News for hackers. Stuff that matters.
Re:What kind of data is my new car collecting? by clucas on Wednesday January 15, 2020 @10:11AM (#22054795)
This is not legal advice, and you should consult an attorney if you believe that an OEM may come after you for tampering with your own vehicle.

That said, I believe that there is very limited legal recourse for a vehicle OEM who wants to prevent an end user from changing the data collection and upload features of their vehicles. The worst thing would be potentially voiding the warranty, but for 10-15 year old used vehicles, that's not an issue.

I work as an in-house counsel at a vehicle OEM (likely not one you've heard of). Our end customers are generally large companies, so it may be different for personal passenger vehicles, but we actively plan for the contingencies where our end users switch out their telematics module, or request to have the telematics data stream be directed to another service provider. Further, in our market, the idea that the customer wouldn't want telematics at all is not really likely, but we also plan for that possibility.

So, I don't believe the used market isn't as big of a deal as you may think. The real concern for personal vehicles is losing essential warranty or service options for new vehicles by turning off the data collection.

Re:What kind of data is my new car collecting? by falcolas on Wednesday January 15, 2020 @10:25AM (#22054979)
Don't forget that Tesla is now in this space, and turning off Tesla's access to it will turn off your car, period. I have a hard time believing that others in the industry will not take the blase reaction to this and then do it themselves.
Re:What kind of data is my new car collecting? by Seenso on Wednesday January 15, 2020 @10:33AM (#22055068)
> Don't forget that Tesla is now in this space, and turning off Tesla's access to it will turn off your car, period.

Which is super scary. A couple years ago one of their firmware engineers had his NDA expire, and he posted some stories about his time there in some forum.

One of the stories that stuck with me is they were really sloppy with their updates. One time the pushed one that wasn't fully cooked (it might have bricked some, I can't remember), so one of the engineers literally wrote a script to SSH into each of the cars to roll back part of the update.

Update: here's the original source: https://twitter.com/atomicthumbs/status/1032939617404645376

Re:What kind of data is my new car collecting? by rapnie on Wednesday January 15, 2020 @10:55AM (#22055301)
Re:What kind of data is my new car collecting? by matheusmoreira on Wednesday January 15, 2020 @11:52AM (#22055828)
Re:What kind of data is my new car collecting? by ASalazarMX on Wednesday January 15, 2020 @01:42PM (#22057045)
This was really iffy even then. If the car is connected by cellular, it doesn't have a unique IP address to SSH into. If it is connected to WiFi, the router has to be configured to forward that port.

Since the author remains anon, I always thought it was just a troll.

Re:What kind of data is my new car collecting? by ohazi on Wednesday January 15, 2020 @02:08PM (#22057342)
Busting through NAT is really easy... The car could just ping home and open the tunnel by itself when it sees the appropriate signal.
Re:What kind of data is my new car collecting? by ASalazarMX on Wednesday January 15, 2020 @03:22PM (#22058063)
The whole thread doesn't hold water. It was just a mix of plausible, implausible, jargon and some profanity for relatability.

Full quote:

> model s and x use openvpn to talk to their backend. inside that backend there are metadata services that feed info to the system, one of those things being a ~20MB+ (generated by the worst erp system) json payload that describes supercharger shit for the map in the touchscreen. somebody was smart enough to do automated linting but forgot to validate against the custom parser the car runs which caused a segfault in the qt app that runs the ui, which in turn for a variety of reasons forces a reboot of that component. I think we clocked about 15 seconds before it read the file and faulted after boot. it was doing that for an hour before everyone panicked and got me and qa on the phone to fix it. i wrote a quick python/fabric script that ssh’d to as many cars as possible at a time to rm the file

Re:What kind of data is my new car collecting? by twistiti on Wednesday January 15, 2020 @04:24PM (#22058796)
Another interesting quote from this thread:

- "On that note, China has a law in place that mandates all electric cars send real time telemetry to their government servers - Model S/X/3, NIO cars and any other electric car if they're driving already complies with that law to be road certified"

- "Don't be surprised if that becomes a mandate in other countries"

Re:What kind of data is my new car collecting? by shadow-banned on Wednesday January 15, 2020 @02:25PM (#22057532)
FYI, those details were originally posted on YOSPOS, a SomethingAwful sub-forum which is the world's best Internet forum for computer touchers.

They regularly lambast HN via this thread. It would be great if more people read their criticisms of the community here.

https://forums.somethingawful.com/showthread.php?threadid=39...

Re:What kind of data is my new car collecting? by sli on Wednesday January 15, 2020 @05:06PM (#22059286)
I don't think anyone is going to pay $10 just to read that thread.
Re:What kind of data is my new car collecting? by clucas on Wednesday January 15, 2020 @10:40AM (#22055161)
Yeah, fair - that's definitely a difference between vocational vehicles and personal vehicles. If we tried to do that, our end customers would laugh us out of the room.

However, I believe consumers also have a way to laugh Tesla out of the room, eventually: public policy ideas like the first sale doctrine, or just straight up passing new laws saying that when you buy a car, the manufacturer must provide basic certain basic services (such as allowing the vehicle to run, and warranty for basic components) even if the purchaser elects to deactivate some of the data collection.

In the past few decades, we have really allowed power to accrue to large corporations, but I think that things like the right-to-repair movement show that the pendulum may swing the other direction, at least in some contexts. Regardless of overall political or economic ideology, as soon as a large portion of the population realizes that these OEMs are basically saying "yes, pay me a good chunk of your annual salary, and I'll let you use this vehicle as long as you don't piss me off," I think things will swing very quickly in favor of consumers. The reason it hasn't yet is because most people don't have to deal with vehicles with these restrictions.

