By Andrew Klein and Sera Elizabeth Klein

Reader’s note: We do not need readers to agree with us. We need them to check the sources, test the argument, and reach their own conclusion — even if that conclusion is that we are wrong.

Abstract

This paper examines the Australian Broadcasting Corporation’s Four Corners investigation into cybersecurity vulnerabilities in a Chinese-manufactured vehicle, aired on 21 September 2026. It argues that while the investigation identified a genuine and serious technical flaw, the program’s framing — that this represents a state-sponsored espionage operation targeting Australian motorists — is a speculative extrapolation not supported by the evidence presented. It further argues that the same vulnerabilities are documented in vehicles manufactured by other nations, including Tesla (United States), and that the Australian Army’s 2021 removal of Israeli-developed battle management software on security grounds establishes a precedent that espionage concerns are not exclusive to any single country. The paper examines the ABC’s statutory obligations under its Charter, traces the broadcaster’s observed drift from its editorial standards from the tenure of Ita Buttrose to the current chairmanship of Kim Williams, and analyses the pattern of complaints and corrections that raise questions about journalistic consistency. It concludes with a warning: in a period when democracy is under attack on multiple fronts, a respected source of information moving to embrace the role of political messaging is a very real threat to informed decision-making.

I. Introduction: The Report and the Question

On the evening of 21 September 2026, the ABC’s flagship current affairs program Four Corners broadcast an investigation titled “Asleep at the Wheel”. The program, reported by Angus Grigg, documented how a cybersecurity researcher, Dan Hreszczuk of Fortify Labs, was able to remotely access and control key functions of a BYD Shark 6, a plug-in hybrid ute manufactured by the Chinese company BYD.

The investigation was given additional credibility by commentary from Alastair MacGibbon, Australia’s former national cyber security advisor, who said that “connected vehicles by their nature have functionality that can be abused” and that China’s security agencies could gain access through BYD because “it’s a feature of the vehicle”.

The program raised a question that this paper examines: what did the investigation actually demonstrate, and what did it imply? The distinction matters — not because the technical vulnerability is unimportant, but because the leap from a demonstrated flaw to a geopolitical threat requires a chain of inference that the evidence presented does not support.

II. What the Report Demonstrated

2.1 The Technical Flaw

The Four Corners investigation showed that the BYD Shark 6 had a digital access point with no password. This single vulnerability allowed Hreszczuk, working from the roadside with a laptop, to:

· Lock and unlock doors, control the stereo, and display images on the infotainment screen;

· Activate the windscreen wipers and sprayers at full speed, and repeatedly turn the headlights on and off;

· Track the vehicle in real-time as it drove around Canberra;

· Activate the car’s microphone to listen in on a phone call the driver was having, and even crack a password mentioned during that call.

The demonstration took place at approximately 30 km/h on a straight country road outside Canberra — a “proof of concept,” not a demonstration of a weaponised capability for use at highway speed. Hreszczuk could not access the brakes or cameras, which were protected by stronger security.

BYD responded that it “takes vehicle security very seriously” and was “taking full and immediate action in reviewing specific claims made in the article relating to unauthorised remote access of certain vehicle functions”.

2.2 The Leap to State Espionage

The report’s most significant claim was not technical but political: that China’s security agencies could exploit these functions through BYD. This inference rests on a legal, not a technical, foundation. China’s National Intelligence Law and Counter-Espionage Law obligate Chinese companies to cooperate with state intelligence requests, including providing access to data. BYD’s public statement that it has “not and would not transfer any data of Australians to Chinese authorities” is therefore legally contestable, as it could be compelled to do so.

However, this is a legal potential, not proof of an active operation. The report does not present evidence that BYD has been compelled, that such a request has been made, or that any data has actually been transferred to Chinese intelligence. It presents a vulnerable system and a legal framework that could, in theory, be used to exploit it.

2.3 The Data Transmission Problem

A single connected vehicle can generate enormous volumes of raw data. Transmitting that volume from a passenger car to a server in China in real-time would require bandwidth that the vehicle’s connectivity systems are not designed to provide. While Chinese automakers are integrating 5G and satellite communication capabilities into vehicles, these systems are designed for navigation, infotainment, and emergency services — not for continuously streaming terabytes of sensor data to a foreign intelligence hub.

