Vehicles Know eSIMs. Does Your Investigation?

Consider a situation in which a suspect deliberately leaves their main phone at home to create a false alibi, yet keeps up communications, navigation, internet access, or app connections through their vehicle. The typical investigative assumption, that the phone’s location mirrors the suspect’s, is challenged when cars themselves act as connected devices with their own subscriber identities.

Many investigators still often see vehicles as modes of transportation rather than active cellular endpoints. Technologies like Personal eSIM blur the distinction between automobiles and mobile devices, meaning crucial evidence may lie beyond standard phone records.

An eSIM, or “embedded SIM,” is a digital SIM card integrated directly into a device’s hardware. Unlike traditional SIM cards that require physical insertion, an eSIM stores the cellular identity electronically within the hardware. While smartphones, smartwatches, and tablets already employ eSIMs, many modern vehicles, including BMWs equipped with Personal eSIM, now feature this technology. This allows the car itself to operate as a standalone cellular device, presenting new considerations for investigators.

BMW’s Personal eSIM enables the car to join the cellular network independently from its built-in telematics system. BMW models come with internal telematics for navigation, diagnostics, emergency assistance, remote services, and app connectivity, powered by a Duetsche Telekom eSIM roaming on T-Mobile and AT&T networks in the US. Personal eSIM expands these functions, letting drivers activate their own carrier profile right inside their vehicle using one of several eSIM slots. Once activated, the eSIM provides a personal Wi-Fi hotspot, synchronizes apps between the vehicle and phone, and allows communication without needing a cell phone. Drivers can use both Duetsche Telekom and another provider, like Verizon Wireless, resulting in call detail records across multiple carriers and towers.

The central challenge for investigators is that this technology undermines the assumption that suspects and their cellphones always travel together. Often, cellphone location data is treated as a digital stand-in for the suspect’s movements. BMW’s Personal eSIM complicates this view: a suspect might leave their phone at home, generating call records, app activity, and tower history that falsely indicate they never left their residence.  Another challenge for investigators is that a single BMW can be associated with up to seven BMW IDs, each eSim belonging to a different user.

Investigators unfamiliar with these vehicle capabilities could interpret a lack of handset movement as innocence. Meanwhile, the BMW continues to leave behind telematics events on one carrier, hotspot sessions on another, and network registrations throughout the journey. Ultimately, even if a suspect believes they've distanced themselves from their mobile device footprint, their vehicle may still be creating a digital trail.

As connected vehicles become more advanced, investigators need to see them as more than just an extension of the cellphone for digital evidence. Today’s investigations should treat vehicles as network-connected devices that produce their own data, so examiners must analyze information from the phone, the car itself, the manufacturer’s cloud services, and the cellular network. Focusing on just one source could mean missing critical evidence or even arriving at incorrect conclusions.

Recommendations to stay ahead of these challenges are as follows:

1. Detect connected vehicles promptly: When beginning your investigation, assess if the vehicle offers advanced cloud services like Personal eSIM, Digital Key, or user profiles stored online.
2. Determine who was using the vehicle, not only ownership: Record which BMW ID or driver profile was active during the event, since multiple individuals may access the same car.
3. Broaden legal procedures: Request preservation and legal documentation not just for mobile phone records, but also for manufacturer logs, data from connected vehicles, and carrier records linked to the personal eSIM.
4. Verify information through several sources: Examine telematics, infotainment systems, cloud-based logs, navigation details, and mobile phone evidence to create a thorough timeline, instead of depending on a single data type.
5. Educate investigators: Police officers, detectives, prosecutors, and digital forensic specialists should recognize that today's vehicles are not merely modes of transport; they serve as connected devices capable of supplying significant evidence.

The goal is no longer to ask, "Where was the phone?" The better question is, "What connected devices was the suspect using?" In today's investigations, the answer may include a smartphone, a smartwatch, and a vehicle; all capable of telling different parts of the same story.