Behind the dashboard of any car sold in the last decade there is a box roughly the size of a paperback. It holds a cellular modem, a GPS receiver, some storage, and a SIM that was activated at the factory and has never been touched since. It is bolted where you cannot reach it and it has no switch.
That box is the reason Poland barred Chinese made vehicles from its military sites last week, citing data security, and the reason several other governments are working through versions of the same question. What follows is how the thing actually works, because the public argument about it has been conducted almost entirely in the language of espionage and almost not at all in the language of engineering.
What the box does on an ordinary day
It is not there to spy on anyone. It is there because a modern car is a product that gets updated, diagnosed and billed remotely.
Its routine work is mundane. It reports fault codes so a dealer knows what is wrong before the car arrives. It downloads software, increasingly for components that affect how the car drives. It handles the emergency call function that many jurisdictions require, which by definition means knowing precisely where the vehicle is. It supplies the phone app that unlocks the doors and pre heats the cabin. On some models it relays data used to price insurance.
To do that it has to know where the vehicle is, when it moved, how it was driven, and what state its systems are in. It has to be reachable from outside. And it has to be able to accept new software, which is the part that matters most and is discussed least.
What else is on the bus
The modem does not sit alone. It shares an internal network with everything else, and on a current vehicle that includes a startling amount of sensing.
Several external cameras, because lane keeping, parking and driver assistance all need them. Radar and ultrasonic sensors. At least one microphone, for hands free calling and voice commands, and on many models an interior camera pointed at the driver’s face for attention monitoring. Precise satellite positioning, continuously.
None of that was installed for surveillance. All of it is a sensing platform that happens to be parked wherever its owner parks it.
Why every car has one at all
Worth a paragraph on how this became universal, because it was not a market decision and it is a good illustration of how attack surfaces get created by people trying to prevent something else.
In the European Union, every new car type approved from the spring of 2018 has been required to carry an automatic emergency call system. In a serious collision the car contacts the emergency services by itself and transmits its position, on the reasoning that a driver who is unconscious cannot dial and minutes matter. It is a good rule. It has saved people.
To satisfy it, a vehicle needs a cellular modem, a satellite receiver and a power supply that survives a crash. Once a manufacturer is fitting all three to every car anyway, the marginal cost of using them for software updates, telematics and a phone app is close to nothing, so everyone did.
That is the actual origin of the box. A safety mandate put a connected computer in every new car on the continent, and the commercial uses followed because the hardware was already paid for. Nobody decided that every vehicle should be a networked sensing platform. It was the second order consequence of deciding that every vehicle should be able to call an ambulance.
Why a site ban rather than a technical fix
This is the part that explains Poland’s choice, and it is a reasonable one on the engineering rather than on the politics.
The intuitive answer to a worry about a device is to inspect it: audit the firmware, confirm what it sends, certify the model, move on. That does not work here, for two reasons that compound.
The first is that you cannot meaningfully audit software you do not possess in source form, on a component you did not design, where the interesting behavior would be conditional and rare. A system that behaves normally except under a specific trigger will look normal for as long as you watch it.
The second is decisive. These vehicles accept remote software updates. Even a perfect audit of the code running today tells you nothing binding about the code running next month, because the manufacturer can lawfully and routinely replace it overnight. Certification assumes a static artifact. This artifact is not static, by design, and the ability to change it is a feature customers pay for.
So the options narrow. You can prohibit the components at the point of sale, which is slow and applies only to new vehicles. Or you can keep the whole object away from the places you care about, which is immediate, requires no cooperation from anyone, and is what a car park barrier already does. Poland chose the second because it is the only one available this year.
The American version, and its shape
The United States took the first route. A Commerce Department rule finalized in January 2025 prohibits the import and sale of connected vehicle hardware and software with a sufficient connection to China or Russia, and it is worth reading the timetable rather than the headline.
The software prohibitions bite from model year 2027. The hardware prohibitions from model year 2030, or the start of 2029 for units without a model year. There is also a prohibition on sales by manufacturers with a sufficient nexus to either country from model year 2027, even where the vehicle is assembled in the United States.
Two features of that are instructive. The gap between the software date and the hardware date is an admission about supply chains: software can be swapped in a design cycle, and a component sourcing decision takes the better part of a decade to unwind. And the rule covers passenger vehicles while leaving out trucks and buses, which is a scoping choice with consequences, since a bus is a vehicle that spends its day driving a fixed route past everything in a city and a delivery truck goes wherever deliveries go.
What to watch
Three things, and only one of them is about cars.
Whether the commercial vehicle gap closes. The exclusion of trucks and buses from the American rule is the largest opening in it, and the argument for keeping them out is about disruption to freight rather than about risk.
Whether site level exclusions spread from military installations outward. Poland’s measure applies to defense sites, which is the easy case because the perimeter already exists and the authority is unambiguous. The harder version arrives when someone proposes it for a power station, a port, or a government office with a public car park, and has to answer what happens to an employee who owns the wrong car.
And model year 2027, which is the first date with teeth and is closer than it sounds. Model years run ahead of calendar years, so 2027 vehicles reach American showrooms during 2026. That is the point at which the software prohibition stops being a rule on paper and becomes a set of declarations that importers have to sign, about components several tiers down a supply chain they do not own.
Watch what gets withdrawn rather than what gets announced. A manufacturer that quietly drops a trim level, delays a model, or ships a car in North America with a different infotainment stack than the same car carries in Europe has told you more about how binding the rule is than any statement will. Those changes are visible on a price list, they happen months before anyone writes about them, and they are the first place the cost of this lands.
