.
As of early 2023, Waymo has faced at least nine search warrants in both San Francisco and Maricopa County, Arizona. Among these cases was the homicide of an Uber driver in 2021. Although San Francisco police could not pinpoint a specific Waymo vehicle near the crime scene, they asserted there was reasonable belief that Waymo vehicles had captured footage relevant to the investigation. Waymo complied with the request but the evidence did not result in an immediate arrest; the suspect was convicted in 2023.
In a recent incident, Waymo filed lawsuits against two individuals for allegedly vandalizing its vehicles, citing camera footage as part of the evidence in these cases. One of these legal proceedings remains open, while the other was dismissed last month.
The practices surrounding Waymo’s data collection are not isolated to the company; vehicles equipped with self-driving technology universally rely on a combination of lidar, radar, and video data to navigate. Other firms in the space, such as Cruise, the defunct self-driving car initiative from General Motors, have also provided video footage to law enforcement agencies at their request.
Private vehicle owners equipped with camera technology can voluntarily furnish footage to law enforcement. Notably, police in Berkeley, California, have received footage from a Tesla Cybertruck owner who reported two incidents of vandalism this year.
Examining these incidents through a cybersecurity lens reveals potential vulnerabilities in data handling and access protocols. Within the MITRE ATT&CK framework, tactics such as initial access and privilege escalation may be relevant, especially given the sensitive nature of the data being managed. The implications of such data management practices warrant careful consideration for businesses engaged in similar technological advancements, particularly in ensuring compliance with emerging regulatory landscapes and best practices for safeguarding data integrity.
