- Miles Mobility is demanding more than € 13,000 from a customer whose rental car was stolen and damaged by unidentified thieves. As a result, the customer is now threatened with bankruptcy
- Multiple theft-related incidents, with subsequent requests for damages, happened last summer, before and after a major system upgrade
- Research shows that Miles Mobility, unlike its major competitors, hasn’t implemented basic industry-standard safety measures to prevent theft, such as a proximity- or time-based car immobilizer
- Previous incidents and information from various sources show that Miles Mobility was unable to successfully prevent theft in the past, and for a long time had no full control over technical aspects of its own platform
Berlin car sharing startup Miles Mobility is asking a number of customers whose cars were stolen to pay for the damages caused by the thieves during their illegal ride. In all of these cases, the stolen Miles cars were subsequently found after the thieves abandoned them somewhere in Berlin, some with scratches and signs of vandalism, some severely damaged. Now the company is claiming through its lawyers that the users should be held responsible for the theft, as if they somehow enabled it, all while failing to implement simple car safety fail-safes and anti-theft mechanisms that all major car sharing competitors are currently employing. According to sources close to the company, the absence of such safety measures could be tied to Miles’ lack of agency over their own technological platform, which, at least until this summer, was based on a white-label solution by a third party company.
“Don’t call the police!”
How do I know all that? Well, I’m one of the customers whose car was stolen. On August 11th, 2020, around midday, I rented a Miles car to transport a desk to my office in Berlin Wedding. I parked the car in front of the office, stepped out, unloaded my desk, and parked the car from the app to close it while carrying the desk inside my office. Ten minutes later I left the office, only to find that in the meantime the car had vanished. I frantically opened the app but I couldn’t do much, except for follow the car on the map: I couldn’t end the rent and, more importantly, I couldn’t stop the car in any way. Worried, I immediately called Miles.
The customer representative who answered my call didn’t seem particularly prepared to handle the situation. «Don’t call the police, please», he said to my surprise, multiple times, «we’re taking care of it». Twenty minutes later I called a second time, only to be told not to contact the Polizei––again. At 2:55pm, for good measure, I sent an email to Miles’ customer support, informing them of the strange interaction I just had with customer support. Worried by Miles’ continued silence, I then took the matter to Twitter, where Miles customer support replied in less than twenty minutes. “We are already in contact with the police and will stop the car asap”, the company said in a tweet. “You will for sure receive compensation credits on your account.” Later that day, Miles finally replied to my email, informing me that they “were able to stop the vehicle with help of the authorities and end your rental. The car has been confiscated and will be checked thoroughly.”
They also claimed that “while you were unloading in front of your office, the car stood unlocked in the street, accessible for anyone” –– that didn’t reflect my experience at all. A police investigation followed, clarifying I wasn’t the person driving the car after the theft. In early December, 4 months after the fact, I received a letter from Miles’ lawyer, asking me to pay thousands of Euros for the car’s damages. Miles claims, contrary to my personal experience, that I didn’t close the car, thus enabling someone to steal it.
All this while the only temporary key for the car – i.e. my own smartphone with the Miles app on it – was always sitting safely in my pocket. Other customers whose car was stolen between June and August have all received a similar letter, despite them also being sure that they had properly locked their cars after renting them. Regardless of the cars’ doors being closed or open when the vehicles were stolen, how can someone drive away while the user’s smartphone is physically removed from the rented car? And why wouldn’t Miles’ insurance cover such events?
The risks (and countermeasures) of keyless car sharing
Miles Mobility operates a fleet of keyless Volkswagen, Audi and Renault cars and vans that customers can find and rent through the Miles app on their smartphone. The service is available in Berlin, Hamburg, Cologne, Düsseldorf and Munich. Its slogan is “miles, not minutes”, as they charge customers based on the number of kilometers driven instead of the trip’s duration.
All Miles’ cars, except for the Volkswagen and Renault vans, are “keyless”, meaning that to reserve, rent, unlock and activate one of Miles’ cars, users need to be authenticated through a companion app installed on their iPhone or Android smartphone. Once they’re inside the car, they can start the car by pressing on the electronic ignition button on the cars’ dashboard.
The app, and for extension the user’s smartphone, acts as a temporary digital key for the rented vehicle. The system isn’t complicated, and the underlying technology has been safely implemented multiple times over by many companies, both for rental and privately owned cars. Yet, there’s a number of security pitfalls that need to be properly addressed to make sure the interaction between the user and the car is secure at all times. One, for example, is a continuous check on proximity. The temporary digital key, i.e. the user’s smartphone, should act like a regular transponder car key, enabling interaction with the car only when the user’s key is close enough to the vehicle, or sitting inside it. When the key is removed from the vehicle, even for a very short time, the car’s immobilizer should activate, thus preventing anyone from turning the engine on.
