"This car was incredibly easy to hack but incredibly difficult to track," said Ian Fogg, a technology analyst at FDM CCS Insight. He was watching via his video doorbell as thieves drove away his Kia from outside his house in March. Despite having the car's live location data via the Kia Connect app, an Apple AirTag hidden inside, and a doorbell recording of the theft, he has not been able to retrieve it.
Kia told the BBC that UK law prevented its Connect function from being used to live track vehicles, advising customers to use it for "convenience" rather than security. The company said: "Kia Connect is a customer convenience feature, not a certified security vehicle tracker. Therefore, it does not provide live‑tracking functionality for stolen vehicles."
“Ian Fogg's Kia was stolen despite GPS tracking, but UK law prevented live tracking, experts warn of gap.”
Fogg's ordeal began when his phone pinged to say he no longer had access to the Kia Connect app. Thieves had broken into the car without keys and disconnected his phone via the entertainment system—an unsecured process designed to make it easier for new owners to take over. For a short while he tracked the car using the AirTag, until the thieves located it and discarded it because it was making a noise, an anti-stalking feature introduced by Apple.
When Fogg contacted Kia Connect as advised on its website, he was told he would have to fill in a form every time he requested the location. He did this eight times. Each time, he did not receive the location until 24 to 48 hours after the car had been recorded there. "It shouldn't be this easy to nick a car when they cost an order of magnitude more than a phone and have similar radio technology," he told BBC News.
Car safety firm Thatcham Research warned of a "genuine and growing gap" between consumer expectation and the technical reality of connected car features. Kia added that release of location details via Kia Connect is possible, but "must be done in full compliance with all applicable laws, in particular GDPR, and the authorities to minimise risk to the customer."
Fogg's story remains a cautionary tale: the car is still missing, and the technology that promised security could not be relied upon in the moment of crisis.