Simpler solution for disabling the DCM telematics - Silencing Antennas

Background: I've worked in cyber security for close to two decades and have a simple philosophy for my devices: "Does thing X need to be attached to the internet? Probably not..." I'm not a privacy nerd or tinfoil hat aficionado, but have lived through Over the Air updates bricking things that had been working just fine on previous vehicles I've owned. I bought the Taco to be simple. Internet-of-crap functionality for remote monitoring features I don't want to pay for is the opposite of simple.

We just bought our 2023 TRD OR at the end of November and in reading through the manual found out that we could contact Toyota to opt out of data reselling (to insurance companies and advertisers) but couldn't actually disable our DCM/Telematics module from connecting to the internet via user-accessible menus from the truck.

After reading through these three threads, it looks like most people have tried pulling the fuse for the DCM module at the sacrifice of the bluetooth microphone and right hand speakers and then having to splice/jumper that functionality back into their wiring harness.

https://www.tacomaworld.com/threads/disabling-dcm-telematics-transceiver-“safety-connect”-connected-services-module.794817/

https://www.tacomaworld.com/threads/stop-toyota-tracking-you.649519/

https://www.tacomaworld.com/threads/in-case-anyone-is-interested.752429/

I don't necessarily care that the truck has a black box functionality at the time of the crash, nor do I want to spend my afternoon cramped into my passenger seat irreversibly splicing/soldering parts of my audio system back into working order just because I pulled a single fuse. I just didn't want it continuously connected to a cell modem streaming telemetry and pulling down software updates. I went to Toyota's TIS login, paid my weekend fee, and came across the following documents:

• RM100000001KYY5 - Cellular Communication: Safety Connect System System Diagram
• RM100000001KYYI - Cellular Communication: Safety Connect System Telephone Main Antenna Circuit Short to Ground
• RM100000001KYY8 - Cellular Communication: Safety Connect System Terminals of ECU
• RM100000001L099 - Telematics System: System Diagram
• RM100000002DT1Q - Navigation: Telematics System Transceiver Disconnected

It looked like I could end up throwing some codes by breaking the connection between the DCM/Telematics module and the nav system and it wouldn't really solve the issue of an internet connected computer sitting on my CAN Bus. I was able to find the right pins to manually reconnect the mic/speaker if I wanted to pull power but again, I didn't want to spend a bunch of time splicing/re-soldering existing parts of my harness from connector D37. I also didn't want to just disconnect or short the antennas since it would likely lead to a different fault and possibly a check engine light.

That just left properly terminating at least the two cellular antennas attached to the module with a real 50-ohm terminator to trick the system into "I just can't find/send a signal right now."





From the "RM100000001KYY8 - Cellular Communication: Safety Connect System Terminals of ECU" doc, it looked like the three antennas used three different clockings of a standard FAKRA antenna connector, but I couldn't tell from the drawing whether they were the male or female connectors on the cables nor could I tell what the connector spacing was. I rolled the dice and ordered three of each both male and female FAKRA - Z connectors as well as 50-ohm SMA terminators to cap off the short whip without damaging the transceiver.

FAKRA Z Female to SMA:

$7 Bingfu Fakra Z Female to SMA Female Vehicle Antenna Adapter Cable 30cm 12" for Car Stereo Android Head Unit GPS Navigation FM AM Radio Sirius XM Satellite Radio 4G LTE Telematics Bluetooth Module

https://www.amazon.com/gp/product/B07PFLZ4HF

SMA terminators
https://www.amazon.com/gp/product/B071FF36L3

After tearing apart my passenger dash (doc RM10000000188KM in TIS) by removing the scuff plate, cowl side trim board, instrument side panel, passenger knee airbag, glove compartment plate, and finally the glove box/"instrument lower panel assembly" with a trim tool, a philips, and a 10 mm socket I was able to see the DCM module on the far right with the three antenna connectors.

Almond colored antenna connector block on top of DCM module


Three factory FAKRA connectors



It turns out they were indeed FAKRA female connectors, but the connector body on the Amazon part was too wide to seat next to the other connectors, and the interior pin had a different shape than the ones that Toyota used inside of the three factory connectors.

Disassembled FAKRA-Z Female to SMA cable:


Aftermarket connector top, Toyota connector internals bottom:



Since the set of FAKRA-Z connectors from Amazon did have a backup spring that held the collet end of the connector with a bit of a "snap" onto the DCM module, I decided to just skip modifying the shells to fit the width and just strip the three connector bodies and attach the SMA terminators:



These zip tied nicely into place with no real tension on the three DCM terminals:


I did end up wrapping the bundle of SMA connectors with some adhesive-backed felt to keep any rattling down and added a few more zip ties on there for some additional support. All of the plastic bits got snapped back into place, knee air bag bolts re-torqued back to 10 NM per the specs in doc RM100000000VG05, and went for a test drive.

