Incredibly easy to hack, incredibly difficult to track
When Ian Fogg's Kia was stolen while he watched helplessly from abroad, three layers of modern technology — a doorbell camera, a hidden tracker, and a manufacturer's connected app — each failed in their own way to return his car. The incident reveals a quiet but widening gap between what consumers believe their connected vehicles can do and what those systems are actually designed to deliver, shaped as much by data protection law as by engineering choices. In an age when a smartphone carries stronger theft protections than a car costing many times more, the promise of the connected vehicle has quietly outpaced its reality.
- Thieves bypassed a modern Kia's keyless entry in moments, then severed the owner's digital connection to his own car before he could react from overseas.
- The manufacturer's tracking app, assumed by its owner to be a security tool, was governed by GDPR and UK data law — meaning location updates arrived 24 to 48 hours after the car had already moved on, eventually surfacing in Lithuania.
- Police lack the formal authority to demand real-time vehicle location data without rare Home Office approval, leaving a legal vacuum that thieves effectively exploit.
- A smartphone analyst points out the painful irony: his phone, worth a fraction of the car, has more robust theft protections — because the phone industry tightened security while the car industry moved the other way.
- Thatcham Research warns of a 'genuine and growing gap' between consumer expectations and connected car capabilities, urging drivers to invest in independently certified trackers with dedicated power sources rather than trusting manufacturer apps.
- With nearly 55,000 cars stolen in the UK in 2025 and only 13 percent ever recovered, Fogg's unreturned Kia stands as a measure of how far the technology still has to go.
Ian Fogg was overseas in March when his phone delivered an unwelcome notification: his access to his Kia's connected app had been cut off. Watching his video doorbell remotely, he saw thieves break into the car without a key and drive it away. He had three tools available — the doorbell footage, a hidden Apple Airtag, and Kia's Connect service — and none of them would bring the car back.
The Airtag worked briefly, until the thieves heard it beeping and discarded it. The Kia Connect app, which Fogg had assumed offered some security function, proved to be something else. Each time he submitted a location request — eight times in total — the data arrived a day or two after the car had already moved. By the time anything useful came through, his Kia was in Lithuania.
Kia was direct with the BBC: Connect is a convenience feature, not a security tracker. UK law and GDPR prevent the company from offering live location monitoring to customers, and even responding to an owner's own data request must follow data protection timelines measured in weeks, not minutes. Police, meanwhile, have no routine power to compel this information without Home Office approval — a threshold rarely met in vehicle theft cases.
For Fogg, a smartphone analyst, the contradiction was particularly sharp. His car and his phone share the same underlying radio and satellite technology, yet his phone carries stronger theft protections despite costing far less. 'This car was incredibly easy to hack but incredibly difficult to track,' he told the BBC, noting that the phone industry has hardened its security in recent years while the car industry has drifted in the opposite direction.
Thatcham Research has been raising this alarm for some time, describing a growing gap between what drivers expect from connected car apps and what those apps are built to do. Kia does offer a genuine real-time security tracking service — but only in the United States, as part of a premium subscription. It is not available in the UK.
The expert advice is unambiguous: do not rely on a manufacturer's app to recover a stolen vehicle. Independently certified trackers with their own power sources and professional monitoring centres exist precisely because connected car apps, however sophisticated, are not engineered for that purpose. With around 55,000 cars stolen in the UK in 2025 and only about 13 percent ever recovered, Fogg's missing Kia is a quiet reminder of the distance between what technology appears to promise and what it can actually deliver.
Ian Fogg was abroad in March when his phone lit up with a notification: he no longer had access to his Kia's connected app. By the time he saw the alert, thieves had already broken into the car without a key, disconnected him from the entertainment system, and were driving it away. He watched it happen on his video doorbell. He had three tools at his disposal—the doorbell footage, an Apple Airtag hidden in the vehicle, and Kia's Connect tracking service—and none of them would get his car back.