The more plausible surveillance model is not mass data exfiltration, but targeted access. The legal compulsion mechanism would allow Chinese authorities to request specific data on a specific vehicle or individual, which is a far more feasible and covert operation.

III. The Generalised Vulnerability: A Sector-Wide Risk

3.1 Tesla: The American Precedent

The same cybersecurity risks identified in the ABC’s report are documented in Tesla vehicles, manufactured in the United States.

In late 2021, German security researcher David Colombo exploited a vulnerability in TeslaMate, a third-party data logger, to remotely control 25 Teslas across 13 countries. He could unlock doors, open windows, blast music, start each vehicle, and gather private data including detailed driving routes. He could not control steering, throttle, or brakes — the same limitations reported in the BYD case.

The vulnerability was not in Tesla’s core software, but in third-party software that stored API keys unencrypted. Colombo emphasised that it was “the fault of the owners, not Tesla” — but the incident revealed a systemic risk in the connected vehicle ecosystem, regardless of manufacturer nationality.

3.2 Over-the-Air Technology: An Industry-Wide Risk

The Australian Strategic Policy Institute (ASPI) has identified Over-the-Air (OTA) update technology as a sector-wide vulnerability. OTA technology was pioneered by Tesla, which began deploying it to Model S vehicles in 2012. It is now “embedded across much of the automotive sector”.

ASPI’s own researcher, Jason Van der Schyff, noted that the growing penetration of OTA technology “makes it more susceptible to cyberattacks” and that the potential for a foreign actor to sabotage the controls of a moving vehicle is “a unique national security concern”.

The Norwegian bus company Ruter conducted tests on two Yutong buses and found that one had “access to the control system for battery and power supply via mobile network through a Romanian SIM card” — meaning the bus could “be stopped or rendered inoperable by the manufacturer”. This investigation sparked similar inquiries in the United Kingdom and Denmark.

The American Enterprise Institute warned in May 2026 that safeguarding the automotive sector was crucial to limit foreign governments’ espionage capabilities, recommending “additional security reviews, implement restrictions on certain foreign-made hardware and software in vehicles, and mandate increased data-collection disclosures”.

3.3 The ASPI Assessment: Risk, Not Threat

ASPI’s own analysis is precise: “The core risk is not simply that a bus is made in China. It is that digitally enabled technology introduces vulnerability into critical infrastructure unless it is secured by design, properly configured and actively governed”.

It notes that “foreign actors do not need privileged supply-chain access to exploit them. They can target misconfiguration, weak identity controls or third-party compromise instead”.

Crucially, ASPI distinguishes between risk and threat: “A threat implies intent. Risk reflects exposure and uncertainty. Uncertainty is not proof of wrongdoing. But it does reveal a governance and assurance gap that cannot be closed through blanket bans alone”.

This is the assessment that the Four Corners report did not adequately convey. The vulnerability is real. The threat is speculative.

IV. The Elbit Precedent: Security Concerns Are Not Country-Specific

4.1 The 2021 Removal

The Australian Army’s experience with Elbit Systems provides a powerful precedent: security concerns can override strategic alliances.

In May 2021, Army Headquarters issued a directive ordering Defence to “cease use” of the Elbit Systems Battle Management System (BMS-C2) version 7.1, in preparation for a replacement system. The order stated: “The employment of the BMS-C2 system version 7.1 within Army’s preparedness environment is to cease no later than May 15 2021”.

Military sources told the ABC there were “definite concerns that the Israelis are backdooring the system for information”. The directive demanded that items such as USB memory sticks and software “be withdrawn from issue to users and consolidated and quarantined by signals support staff”.

4.2 The Denial and the Outcome

Elbit Systems of Australia “strongly refuted” the security rumours. Managing Director retired Major General Paul McLachlan said: “Unnamed, unsubstantiated sources are the ones that frankly have been responsible for the shrill and hysterical speculation about us being involved in espionage”.

Army Chief Lieutenant General Rick Burr told a parliamentary hearing the decision was down to “a lack of accreditation of the current version of software”.

Despite the denial, the system was stripped from Army vehicles. A subsequent independent review, jointly funded by Defence and Elbit, criticised the Defence Department’s handling of the project but did not clear the technology of the espionage risk.

The Elbit case confirms that cybersecurity fears are not limited to geopolitical adversaries. A close ally — Israel — had its technology removed from Australian military vehicles on security grounds. The same standard should apply to all connected vehicle technology, regardless of nationality.