Unfortunately, it appears that at the time of the events Miles’ cars were not equipped with this basic safety function. In my case, someone was able to enter the car and steal it while its temporary key (i.e. my smartphone) was dozens of meters away, in my pocket, and my rent was still active. Even if the car was open (which, to my knowledge, it shouldn’t have been considering I parked it through the app) how can someone simply hop on and take it for a ride?
A stolen Miles car is more common than you think
Mr. Rob Shaw, the owner of a bar in Berlin Neukölln, had a similar experience back in June. «I parked my car near my bar and I ended the rent through the app», he says. «The day after, I was informed by Miles that the car had been stolen, while my rent was allegedly still active». Miles is now claiming that Mr. Shaw should be held responsible for the damages caused by the thieves, who apparently committed some serious felonies while driving the vehicle but haven’t been identified. «According to Miles, the car was stolen around four hours after I parked it» Mr. Shaw says. «Even if the rent was still on as they claim – and by the way, it wasn’t; my girlfriend was with me and she clearly remembers the indicators flashing when I closed the car – how could someone still be able to turn the engine on after such a long time?»
Mr. Shaw showed me the screenshots of Miles’ backend, which the company’s lawyer attached to their first letter. The documents show that the car was sitting idle from around 3.30pm on June 23rd, 2020, the time when Mr. Shaw parked the vehicle, to around 7.31pm of the same day. That’s when the theft happened, four hours later. If what Miles claims is true, that means the company is aware of the lack of a proper proximity-based immobilizer function on their vehicles.
«I’m really baffled and sad», said Mr. Shaw. «If they had asked me to pay a few hundred Euros for the insurance deductible I would understand. Instead, they’re claiming I owe them over 13,000€ for damages I haven’t caused, plus the 1500€ in legal fees I had to fork out to counter their claim. As a bar owner, the pandemic hit me pretty hard already, and now this. I’m threatened with bankruptcy as a result, which means I’ll have to lay off my staff of eight, all because Miles’ app probably didn’t work properly, and they didn’t bother to add something as simple as a car immobilizer. They have made an already bad year so much worse».
What are Miles competitors’ doing?
Miles is not the only free-floating car sharing company managing keyless vehicles in Germany. WeShare, a competing service operated by Volkswagen’s subsidiary UMI Mobility, has more than 100,000 active users in Berlin. Customers have access to a fleet of eGolf and ID.3 electric cars that they can rent through the WeShare app on their smartphones. I asked the company about the safety measures they put in place to ensure the proper use of their vehicles, and if car theft is a common problem, as it seems to be for Miles Mobility.
«No vehicle has been stolen from WeShare. In a few cases, customers have informed us that they have found an open vehicle where the previous tenant had not properly ended the rental. Here we ended the rental manually and informed the previous customer», a company representative told me. «The WeShare system automatically and continuously checks whether rents have not been regularly ended or vehicles are unlocked on public roads. In such cases, the system activates the immobilizer so that the engine can no longer be started. The customer will be informed about this via the app. However, the doors remain open in case of medical emergencies. The immobilizer can be deactivated again via the app or customer service».
SHARE NOW, the world’s largest car sharing company, implements similar safety measures on its cars. Born in 2019 from the merge of BMW Group’s DriveNow and Daimler’s car2go, the company has more than 400,000 active users in Berlin, and operates a mixed fleet of both keyless and key-based vehicles. A ShareNow representative confirmed they also implement an immobilizer-based safety solution on all their keyless cars.
«As the SHARE NOW app is the digital car key for keyless vehicles, we have taken extra precautions when our customers are doing a stopover during their rental. In this case, the users have to unlock the vehicle’s engine via the app before being able to go along», the company said. «Moreover, we are using different tools to detect and prevent the fraudulent use of our cars, such as the usage of a so-called immobilizer. This allows us to stop the engine and block the vehicle when our system detects an unauthorized usage of the respective car».
Furthermore, SHARE NOW implements a “GeoFence Alerting” system. «As described in our data protection declaration, a serious violation of our General Terms and Conditions is required for the activation of this tool» the company said. «Such a violation occurs for example when the customer leaves the contractually-agreed region of use. As a consequence we get a notification that the vehicle is outside the country. This allows us to contact the customer and ask him/her to return the car immediately».
A source with close knowledge of the company’s operations, who asked not to be named for fear of repercussions, said Miles’ system doesn’t implement any sort of “GeoFence Alerting”. «There’s a well known story inside the company, about a van that ended up in another continent», they told me. «Someone took it in Berlin and drove it all the way to Paris. The company wasn’t able to stop it in any way. After some time the van reappeared in Northern Africa where it was driven around for awhile before stopping for good. The thieves probably brought it over, used it for a while, then scrapped it for parts».
I tried to talk to Miles to request a comment about this and other tidbits of information, but the company doesn’t seem to have a PR Manager, a press office or a press agency, nor is anyone listed on its website or on LinkedIn as a first contact for press inquiries. The company also never replied to a request for comment I sent to their “presse@” email address several days ago.
