Wow. This is gross negligence. Short version: the guy's insurance company had him put a GPS-enabled device in his car to measure usage. With no auth and only the car's license plate number, you can track the car, find out who owns it, and get a bunch of stats.

This is the kind of thing that should result in a fine of millions of dollars. They never even tried to secure this.