The Airtag worked briefly, until the thieves heard it beeping and threw it out. The Kia Connect app, which Fogg assumed was a security feature, turned out to be something else entirely. When he contacted Kia to request his car's location, he was told to fill out a form. He did this eight times. Each time, the location data arrived 24 to 48 hours after the car had already moved on. By the time he had any useful information, his Kia was in Lithuania.
Kia's response to the BBC was blunt: Connect is a convenience feature, not a security tracker. The company explained that UK law and GDPR—Europe's data protection regulation—prevent it from offering live location monitoring to customers. Even when Fogg requested his own vehicle's location, the company had to navigate data protection rules that require responses within a calendar month, not minutes. Police have no formal power to demand this data without Home Office approval, which rarely happens in theft cases. Individual manufacturers decide whether to share information with law enforcement at all.
Fogg, a smartphone analyst, found the contradiction maddening. His phone and his car both contain mobile radios, satellite chips, and sophisticated software. Yet his phone has stronger theft protections than his car, despite costing a fraction of the price. "This car was incredibly easy to hack but incredibly difficult to track," he told the BBC. "It shouldn't be this easy to nick a car when they cost an order of magnitude more than a phone and have similar radio technology." The phone industry has tightened security in recent years. The car industry, he observed, has moved in the opposite direction.
Thatcham Research, a car safety firm, has been warning about this gap for some time. There is, they say, a "genuine and growing gap" between what consumers think their connected car can do and what it actually does. Kia does offer a real security tracking service in the United States—part of a premium subscription package—but it is not available in the UK or Europe. For British drivers, the company's advice is to contact Kia if a theft occurs and wait for a response.
The experts' recommendation is clear: if you want to recover a stolen car, do not rely on the manufacturer's app. Instead, seek out devices that have been independently certified as dedicated vehicle trackers. These should have their own power source and provide genuine real-time monitoring through a professional center. "These products exist precisely because most connected car apps, however sophisticated, are not engineered to perform the security function that owners may assume it provides," Thatcham notes.
The numbers suggest the problem is real. Nearly 55,000 cars were stolen in the UK in 2025, down 11 percent from the year before. But only about 13 percent of stolen vehicles are ever recovered. Fogg's Kia is not among them. His story is a cautionary tale about the distance between what technology promises and what it can actually deliver when it matters most.
Citas Notables
This car was incredibly easy to hack but incredibly difficult to track. It shouldn't be this easy to nick a car when they cost an order of magnitude more than a phone and have similar radio technology.— Ian Fogg, smartphone analyst
Kia Connect is a customer convenience feature, not a certified security vehicle tracker. Therefore, it does not provide live-tracking functionality for stolen vehicles.— Kia, in statement to BBC
La Conversación del Hearth Otra perspectiva de la historia
Why would Kia design an app that can see where the car is but won't tell the owner in real time?
They say it's a legal issue—GDPR and UK data protection law. But there's also a business question: they're not liable if they call it a convenience feature instead of a security tool. The liability shifts to you.
But Kia offers live tracking in America. Same company, same car.
Different legal framework. The US doesn't have GDPR. So Kia built the feature there because they could. In Europe, they decided the compliance burden wasn't worth it. It's cheaper to say no than to engineer a compliant system.
Couldn't they just share the data with police faster?
They could, but police don't have formal power to demand it without Home Office approval. And manufacturers aren't obligated to cooperate. It's voluntary. So Kia's incentive to move quickly is zero.
What's the real problem here—the law or the company?
Both. GDPR is strict about data sharing, which is good for privacy. But it wasn't written with stolen cars in mind. And manufacturers have chosen to interpret it as a reason not to build the feature at all, rather than build it carefully.
So what does Fogg do now?
Buy an independent tracker. Something with its own power source that doesn't depend on the car's systems or the manufacturer's goodwill. It's the only thing that actually works.