NHTSA tells automakers not to comply with Massachusetts right-to-repair law

Re:NHTSA tells automakers not to comply with Massachusetts r... by lelandbatey on Friday June 16, 2023 @12:27PM (#36359357)

Posted by another person here in this thread:

https://s3.documentcloud.org/documents/23846284/nhtsa-letter...

The letter only calls out one very specific part of the law around allowing open-access to send commands, which the letter states is an unacceptable security risk and would qualify as a "manufacturer defect", which manufacturers cannot knowingly include in their cars by federal law.

> The open remote access to vehicle telematics effectively required by this law specifically entails “the ability to send commands.” Open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking, as well as equipment required by Federal Motor Vehicle Safety Standards (FMVSS) such as air bags and electronic stability control. A malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently. Vehicle crashes, injuries, or deaths are foreseeable outcomes of such a situation.

Hopefully, the response to the letter by manufacturers is to say "Okay, we won't include that clear and obvious security flaw, but we will comply with the rest of the Massachusetts law and allow free access to other telematics such that they're available AND secure."

I wouldn't put money on that being their response though.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by JumpCrisscross on Friday June 16, 2023 @12:43PM (#36359645)

Thank you. The footnote 6 for why acting "in accordance with that law... would conflict with your obligations under the Safety Act" cites NHTSA recall notices.

It looks like this is at the NHTSA's discretion.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by zardo on Friday June 16, 2023 @12:48PM (#36359753)

The ability to remotely send commands that spoof the accelerator pedal should probably be considered a safety defect. Not just if Jake's Auto Repair can do it, but if Ford Motor Company can do it.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by AnthonyMouse on Friday June 16, 2023 @01:12PM (#36360192)

More to the point, the problem here is if it could be done by someone not authorized by the vehicle's owner, rather than by someone not authorized by Ford Motor Company.

If the vehicle's owner wants to modify their car's code, or pay someone else to do it, there are many legitimate reasons to do that and it's no different than the mechanical modifications that people have been doing since cars were invented.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by bluGill on Friday June 16, 2023 @01:17PM (#36360279)

As the potential buyer of the car used in a few years I want to know if it was ever run non stock, as most modifications trade how long the car will last for more power.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by AnthonyMouse on Friday June 16, 2023 @01:25PM (#36360438)

There is no way to know that. Someone could remove the entire computer, put it on a shelf, operate the car with a modified one and put the original back in before they sell it to you.

Moreover, this rule is about remote access, not what someone can do who has direct physical access.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by HeyLaughingBoy on Friday June 16, 2023 @02:35PM (#36361562)

Yup. In fact, I have a vehicle where exactly that happened. Bought a used diesel pickup truck. A year later it wouldn't start: ECU was completely unresponsive and wouldn't even send anything over OBD. Had it towed to the dealership and during their analysis they found an aftermarket torque chip in the ECU and removed it. Truck started right up after that.

If the dealer hadn't mentioned that, I'd never have known. I don't even know if the person we bought it from knew about it since he was the second owner.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by zardo on Friday June 16, 2023 @03:57PM (#36362945)

Giving the vehicle owner an easy button to crash their car remotely is going to be a liability for the manufacturer when the obvious happens and it's used as murder weapon.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by AnthonyMouse on Friday June 16, 2023 @08:41PM (#36365907)

This makes zero sense. It's like saying giving the owner a steering wheel they can use to crash their car into a pedestrian is going to be a liability for the manufacturer when the obvious happens and it's used as a murder weapon.

That's ridiculous, the person who is liable for the murder is the murder, not the car company. It's a transparent excuse because they want to force people to have their car repaired at the dealership. Nobody's buying it.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by zardo on Saturday June 17, 2023 @08:10PM (#36376060)

There is a legitimate use for a steering wheel. The ability to remotely command full throttle on a car is useful for what?

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by AnthonyMouse on Sunday June 18, 2023 @11:01AM (#36380897)

It's a computer. There are many legitimate reasons for the computer to control the throttle, from implementing a top speed governor when the car is in the hands of your children, to tuning the engine for unusual environmental conditions, to interoperating with aftermarket vehicle modifications.

"Remotely" is just how the code gets installed. But installing updates for any of those features over the air is perfectly fine when authorized by the owner of the vehicle.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by bluGill on Friday June 16, 2023 @01:14PM (#36360231)

The ability to command the accelerator pedal is important for many diagnostics tests. Sometimes the car is on a dyno for those tests which makes it impossible for the car to know it isn't on the road.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by smolder on Friday June 16, 2023 @02:03PM (#36360995)

This access only needs to be physical. There is 0 argument for providing wireless access to the accelerator. Physically plugging into the car for accelerator control or having someone work the pedal are the only methods that make any sense.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by bluGill on Friday June 16, 2023 @05:23PM (#36364103)

The computer can do diagnosis if it can command that pedal. Often better than physical access as the computer can get the exact rpm it wants.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by smolder on Friday June 16, 2023 @01:58PM (#36360925)

Yes, or if the police can do it. That would also be a defect, IMO. There should be NO control possible of safety critical systems by anyone not in the drivers seat.

[ Parent | on HN ]

Re:NHTSA tells automakers not to comply with Massachusetts r... by MSFT_Edging on Friday June 16, 2023 @01:11PM (#36360184)

I find this interesting, because "Sending commands to <systems>" is how aftermarket self driving works. I'm specifically thinking of George Hotz's venture. It connects up to OBD and can control steering, brakes, and gas if they're drive by wire. I know at least Toyotas allow this, and to a lesser extent Hondas.

[ Parent | on HN ]