Re:What kind of data is my new car collecting? by Jamwinner on Wednesday January 15, 2020 @11:56AM (#22055860)
Which is why Tesla will never have a place in my fleet. I can afford it, and love the mechanical tech, but the lack of rights and privacy is appaling. It shocks me people pay for their own piecemeal enslavement for the latest shiny thing.
Re:What kind of data is my new car collecting? by admax88q on Wednesday January 15, 2020 @10:31AM (#22055050)
Finally car manufacturers can kill the used car market just like video game companies killed the used game market.

I'm sure its not going to be long before you don't _own_ your car, you just purchased a license to use it for a period of time.

Re:What kind of data is my new car collecting? by slipheen on Wednesday January 15, 2020 @11:17AM (#22055503)
I've read about people removing the modems from their Teslas in the past.

Have they updated the software such that this isn't possible?

Re:What kind of data is my new car collecting? by logicIsTruth on Wednesday January 15, 2020 @10:34AM (#22055079)
Hopefully the rest of the industry follows Tesla and makes paid car DLC and constant updates. /S
Re:What kind of data is my new car collecting? by magduf on Wednesday January 15, 2020 @11:29AM (#22055618)
>That said, I believe that there is very limited legal recourse for a vehicle OEM who wants to prevent an end user from changing the data collection and upload features of their vehicles. The worst thing would be potentially voiding the warranty, but for 10-15 year old used vehicles, that's not an issue.

>I work as an in-house counsel at a vehicle OEM

If you're really a lawyer, I'm surprised you'd write any of this, because it's blatantly false. The Magnusson-Moss Warranty Act of 1975 makes it blatantly illegal to "void" a warranty for any modification, unless it can be proven that the modification caused the issue that the customer is making a warranty claim for.

Re:What kind of data is my new car collecting? by clucas on Wednesday January 15, 2020 @12:01PM (#22055903)
I wasn't aware of that, but perhaps it will hearten you to know that I don't deal with warranty law in my day-to-day. So, I clearly have more to learn - not sure why you felt it necessary to call my credentials into question over it though.

But in any case, your post does strengthens my main point, which is that fear over surveillance of vehicles by OEMs, with no consumer recourse, is somewhat overblown.

EDIT:

Just read Magnusson-Moss, and I have a question since you seem to know about it - you said the act "makes it blatantly illegal to 'void' a warranty for any modification, unless it can be proven that the modification caused the issue that the customer is making a warranty claim for."

But the act itself says "the warrantor shall not impose any duty other than notification upon any consumer as a condition of securing remedy [...] unless the warrantor has demonstrated [...] that such a duty is reasonable." 15 U.S.C. § 2304(b)(1).

Based on what's actually in the text of the law, I could imagine Tesla or some other OE making the argument that it is "reasonable" to condition the warranty on the consumer continuing to feed the stream of telematics data to the OE, because it allows them to identify warranty issues before they require substantial repairs, thus potentially saving significant money for the OE, and significant time for the consumer - certainly a reasonable thing. I personally don't agree with that argument, but I'm curious how you would respond to it, and how you can be sure that a court would shoot it down.

Re:What kind of data is my new car collecting? by magduf on Wednesday January 15, 2020 @12:57PM (#22056522)
I only questioned your credentials because you said you were in legal counsel, and at an automotive OEM of some kind. Most people who've done any significant DIY car work know about this law, because it's protected them for decades from dealers that would try to deny them warranty coverage for completely unrelated non-dealer repairs or maintenance. For instance, a dealer can't claim that some kind of engine trouble isn't covered because you replaced your own brake pads, or worse, because you replaced the radio. They also can't deny warranty coverage just because you had an independent mechanic work on your car instead of the dealership. Furthermore, they can't require OEM parts to be used, unless they provide them for free. I would have thought anyone working in automotive legal would know about this off the top of their head.

As for your example, that sounds pretty contrived and ridiculous to me. Doesn't mean someone might not try it though; companies have tried lots of ridiculous legal tactics before, such as Oracle's current API lawsuit. But I imagine any decent court would shoot it down pretty quickly. Warranty claims are made because parts fail before the warranty expires; the absence of telematics isn't going to magically make some mechanical part fail faster. It might help identify it sooner, sure, but it's still a defective part for failing that quickly, so I don't see how the consumer disabling telematics absolves the manufacturer from covering this. In short, it's never been "reasonable" before this for car companies to have telematics to keep their machines working properly through the warranty period, so why is it suddenly required now? It's not reasonable for anything else either; does a new house need telematics for the house warranty to be valid? How about a blender or toaster in the kitchen? I don't see this argument going far at all.

Re:What kind of data is my new car collecting? by clucas on Wednesday January 15, 2020 @01:24PM (#22056857)
Fair enough. Thanks for the reply, that all makes sense.

I have never run into a situation where my current company tried to limit its warranty in legally interesting ways (and it wouldn't necessarily get to my desk anyway), so I never really had call to dig and find Magnusson-Moss. I suspect that knowledge of that law is probably more top-of-mind for DIYers than for OEM lawyers.

I still think that whether requiring telematics is a "reasonable" condition for a warranty is more complicated than you think, but what you're saying is exactly the counterargument I would make.

And, I hope I've provided some assurance that I am, in fact, a lawyer. Whether I'm a good one is perhaps up for debate. :)

Re:What kind of data is my new car collecting? by jellicle on Wednesday January 15, 2020 @01:06PM (#22056625)
I shouldn't need to attack my car with a soldering iron and wire cutters because I don't want to be tracked by it.
Re:What kind of data is my new car collecting? by stjohnswarts on Wednesday January 15, 2020 @04:38PM (#22058970)
I agree it should be an opt in policy. This is why I'm against tollways because they don't immediately just charge me and toss the data after say 90 days. They keep where you've been essentially forever or until DOT forgets to back it up and the drive crashes.