How to disconnect the tracking telemetry on the 5th gen 4Runner

Surprised it’s that easy.

 

Me too. But my tests show there’s simply no data flowing in or out of the truck when that fuse is pulled, other than the GPS signal, which is only received. And that’s not a problem cause the vehicle can’t send it out to anyone.

Anyway, I’ll experiment more and will def update if there are any unexpected complications.

 

If I read it correctly remote services is basically not working and not being able to use Remote Services is the dealbreaker for me.

 

Key fob stops working? Why would the signal between the key fob and car stop working when cell is not working?

 

Correct. As noted elsewhere in the thread, Remote Services has a lot of convenient features and I understand why many people would want to keep it -- even when they'd have to pay for it each month.

But for some of us (a minority no doubt) concerns about privacy and the risk of hacking outweigh those conveniences. I personally do not find the conveniences to be worth the costs of an ongoing subscription service. And if I can no longer take advantages of the conveniences, I'm left with only the risks posed by having my car's major systems exposed over the Internet, as well as tracking and other data regarding my driving, as well as the potential for eavesdropping on conversations within the car.

This project was about figuring out a method for disabling the car's ability to send or receive data over the Internet, to resolve those concerns.

As it turns out, there's a way to do so that is simple, reversible, and does not appear to interfere with any other system. Demonstrating that was the point of my post.

 

IKR! It seems to make no sense whatsoever. But it has also been observed by others. The only logical explanation I can think of is that the car's computer is programmed to disable this service when Remote Services is disabled, and Toyota does this only to try to push people into paying the monthly fee for keeping Remote Services working.

I in fact am one of the people that Toyota had in mind. The remote start feature is the single most valuable feature for me in Remote Services. If I can do it from the fob then I don't need to pay for that.

If someone has a better explanation I'd like to hear it.

PS -- I am going to try the fob again after I next pull the fuse, and will report if for some reason it works again. I think it can be finicky and maybe I just screwed it up or something. But when it didn't work, I remembered others on the forum saying that it also stopped working for them once Remote Services expired.

 

Any electronics engineers in here?

 

You know that there is a backup battery for the DCM unit. Apparently it’s kept charged by the DCM and is monitored by it. And when that battery goes dead you get a code B15CC Backup Battery Failure. Or a B15CE Backup Battery Degradation if it’s charge level is low.

If you take power away from the DCM I’d imagine the battery will eventually deplete. But if the DCM is really the monitoring point it would never throw a code. Unless you re-enable the DCM by plugging the fuse back in.
Keeping that battery healthy may be something to consider if you ever want to start using the system again.

http://www.to4runner.net/backup_battery_failure_b15cc_-392.html

http://www.to4runner.net/backup_battery_degradation_b15ec_-390.html

 

My key fob works less that 30% of the time as a remote starter. Never had a vehicle this bad. All my Jeeps worked 100% of the time. The transmission might fail but the remote start would work.

 

You can’t unlock the doors with the fob if you don’t pay for a subscription service? That can’t be right.

 

Yes and thanks, this is an important point. I was wondering if the battery would kick in to provide data transmission in the absence of power from the car. But apparently not. I then wondered if it’s purpose is to provide the power needed to retain data it has collected, so it can be transmitted later. For example if the vehicle leaves an area with cell service then returns to it. But this doesn’t seem likely since these days almost all data is stored on flash chips.

So it’s purpose is a bit of a mystery.

Good point too about the possibility of error codes when and if the battery dies after pulling the fuse. Guess I’ll find out eventually!

 

Yeah paying for it each month is really stupid IMO.

 

https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-procedure.304339/#post-2766176



Also from another (EU) forum. Not sure how applicable to US vehicles.



Toyota does not offer a way of disabling the DCM (without setting permanent warning messages),as the module handles two functions including:

1. Ecall which is now mandatory in all new vehicle types introduced in the EU after 31/03/2018:

How does eCall work?

eCall is activated automatically as soon as in-vehicle sensors and/or processors (e.g. airbag) detect a serious crash.

Once set off, the system dials the European emergency number 112, establishes a telephone link to the appropriate emergency call centre (aka Public Safety Answering Points – PSAPs) and sends details of the accident (aka Minimum Set of Data – MSD) to the rescue services, including the time of incident, the accurate position of the crashed vehicle and the direction of travel.

An eCall can also be triggered manually by pushing a button in the car, for example by a witness to a serious accident.

eCall is NOT...

• 112 eCall is not a black box. It does not record constantly the position of the vehicle, it records only a few data to determine the position and direction of the vehicle just before the crash and these data are only transmitted to emergency call centers if there is a serious crash.
• eCall cannot be used to monitor motorist's moves. The SIM-card used to transmit the eCall data is dormant, i.e. it is only activated in case the vehicle has a serious accident (e.g. the airbag is activated).

2. Connected services whilst Toyota can collect the data received they cannot do anything with it if you do not consent via the Connected services terms and conditions presented on the MyT website/app the exception to this is requests from law enforcement/Security agencies requiring a warrant to provide such information.