V. The ABC Charter: Obligations and the Question of Consistency

5.1 The Statutory Duty

The ABC is governed by the Australian Broadcasting Corporation Act 1983, which includes a Charter setting out its functions. The Act “enshrines the importance of the ‘independence and integrity’ of the ABC and the need to ensure its presentation of news and information is accurate and impartial”.

The ABC’s Editorial Policies state that the Corporation “has a statutory duty to ensure that the gathering and presentation of news and information is impartial according to the recognised standards of objective journalism”. The Policies set out five impartiality standards, including the requirement to “present a diversity of perspectives within a reasonable timeframe, aiming to reach a similar audience, so that no significant strand of thought or belief within the community is knowingly excluded or disproportionately represented”.

The editorial policies also require that “editorial decisions are not improperly influenced by political, sectional, commercial or personal interests”.

5.2 The Selective Standard

The Four Corners report focused exclusively on a Chinese-manufactured vehicle. It did not include comparable investigations into Tesla or other Western manufacturers, despite the documented vulnerabilities in those vehicles and the industry-wide nature of the OTA risk identified by ASPI and others.

This creates the impression of a politically motivated narrative rather than a balanced examination of a genuine industry-wide risk. The report was given additional credibility by commentary from Senator James Paterson, who has a documented history of raising alarms about Chinese technology, and by the timing of the broadcast, which followed remarks by Australia’s top spy, Mike Burgess, that China was “the principal concern” as a cybersecurity threat.

Notably, Burgess himself said it was important to “not just focus on Chinese cars” because “most cars today have their…” connected systems — a point that the Four Corners framing did not emphasise.

5.3 The Pattern of Complaints and Corrections

The ABC’s Middle East coverage has generated 8,000 complaints related to Israel-Gaza coverage between October 2023 and May 2026, out of a total of 19,000 content complaints settled by the Ombudsman’s office. In the six months July–December 2025, 51 per cent of complaints claimed the ABC’s Israel-Gaza coverage was broadly pro-Palestinian and 47 per cent claimed it was broadly pro-Israel.

The ABC’s Ombudsman acknowledged that “at times the ABC is slow to correct and clarify”. The editorial director conceded a “bad mistake” in a report that falsely claimed 14,000 babies would starve within 48 hours in Gaza — a story that was corrected on-air 10 hours after the first report and online only seven days later. Counsel assisting the Royal Commission into Antisemitism put to the editorial director a “pattern of late and inadequately prominent corrections”.

These complaints and corrections do not, on their own, prove political bias. But they do establish a pattern of editorial lapses that raise questions about the consistency of the ABC’s adherence to its Charter obligations.

VI. Timeline: From Buttrose to Williams

6.1 The Buttrose Era (2019–2024)

Ita Buttrose was appointed ABC chair in 2019 by the Morrison government. Her tenure was marked by a series of editorial controversies and a broader perception of political accommodation.

In November 2019, Buttrose “pulled” an episode of Q&A over a “call to violence” and was reported to have “ruled out” the creation of a staff advisory group on climate coverage. Headlines such as “Ita Buttrose urged to scrap MeToo documentary” added to a perception of editorial caution.

In June 2020, the ABC board, under Buttrose, produced a five-year plan that was described by critics as “spin for managed decline” — a plan that involved cutting up to 250 staff, axing the iconic 7.45am radio news bulletin broadcast since 1939, and reducing travel budgets, all while the broadcaster faced funding cuts from the Morrison government.

The plan was seen as a response to the $83.7 million indexation cut applied from July 2019, on top of earlier funding reductions. In real terms, ABC operational funding was projected to be “more than 10 per cent lower in 2021-22 than it was in 2013”.

6.2 The Williams Era (2024–Present)

Kim Williams was appointed ABC chair in 2024. His tenure has been marked by explicit denials of editorial bias and a series of public disputes about the ABC’s editorial direction.

Not long after he started, Williams gathered all the editors from around the country to address them about his vision. The speech “did not go down well.” One former colleague observed: “The editors were like, ‘This guy thinks he’s going to have power over us.’ He was trying to ‘alpha’ them, and it wasn’t going to cut it”.

In April 2025, Williams was accused of interfering in editorial decision-making after the ABC’s Media Watch program reported that he had pushed for teams to offer airtime to a comedian. Williams “flatly denied” the allegations, saying “I did not at any time intervene”.

