Ola Electric gets takedown notice from customer after making telemetry data public

Questioning the data

“For 10 days, the scooter was with you (Ola Electric). How do I know the data of the scooter was not tampered with during that period? Where is the opportunity to challenge this data? If this was done in my presence — like if they opened the scooter and investigated in front of me — I would not have questioned the legitimacy of the data,” Reetam Singh told Moneycontrol.

Reetam Singh’s father, Balwant Singh, said in his notice that the company should not have made the scooter’s telemetry data public.

“Ola and I signed an agreement to share data only for private access. The posting of telemetry data online is a breach of the privacy agreement between me, the user, and Ola Electric, the seller,” Balwant Singh said in the notice. “I had categorically requested you via tweets to provide the data via email only. But you failed to provide me the same via email but chose to make my data public. Also the data was extracted not in my presence whereby I question the authenticity of the claims.”

Recalling what happened that night after he hit the brakes, Reetam Singh said: “When the speed increased and the scooter went over the bumper, it was airborne for a few seconds. When it hit the ground, the bike toppled. It then skidded for 20-30 metres before stopping at a divider,” Singh said.

What followed was not just the physical trauma of a broken left hand and 16 stitches on the right hand for the 29-year-old lawyer. It also was the start of a tussle with Ola Electric over what actually happened.

After a few weeks, Balwant Singh took to social media to air his concerns over the apparent lack of safety of the electric scooter and the post-accident response from Ola Electric.

Singh in his posts said that an Ola Electric executive contacted him on April 11 after he raised the issue of the allegedly faulty brakes of the vehicle.

“Once they picked up the vehicle on April 11, for 10 days, the vehicle was at their workshop. Neither were we asked to come over there nor was anything informed to us regarding the tests that were taken up on the vehicle,” Reetam Singh said on a phone call. Singh said Ola Electric returned the vehicle on April 21.

Minister’s tweet

“I had asked them to show me a receipt of the vehicle which showed what repairs they did – to which they said the throttle and the brakes had been changed. I had also asked them to send me the investigation report formally over email, to which the Ola Electric representative said that it was proprietary data of Ola and that it cannot be shared,” he said.

Transport minister Nitin Gadkari said on April 21 that the government was constituting an expert committee to enquire into mishaps involving electric two-wheelers and based on its reports, it would issue necessary orders.

Ola’s response

A day after Gadkari’s announcement, Ola Electric came out with its clarification regarding the Guwahati incident, which has since evoked mixed reactions. 

Ola Electric said in the statement that it had thoroughly investigated the accident and there was nothing wrong with the vehicle.

It provided data of the vehicle’s speed, which it said clearly showed that the rider was speeding and “that he braked in panic, thereby losing control of the vehicle.”

Ola Electric, which tracks vehicle sensor data in real time in its cloud, showed speed data for the 30 minutes leading to the time of the accident. It highlighted three sections where the rider rode in hyper mode, reaching top speeds of 115 kmph in the first two sections and 95 kmph in the third section.

In another graph, Ola Electric showed that in the final section, Reetam Singh had allegedly applied all three brakes together and the speed was brought down from 80 to 0 kmph within three seconds. There was no sudden torque or acceleration after braking, Ola Electric said.

However, Singh does not agree with the data.

“The numbers don’t make sense. My claim has been that I was driving at 60 kmph and when I applied the brakes, the speed increased from 60 kmph to 85 kmph and then it decreased. Later in the graph, they also showed that it went from 85-0 kmph in three seconds. How is that possible? A sports car would have similar braking. And would I be alive if the scooter indeed went from 85-0 kmph in three seconds?” Singh asked.

Privacy vs transparency

While many people appreciated Ola Electric’s response and hailed the ‘transparency’ of connected vehicles and the usage of data to prove a point, for many it was a privacy concern. The fact that connected vehicles including EVs collect user data is not new and neither is it limited to Ola Electric. However, many customers are not aware of it.

“I had no idea that they were collecting my data,” Reetam Singh said.

Regardless, when he bought the electric scooter, his father Balwant Singh had agreed to Ola Electric’s privacy policy, which allows the collection of such data.

“To further improve your Product and safety, to facilitate the (helpdesk) servicing of your Product and to give you insight on your driving behaviour, we will collect certain telematics data from the vehicle. This may include personal information, such as vehicle identification number, and other device related information, such as performance, usage, operation, condition of your vehicle, etc. We collect such information either in person (such as during a service appointment), or via remote access or through App,” Ola Electric says in its privacy policy.

Ola Electric’s privacy policy also allows for sharing of such data.

“We may also disclose personal information if we determine in good faith that disclosure is necessary to protect our rights, resolve legal conflict, enforce our terms and conditions, investigate fraud or protect our users,” Ola Electric’s policy said.

However, the company does not specify where the data will be disclosed. Ola Electric’s policy page also does not provide timestamps to any updates that they may have taken up.

“The company is not doing anything wrong,” said Siddharth Jain, cofounding partner of PSL Advocates & Solicitors. “What the company has shared is not personal data, but data pertaining to the device of the scooter. I think the company is within their rights to share the data on a public platform when the allegations that were levelled against the company were also on a public platform. If the person in question had directly gone to the court, then this could have been avoided.”

Data integrity

However, some experts raised the issue of the sanctity of the data released by Ola Electric.

“Ola Electric is publishing the data in a processed format. Would the consumers also have access to the same raw data so that they will be able to commission an independent verifier to arrive at a conclusion?” asked Sankarshan Mukhopadhyay, technologist and contributor at Privacy Mode of Hasgeek. “What we have in public is visualised data from the company that says that they are not at fault. There is a conflict of interest here. It is in their interest to say that they are not at fault. How are you going to prove that you did not tamper with the data? How did you maintain data integrity?”

Cybersecurity expert Anand Venkatanarayanan pointed out that in criminal cases when the police or other law enforcement officials seize an electronic device like computers or smartphones, they have to give the accused or the suspect a panchnama. A panchnama for an electronic device would contain a copy of the image of the device along with its hash value.

“This hash value is absolutely necessary to prove the sanctity of the data and to prove that it has not been tampered with,” Venkatanarayanan said. “If the police don’t give that, in court of law it will be inadmissible by evidence.”

In this case, Venkatanarayanan pointed out there was no way to know whether the integrity of the data was maintained.

Moneycontrol reached out to Ola Electric with a series of questions on the issue of data ownership and the integrity of the data that was published in its statement. This article will be updated when a response is received.

Computers on wheels

According to Venkatanarayanan, EVs are fundamentally different and people must understand it’s not just a vehicle but a computer with wheels.

“Every EV product that is going to come into the market from now on is basically a computer on wheels,” Venkatanarayanan said. “Once one understands that, all questions that one may ask for, say, an Android phone, will apply to an EV vehicle. For instance, is there a vulnerability in the software? Every time the software is upgraded, what is the new stuff that is going inside the system? Where is my data being stored?”

It is necessary for customers to become more aware of the data collection and sharing practices of connected vehicles.

“What data are you collecting? How are you collecting? How long are you storing? What are you going to do with it? And do I even get a say in all of this?” Mukhopadhyay said, pointing out the facets of data collection that EV customers should be aware of.