Assuming you are in the EU if you really want to ensure your personal details are not connected to the data recovered you can also exercise your "right to be forgotten" by Toyota and your dealer under GDPR legislation in your local market area.

 

No no. Unlock works fine. Inc by only touching the handle, using the proximity feature.


NO normal features were disabled or interfered with during my tests after pulling the fuse, other than the data transmission (which was the point) and the seeming inability to remote start using the fob.

As others have noted, the fob is not super reliable for that to begin with, so maybe the jury is still out on this issue.

 

Interesting. Glad we don’t have an eCall mandate. But wish we had the Right to be Forgotten and similar consumer protections.

As mentioned, Toyota removes all these safety and convenience features after the trial period, unless you agree to pay for them. That’s on them. My point is, if I can’t have the “pros” of these features without being held at ransom, then I’m not going to tolerate all the cons they come with.

It’s troubling to me that I can be denied all these features, yet at any time Toyota or a hacker can pull location and driving behavior data from my car, or turn on the microphone, or look out the camera on the windshield, or slam on my brakes, or turn my engine on and off without my consent.


Toyota might do such things for financial reasons, or in response to a government request. A hacker might do it for any number of reasons.

 

I just imagine one manufacturer's system being hacked. Let's just say Toyota's. Hackers have had success shutting off electrical grids, turning off a major oil pipeline, preventing the filling of postage meters (yes, I know that one personally), etc. Imagine a ransomware attack that is manifested by all Toyota's newer vehicles being made to come to a stop, all at once. How quickly would Toyota pony up a billion dollars to get functionality back?

 

Exactly. Well put.

To me, such hacking — whether by a cybercriminal in a basement somewhere, or a hostile nation state — is the biggest risk. I don’t distrust Toyota. And abusive government requests to Toyota to access such systems should be pretty rare (though certainly not unprecedented). So it’s the hacking I worry about most.

 

Singleminded - would you mind taking a few photos of the box location and fuse location for everyone? I'm interested in this.

 

I remember reading somewhere that the backup battery is used to power the DCM in case it loses power as a result of an accident, so it can transmit location data and some other info for emergency services to locate the vehicle. (As @r32 described for the EU).

And as you said, it probably also is used for data retention of some sensor data.

 

The fusebox is under the dash to the left of the steering column. Not hard to access. The 7.5 amp DCM fuse is top middle in this picture. Also shown is the fusebox cover that identifies that fuse as being for the DCM.

 

That's helpful. I'm no electrician, but am guessing that removing the fuse defeats this function because it can't complete the circuit. The lack of external power, say from the engine dying and the car battery getting disconnected in a crash, wouldn't necessarily cause the same problem. There'd be no external power going to the DCM, but the DCM's own battery could supply that power if the circuit was complete.

Seems logical -- but again I'm no expert.

 

Currently I only "Opted out" verbally from the services but not pulled the fuse.
The thing is that microphone and right door speaker is going through the DCM and if you pull the fuse you will not have neither right speaker nor microphone working.
Special harness need to be created to bypass turned off DCM - and currently I have no time for this.

 

Interesting. I did not notice an issue with the speakers. Will have to check that out -- thanks for the heads up.

Disconnecting the microphone is a plus in my book, however. I can't use it for anything if I'm not paying for Connected Services, and there's no reason I'd want anyone else to be able to activate it without my knowledge or against my wishes.

 

Here is what needed to be bypassed:

 

Easiest way to check is to move balance to front-right in sounds settings

 

Also, interesting threads from sibling forums:
https://www.tacomaworld.com/threads...e-i-can-find-the-trucks-3g-lte-module.660426/
https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-procedure.304339/

 

Unfortunately I'm using this for hands-free - when I call/receive the call.

 

Ah, duh. Now I get it. I do use the mic for phone calls when my phone is connected via CarPlay. This is an unexpected complication of pulling the fuse. Drat, foiled again.

Hmmmmm, anyone got any other ideas for preventing data transmission without screwing up any other capabilities of the vehicle? Bypass wiring is not simple.

 

Another possibility is to tear-down DCM and pull the SIM card (if any), again I do not have time for this yet

Also, see posts 47, 48 here: https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-procedure.304339/page-3#post-2848827

It's not that hard

 

Much thanks, if you do that please let us know. This was my original goal -- don't screw anything else up, just kill the cellular chip. If the system thinks everything is normal but the chip ain't working, that might be the ideal solution. I just tried the fuse pull as a super quick and easy test to see what would happen. It seemed like a perfect solution at the time, but you've pointed out a flaw re the disabling of the mic.

PS, I saw on the Rav4 forum discussion of this topic that on the high end stereo system the only speaker that cuts out is the small dash mounted one on the right. Not the bigger speaker on the door. That may be the case with the "high end" stereo in my Limited, and I might be able to live with that. But it doesn't solve the big microphone problem!