In July 2026, Williams appeared on Sky News for a tense interview in which he “flatly denied any editorial bias” at the ABC. He said he had “no idea how the overwhelming majority of people at the ABC vote, and nor would I seek to find out”. When questioned about the ABC’s climate coverage, he said: “I don’t think the ABC is an advocate in any of these environments. It reports in relation to issues of consequence in a disciplined and fair-minded fashion”.

When questioned about the ABC’s Middle East coverage, Williams defended it, noting that a key error had been corrected and apologised for. But the interviewer pressed: “I think the important point is that this shows a propensity to always believe the worst about Israel, even if it is completely implausible”.

Williams also took aim at One Nation, dismissing the party as a “policy-free zone” — a comment that raised questions about whether the chair of the public broadcaster should be making political characterisations of elected parties.

6.3 The Trajectory

The trajectory from Buttrose to Williams is not a simple story of increasing bias. It is a story of increasing scrutiny of the ABC’s editorial decisions, and of the broadcaster’s defensive posture in response.

What has changed is not necessarily the content of the ABC’s reporting, but the perception of it. The broadcaster that was once criticised for attacking governments and holding power to account is now perceived by a significant portion of the public — and by a Royal Commission — as having drifted into a role that is less about scrutiny and more about advocacy.

VII. The Broader Pattern: Selective Standards and Political Beat-Ups

7.1 The “Spy Car” Narrative

The Four Corners report is not an isolated case. Earlier in 2026, similar “spy car” narratives circulated in Australian media. Many Australian netizens were indifferent or openly mocked the claims, suspecting a double standard or ulterior motives.

One analysis noted that the ABC “circulates threat inflation through institutional credibility, which is considerably harder to unwind once spent”.

7.2 The Real Risk

Critics of the narrative argue that while the spy-car story circulates, Australia’s actual transport-related national security vulnerabilities are being overlooked. The ASPI analysis is clear: “The core risk is not simply that a bus is made in China. It is that digitally enabled technology introduces vulnerability into critical infrastructure unless it is secured by design, properly configured and actively governed”.

The Elbit case proves that this risk is not limited to any single country. A close ally — Israel — had its technology removed from Australian military vehicles on security grounds. The same standard should apply to all connected vehicle technology, regardless of nationality.

7.3 The Charter Obligation

The ABC Charter requires “accurate and impartial” news “according to the recognised standards of objective journalism”. The Four Corners report identified a genuine vulnerability. That vulnerability should be addressed. But the framing — that this represents a large-scale, state-sponsored espionage operation — is a speculative extrapolation.

It is built on a legal possibility (compulsion), a demonstrated vulnerability (no password), and a political narrative (China as a threat). It is not supported by evidence of an actual, ongoing espionage campaign.

This is not to say the risk is zero. It is to say that the evidence presented demonstrates a technical flaw, not a geopolitical operation. The leap between the two is where the journalism ends and the politics begins.

VIII. Conclusion: The Threat to Democracy

The technical vulnerability is real, and it affects all connected vehicles. The Australian Army’s experience with Elbit proves that espionage concerns are not exclusive to any single country. The ABC’s report, however, appears to apply a selective standard — highlighting the risk in Chinese vehicles while overlooking it in others. This is not a failure of the technology. It is a failure of journalistic consistency.

By focusing on one country, the report risks becoming political advocacy rather than impartial journalism — a concern that goes to the heart of its Charter obligations.

In a period of time when democracy is under attack on so many levels, a respected source of information moving to embrace the role of political messaging is a very real threat to democracy. Unbiased information is essential for informed decision-making. When the public broadcaster applies a selective standard — amplifying threats from one source while ignoring comparable threats from others — it does not inform the public. It shapes the public. And a public that is shaped rather than informed is a public that cannot hold power to account.

The ABC Charter enshrines the importance of “independence and integrity” and the need to ensure “accurate and impartial” news. These are not optional. They are the conditions of the broadcaster’s legitimacy. When they are compromised — or when they appear to be compromised — the legitimacy is compromised with them.

The question is not whether the ABC should report on cybersecurity risks in connected vehicles. It should. The question is whether it should do so in a way that is consistent with its Charter obligations — and whether the standard applied to Chinese vehicles will be applied with equal rigour to vehicles manufactured in the United States, Europe, and Israel.

The desert is real. It has boundaries. And the boundaries are guarded by words — and by the standards we apply to the words.