Success. No check engine light, no warnings on the navigation system, just a red light next to the SOS button and a grey "no coverage" DCM icon in the upper right hand corner of the nav system.

If my understanding of the Toyota documentation is correct, this should continue to run happily with the DCM/telematics module believing it is out of cell coverage range, and then just overwriting the oldest events in the internal memory in the vain hope it someday hears a cell tower again. The nice part of this approach is should I (or the dealer) ever need to undo this mod, it's completely reversible. Since the three radios were properly terminated into a 50-ohm terminator, there won't be any damage to the transmitting or receiving side of the DCM module, and there also won't be any damage to the wiring on the D37 connector either.

Altogether, this only took about an hour and a half to do once I figured out the right combination of connectors to use. Hope this helps someone in the future!

Edit: Since there's been interest from a handful of people in premade antenna terminator whips as a kit, I have them up here on eBay:
https://www.ebay.com/itm/186244226072

 

Very clear and concise write up. Truly appreciate it.

 

This is awesome, thank you for this write up! As a privacy advocate I've been waiting for someone to figure out where the antennas live to just kill them off with no long term damage or drawbacks.

 

Awesome. When is the kit going to be available for purchase? Hehehe.

 

Excellent write-up! Thanks for the info.

So, according to the USCAR color codes:
- The blue is for GPS
- The grey is for ‘SDARS’ (?)
- The cream (white) is for radio (?)

Can you verify what the Toyota connectors are, and what you lose when you block each connection?

Does any of this affect the key fob / remote operation?
Does any of this affect the radio or XM reception?

Thanks!

 

Very nice write up. Appreciate the time you spent diving into this.

 

I think TW has been waiting for this post since 2016. Great detective work and implementation.

 

I linked the parts I used, but if you want me to assemble the three terminated whips as a kit and send them to you, send me a DM.

Edit: If anyone is interested in premade antenna terminator whips as a kit, I have them up here on my eBay:
https://www.ebay.com/itm/186244226072

 

The interesting thing I came across as I was researching this project is that the FAKRA connector colors are suggestions, not necessarily standards. The consistency between colors and connectors is the "clocking" of the little tabs around the barrel and their alphabetical designation (ex. Z is dark teal and doesn't have any alignment tabs, B is white or cream has one square and one triangular at the 2 and 11 o'clock positions, etc)

Looking at docs RM100000001L099 and the system schematic, the DCM/telematics module is its own bump in the wire on the CAN bus and only intercepts the microphone and speaker cables to operate the SOS functionality. When you cross reference these three antennas against doc RM100000001KYYI, they are only for transmit from the roof, GPS from the roof, and transmit/gps from the interior dash antenna.



If you look at the neighboring doc RM100000001KYUS for the terminals on the multifunction display, the nav unit actually handles its own Sirius XM antenna connection and a separate radio antenna (SXM and RA connectors):



After doing this mod, the radio, Sirius XM, keyfob lock/unlock, and push button start all still work on my truck. If you use the app to remote start your truck or do any of the connected maintenance features, that functionality would be intentionally broken by taking the truck off the internet.

 

Thanks - excellent information! Looking forward to disconnecting from Toyota Central Services. If anyone asks, you were never here.

 

Thank you for this post. Just did this mod and it appears to be working perfectly. SOS light is red and no CEL. I used this thread as reference to disassemble the glove box to get to the DCM module (https://www.tacomaworld.com/threads/how-to-remove-glove-box-in-tacoma-2017.712599/). Overall the mod was pretty easy and completed in about an hour and a half. The hardest part was popping the plastic knee airbag clips loose with a small tool. Now maybe the stealership will stop calling me every time the maintenance light comes on.



edit 2/1/2024: This mod did not completely remove my truck telemetry. I wrapped my DCM module in aluminum foil and it fixed the issue.

further edit 2/4/2024: Aluminum foil helped but did not completely remove telemetry. Will probably delete DCM instead. Read more of this thread for details.

 

This sounds a little tricky, but glad someone figured it out; I am tempted to buy your kit, @altitude-nerd @438060 but i don’t like messing with wiring i don’t understand well, and it may take a few re-reads to feel confident i can follow your directions. Thanks for doing the thinking and research to figure out the hard part. Maybe someone will dumb/lazy it down for me further in a concise video.
I wanna disconnect from the internet for similar reasons just in case Russian, Iranian, PRC, or similarly aligned hackers figure out how to use it to disable or mess with vehicles via taking control of manufacturer servers, though not sure if that would even work on this type vehicle, also see no reason it needs its own internet connection.

