An Australian man has been sentenced to two years and three months in prison after being convicted of 30 domestic violence charges against his former partner, including using a Tesla app to control her car.

Enrico Pucci, 50, pleaded guilty at Parramatta Local Court in western Sydney. Police documents said he added a parental control profile to the vehicle that she could not access, giving him control of its speed, climate settings, locks and curfew hours.

Reports he’d literally lock her out from going anywhere on certain days/times, change the aircon from boiling hot to ice cold and even control the speed at which the vehicle can drive. Goeiste.

The mechanism is the part worth understanding. The profile was added after the car alarm sounded three times in one night, and the next morning the dashboard had been reset. Police records state that the accused was the only person with access to the vehicle's controls through the Tesla app, and that this caused significant stress, mental harm and fear for her physical safety while driving her own car.

A judge found the man had engaged in abusive behaviour over four years. This is not the first case. Reuters documented a San Francisco matter in 2020 where police investigating alleged stalking through a Model X asked Tesla for remote-access data and were told logs are only retained for seven days, which stalled the investigation.

In yet another, a woman was able to sever access herself only because she happened to hold the account settings. After reporting by the New York Times, the US Federal Communications Commission wrote to nine major carmakers asking what safeguards they have to help abuse victims cut an abuser's digital access.

The Guardian reported the conviction and the police documents describing how the profile was used. Reuters, via CNBC, documented the earlier San Francisco case, including Tesla's argument that a restraining order against a vehicle's owner did not specifically require the manufacturer to act. The FCC's letters to nine automakers followed reporting that survivors found car companies unresponsive when asked to remove an abuser's access.

Connected products are built around a single trusted account holder, and that assumption holds right up until a relationship ends. Whoever's name sits on the account keeps control of the object regardless of who drives it, lives behind it or depends on it, and in most cases there is no documented process for the other person to take it back.

Seven-day log retention makes it hard to prove afterwards. That is a design gap, not a Tesla gap, and it applies to every product in this category: alarm panels, smart locks, trackers, cameras and fleet telematics. Anyone selling or installing connected security in South Africa can probably name a customer whose ex-partner still has app access, and almost nobody has a written procedure for severing it.

Building that procedure is straightforward, and it is worth doing before a court asks whether you had one.

You might also like our piece on the Uber GDPR fine over automated driver decisions, the Lego South Africa data breach and who stays liable under POPIA, and WhatsApp's stronger two-step verification.

Get more SA tech and business news and subscribe to The Open Letter.