References

1. ABC News. (2026, September 20). Security flaws in top-selling BYD EV. ABC listen. https://www.abc.net.au/listen/programs/am/security-flaws-in-top-selling-byd-ev/107175180

2. The Courier-Mail. (2026, September 21). ‘Scary how open’: BYD Shark 6 remotely hacked during cyber safety test. https://www.couriermail.com.au/motoring/on-the-road/scary-how-open-byd-shark-6-remotely-hacked-during-cyber-safety-test/news-story/098dd2faaa068f57635688a438afc100

3. ABC Editorial Policies – Principles and Standards. (2011). Australian Broadcasting Corporation. http://about.abc.net.au/wp-content/uploads/2015/09/EdPols2015.pdf

4. ABC Editorial Policies. (2025, January 23). Objectivity and impartiality. https://www.abc.net.au

5. ABC News. (2021, September 4). Secret report criticises Defence Department over scrapping of multi-billion-dollar Israeli technology by Australian army. https://www.abc.net.au/news/2021-09-04/defence-criticised-confidential-report-elbit-military-project/100422476

6. ABC News. (2021, May 7). Israeli company denies ‘security rumours’ as Defence removes multi-billion-dollar technology and quarantines Army IT systems. https://www.abc.net.au/news/2021-05-07/israeli-company-elbit-systems-of-australia-removed-army/100121238

7. Australian Strategic Policy Institute. (2026, March 10). It’s not where buses are made. It’s how they’re controlled. https://www.aspi.org.au/strategist-posts/its-not-where-buses-are-made-its-how-theyre-controlled/

8. CNBC. (2026, July 18). Cybersecurity risks posed by over-the-air tech in autos has analysts concerned. https://www.cnbc.com/amp/2026/07/18/over-the-air-tech-in-vehicles-poses-cybersecurity-risks.html

9. TechCrunch. (2022, January 27). Let’s make the teen Tesla hack a teachable moment. https://techcrunch.com/2022/01/27/lets-make-the-teen-tesla-hack-a-teachable-moment/

10. SoyaCincau. (2022, January 26). Teen hacker gained access to over 50 Teslas around the world, here’s how he did it. https://soyacincau.com/2022/01/26/teen-hacker-gained-access-to-over-50-teslas-around-the-world-heres-how-he-did-it/

11. ABC Media Watch. (2026, July 13). Commission Confrontation. https://www.abc.net.au/mediawatch/episodes/confrontation/106912358

12. Australian Jewish News. (2026, July 16). ABC and SBS defend editorial models. https://www.australianjewishnews.com/abc-and-sbs-defend-editorial-models/

13. The Sydney Morning Herald. (2026, February 26). ‘I’m a lots-of-feelings person’: Inside the world of ABC chair Kim Williams. https://www.smh.com.au/national/i-m-a-lots-of-feelings-person-inside-the-world-of-abc-chair-kim-williams-20260109-p5nst2.html

14. News24. (2026, July 16). ABC chair Kim Williams flatly denies any editorial bias in explosive Sky News interview. https://www.news24.com.au/business/media/abc-chair-kim-williams-fronts-up-to-live-sky-news-interview-as-accusations-of-bias-engulf-the-public-broadcaster/news-story/408ec11dbcbda49a62e9390e68d08998

15. Pearls and Irritations. (2020, June 25). The ABC’s five-year plan is spin for managed decline. https://publish.pearlsandirritations.com/abc-five-year-plan-2020-by-quentin-dempster/

16. The Guardian. (2019, November 22). ABC journalists’ climate crisis group survives political heat. https://www.theguardian.com

17. ABC Act 1983. (Cth). Australian Broadcasting Corporation Act 1983. https://www.legislation.gov.au

Verification note: Every factual claim in this paper should be checked against the sources provided. Readers are encouraged to verify independently. If any claim does not hold, it should be discarded. The analysis of the ABC’s editorial direction is interpretive and is offered as a framework for further investigation, not as an established finding.

 The paper examines the Four Corners report on its own terms, tests the claims against the evidence presented, compares the vulnerability to documented cases in Tesla and other manufacturers, uses the Elbit precedent to establish that espionage concerns are not country-specific, and traces the ABC’s observed trajectory from Buttrose to Williams. The conclusion is a warning about the threat to democracy when a respected source of information embraces political messaging.