Anyone have any idea what just unplugging the phone thing on the inside roofsame as:

actually does?
besides starting the “communication module failure detected” message

I tried eliminating direct internet connectivity by unplugging the thing inside the centered piece, just above the red phone button, with the light. I’m not sure if it actually eliminated connectivity, or just eliminated the call button and calling functionality, but left cellular data connected. I noticed how easy it looked when trying to find a better way to run wiring for cameras. It seems to work, and took less than 5 minutes, including popping the roof located panel off and back on, plus super easily reversible, but results in a error audio message coming from the right side of the vehicle that periodically that says “communication module failure detected pleas contact your dealer”.

 

@altitude-nerd

Is it as simple as unplug the 3 cables plugged into the 3 connectors almond thing; then plug-in the resistor cable assemblies?
Are all 3 needed to eliminate internet? Can you keep one to just keep GPS?

Does the kit plug right into the original FAKRA connectors, simply, no further modding needed to make it fit?
i.e.,
Do the originals need to be stripped/modified to fit?
Or were only the bodies of the Amazon sourced connector bodies for the cable and resistor kit modified?

How obvious is it to find the right connectors to plug the kit into once you open up the panel? Do you simply find the 3 plug almond colored connector block as pictured,
module

unplug from it like shown here empty


and then just plug in the kit cables?



Is it really that simple if a deeper understanding of this stuff goes over your head?

If you want to keep the factory GPS working so it shares better GPS connectivity with your head unit and possibly via carplay, phone/maps/waze, would you just leave the blue FAKRA unmodified/connected to the almond colored 3 receptacle thing? Or are all 3 cable+resistor mods/plug-ins needed to eliminate Toyota’s built-in internet connectivity? Or not following color convention?

 

This is how mod supposed to be! No system compromise and totally reversible. Excellent info. And write up.

 

I think you are correct that disconnecting near the red phone button only disabled the SOS call button. The cellular data would probably still be connected. Just to be clear, in the photo I posted I terminated the three antennas as described in the original post then my SOS button light turned red. I did not disconnect anything near the SOS button.

It pretty much is that simple.

Disconnect battery
Remove the glovebox (you can use this thread to help https://www.tacomaworld.com/threads/how-to-remove-glove-box-in-tacoma-2017.712599/)
Disconnect the 3 antennas from the DCM module
Connect the resistor terminated FAKRA connectors to the 3 ports in the DCM module
Reinstall glovebox
Reconnect battery

The beautiful thing about this mod is the truck thinks the antennas are still connected and just not receiving any signal. If you simply disconnected or shorted the antennas the truck thinks the antenna or connection is broken and might damage the DCM module. I suspect you are correct about maintaining GPS function. By leaving the GPS antenna connected you would essentially be replicating a scenario where the truck is outside of cellular service range but still had GPS service so it might work. You might reconnect the battery before completely reinstalling the glovebox to test function of GPS etc. Be careful handling the knee airbag.

 

Toyota's documentation is a bit thin on which connector specifically goes to which antenna. If you make the assumption that the physical layout is the same as their wiring diagram is from left to right, the center one *should* just be the GPS antenna for the DCM module, but after a few hours of searching I couldn't be 100% sure and didn't feel like dismantling more of my dash or headliner to trace the wires. I don't know what the point would be in allowing the DCM module to only be partially hobbled since it can transmit off of either cell antenna and as another commenter pointed out, it doesn't look like Toyota is following any industry standard color convention for the connectors.

You could theoretically just leave them unplugged, but you risk two things if you go down that route: 1. damaging the transmit side of the radio by not giving it the right impedance match to the antenna (50 ohms) and 2. actually transmitting a signal instead sending it into a dummy load resistor designed to catch the transmitted energy.

 

It looks like @Disgruntled Scientist also answered your question, but just disconnecting the SOS button wouldn't disable any of the transmitting capability from the DCM module behind the dash. The link they shared is a great step-by-step on how to remove the glovebox and the DCM module will be just off to the upper right side.

 

Sorry for the multiple reply, I missed that other question. The GPS antenna connector on the DCM module just feeds the telematics system.

Even after disabling all three connectors on the DCM system, my center multifunction display still has GPS location for the maps since that information comes from the separate "navigation ECU" modules over connectors N38 and N39.

 

Fantastic, thanks for working this out! I'm happy with how the truck is working currently but every day I cringe a little waiting for an OTA update of something that I didn't ask for to break XYZ, never to work again..

Is this the correct, non-generic cable? Amazon and I have trust issues when it comes to electronics (Amphenol P/N for the plug makes that part an easy cross reference).

https://www.digikey.com/en/products/detail/amphenol-rf/095Z820-163-006/15761736