A series of unfortunate events
Mr. Shaw was able to identify more customers whose Miles car was stolen in similar circumstances to ours. One of them, who agreed to talk but asked me to omit his name for professional reasons, has a story similar to Mr. Shaw’s. Their Miles car was stolen in early August, during the night, hours after they had ended the rent in front of their Berlin apartment. Miles is now claiming the customer didn’t park the car correctly. The company also says the theft happened hours after the user left the car, thus confirming again that a parked Miles car that is sitting unlocked can still be turned on and driven away by anyone who’s not in possession of the car’s temporary digital key.
«The day after I used the car I woke up to an automatic email from Miles saying I was due 35€ for my trip», the customer says. «It didn’t seem right, so I emailed customer support right away, saying they overcharged me. They got back to me with an apology, saying that they would refund me for the mistake. Some three weeks later I received another email, saying the car had been stolen, without further explanation. I forgot about it until in December, when I received a letter from Miles’ attorney, claiming I owe them thousands of Euros in damages. I was shocked to say the least! What’s interesting is that the car was moved to another location, but there was no issue with the mechanics or the interior. That makes Miles’ request even stranger to me, as the car could have been vandalized in the same way, even if nobody had stolen it after I ended my rental».
Mr. Shaw, who contacted me through social media after he read my exchange with Miles from August on Twitter, says that he was able to find more customers with similar issues. Some of them didn’t want to come forward. «I wonder if they just paid, without questioning Miles’ claims», he said. These separate incidents have something in common: they all happened last year in the summer, right before and right after Miles Mobility introduced a new app and updated the system’s backend with a major and critical software upgrade. Could a platform bug during that time be the root cause that made Miles’ cars easier to steal?
A fully externalized car sharing solution
A source familiar with Miles Mobility’s past and current operations has told me that, at least until last summer’s upgrade, the company relied on an external platform to manage its service. «They were employing a software solution licensed to them by a third party company called Wunder Mobility», they said, a detail confirmed also in an interview to Wunder Mobility’s founder and CEO Gunnar Froh published on Grunderszene in December 2019. «Miles had no direct control over it, they couldn’t push technical bug fixes, and their technology team was not able to intervene on the platform in any meaningful way. The only way to push an upgrade or to modify something technical was through the external company, which cost money, thus forcing Miles to delay technical upgrades, or scrap them all together».
According to the source, triggering an immobilizer function based on user proximity or tied to the car’s prolonged idle state would fall under that category of updates. «Another example is a well known loophole in the system. The old platform couldn’t really distinguish between cars, which are keyless, and vans, which instead feature a key inside the glove compartment», the source said. «That key could be used by customers to park the van securely, but without actually parking the van in the app, thus allowing them to keep the van longer, basically for free, as Miles charges for distance driven, not minutes. The loophole was there for a very long time, either willfully ignored or impossible to fix, hard to say».
The platform developed by Wunder Mobility is employed by many other mobility services in Germany. It’s the same platform, for example, used by e-scooter sharing company Emmy, also in Berlin. Unlike Miles’ cars, Emmy scooters do have a self-locking system that terminates a rent automatically some 30 minutes after a user forgets to end it through the app. This means the platform on which Miles based its system for a long time is capable of assessing the vehicle’s idle state, and enforce a safety measure based on it. Why hasn’t Miles implemented such a basic safety measure, then?
Unlike Emmy and other prominent mobility services, Miles Mobility was never featured in Wunder Mobility’s website as a partner or a client, as shown by a search through the Internet Archive’s Wayback Machine. My source also confirmed that all Miles cars and vans are not owned, but rather leased through an external company and insured with a special deal by the German insurance company R+V. This means that at least until switching to the new platform, last summer, Miles owned neither the cars they were renting, nor the platform on which they could be rented.
According to a source familiar with the matter, the new platform development and the new Miles app launched this summer were also developed by an external company, as Miles doesn’t have sufficient technical know-how to conduct the development internally. I would have liked to corroborate this information with Miles, but as already mentioned above, the company never replied to a request for comments.
”It’s our mission making (sic.) carsharing more transparent and fair”, says Miles on its website. “We want mobility in urban life to be more diverse and – above all – accessible to everyone”. Unfortunately Miles’ actions are painting a darker picture of a beleaguered company, marred by confusion, dysfunctional processes and lack of control. A company who prefers to ask for thousands of Euros from its customers, instead of taking responsibility for the public safety risk it’s enabling by not implementing basic industry-standard safety solutions.
Update, 12th Jan. 2021, 20:45
A Miles Mobility user reports that, as of December 23rd 2020, Miles Mobility cars implement a sort of car lock mechanism after five minutes of inactivity. The user, who has a technical knowledge of shared mobility platforms, also confirmed that the safety system was not in place until recently. The article has been updated to reflect this information. We’re still waiting for Miles Mobility to reply to our request for comments.
About the author
Andrea Nepori is a freelancer journalist living in Berlin. He covers technology, innovation and smart mobility topics for a range of Italian and international publications such as La Stampa, Vanity Fair, Domus, HDBlog, and others.
