The issue is regulators write regulations for one thing, but want a subtly different thing.
If you and I start a game of poker, but rather than winning through skill, I call the FBI and get them to search all your cards, have I broken the rules of poker? It wasn't a written rule not to call the FBI...
Regulators across the world have similar gaps in the rules, and both humans and automated design tools will start to exploit them, possibly unknowingly. Instead they need to make far more watertight rules. They should simply require all cars to measure their own emissions, and bill the companies for any cars which either mis-measure emissions, or measure more emissions in their lifetime than an allowed limit. Then manufacturers will have an incentive to upgrade cars in the field.
Since when is demand sufficient to bring something into existence?
"When a measure becomes a target, it ceases to be a good measure."
But it was a written rule not to use a defeat device.
This isn’t a case where manufacturers found a loophole and regulators got upset because they wanted manufacturers to obey the spirit of the rules rather than just the letter. This is a case of manufacturers blatantly breaking the explicit written rules.
If I am designing a printer and you say "it must be able to output 10 pages per minute printing black and white text, and make it as light as possible", then I, the printer designer go to work, tweaking the design of the printer to meet that goal, while keeping the weight down.
Seeing nothing about the color printing speed, I don't care about that. It's just black and white speed that matters! I make the black cartridge super fast and super wide. Whoa - gotta keep the weight down! Oh well - I'll make this colour cartridge smaller/cheaper/slower/lighter.
Suddenly, we have a printer that does 10ppm of black and white, and only 0.1ppm of colour, because it has to crawl along.
We now have a 'defeat device'. It performs great in test conditions (black and white text), and badly in general use (colour pages are common).
Did the designer explicitly make a defeat device? Not really... They just only made it work well in the test conditions, and performance in all other conditions suffered.
With your example, you’d be stuck arguing to a judge that color printing is not a normal part of your device’s operation and therefore your loophole exploitation is legal. Which isn’t going to get anywhere at all.
The law is not stupid nor is it evaluated by machines.
Car makers didn't optimize what they were told to optimize for, they optimized for the test they knew the regulators would perform.
A correct analogy would be you telling manufacturers, "the printer must use at most X grams of ink per square centimeter", but then they go and only optimize it for the specific test printouts you will do. In truth their printer is exceeding that threshold just so they can also advertise higher printing speeds.
Even game-theoretically perfect regulation does not work if they're violating the rules.
But I doubt that any popular politician will have the guts to push such a bill against all the industry lobbies :-/
I am so tired of replacing devices just because you can't fix broken software that I see very few alternatives to forcing the manufacturers by law. Just to give an example:
The Samsung Galaxy S3 was shipped with a firmware bug [1] that killed the memory occasionally (just the layout of some internal table so the hardware was completely okay). Sure, when it happened during the warranty period, it wasn't good for Samsung but afterward, you thought your hardware was broken when in fact just the software was broken (and a factory reset doesn't fix firmware internals).
The reason we even know about that bug is that someone disassembled the firmware years after the device had a relevant market share. If the source code for the firmware would have been available, the bug probably would have been made public much earlier and a lot of broken devices would have been repairable.
So I totally understand that manufacturers want to keep some things secret about their products but as a consumer, I feel betrayed when the devices I buy contain time bombs encoded within their software... And since the manufacturers fail to bring recent updates to the devices even during the warranty period, I think it might be a valid option to enable consumers to care for their devices.
[1]: https://media.ccc.de/v/34c3-8784-emmc_hacking_or_how_i_fixed...
I don't dispute that it'd be useful, but the standard for whether it should be statutorily mandated ought to be way higher than that.
>The Samsung Galaxy S3 was shipped with a firmware bug [1] that killed the memory occasionally
I don't really see that as fundamentally dissimilar to a single shoddy physical component bricking an otherwise perfectly functional device.
Consumer devices _used to_ ship with schematics though...
Some (maybe most?) Mercedes units use a Bosch ECU. I'm pretty sure you can dump the firmware from them and figure out how they work fairly easily?
It is however much easier to do some social engineering or hire a bosch employee :). Mercedes, porsche and bosch all have their HQ in Stuttgart, I think it is quite easy for them to know what happens with competitors.
Moreover now with Autosar, they scatter vehicle functionalities through ECUs, with each ECU doing a part of the functionality. It's getting really complex now.
To understand the issue with reverse engineering, one needs to understand that there is no standard in car. Each brand and car has its own communication matrix and electrical architecture, which get periodically overhauled. So even if you manage to identify the meanings of the CAN frames for a make, it is useless for the next generation.
That's why you do not find the communication matrix on internet for recent cars, you only find them somehow for old cars. Also because very few people know how to read CAN network and want to invest timr in this reverse engineering
Excuse me if I sound ignorant but... aren't you able to put the ECUs into a special bootloader mode where you can dump the encryption/protection?
I’m still one of those who think that what Volkswagen did wasn’t cheating anything. They basically “studied for the test” in order to pas it.
I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test.
The only real difference between this an the VW emissions scandal is that everyone has to suffer the consequences of cheating the test!
> I suspect similar cheats are employed all over the industry. For example my motorcycle has a dead spot which people have been known to bypass the clutch switch to avoid. The reason for the dead spot is that the noise test is carried out at a specific speed and by programming a dead zone in the fuel map they can make it pass the test.
Can you go into more specifics about this? I used to ride and am embarrassed that I have no idea about this "dead spot" you are referring to.
Example A: "Each model of this type of car must pass Test X with numbers lower than listed in Table Y"
Example B: "The cars must have emissions lower than listed in Table Y. The standard test may be Test X"
If it is written like Example A, then sure, the entire specification is the test, they merely designed to the rule.
But if it's more like Example B, then they are toast. The cars clearly don't ordinarily have emissions lower than Table Y, they are merely engineered to appear to do so during the specific conditions of Test X.
If there is one thing I've learned about the law from the excellent attny who will soon also be my wife, it is that you cannot reason about the law without reading it. Logic and assumptions will not help you -- you have to look at the law itself.
It is actually a lot like software. Our guesses about the behavior might be OK for very limited purposes, but we really don't know jack until we trace it in a debugger or read the source.
(tracing & reading source might be considered analogous to reading the cases and reading the law & regs)
VW did something different. They installed defeat devices that are explicitly illegal. And they knew it as shown in documents and mails. VW also pled guilty in the US already.
So, while both things are on the surface similar they are yet fundamentally different.
And if you still don't know it, every single Diesel engine with this most common Bosch ECU has this cheating SW. The problem is only if you use it or not. 80% do use it. From all European cars only Fiat didn't use it, if I remember correctly. Most Asians did use it also.
You are saying VW installed it. No, Bosch installed it on their devices. And it was written by Audi.
Who's responsible? You still are of the impression that only VW uses this cheating device. Everyone is using it.
Responsible for this device is Bosch.
Audi was a major supplier of Diesel engines for the whole group, especially the larger ones which also ended up in Porsche Cayennes. The smaller Diesel engines came AFAIK from VW. True, the software came from Bosch and can arguably be used for development purposes. The exact role of Bosch in all of this is still not clear.
The only companies found to be using the Bosch supplied software as an illegal cheat device is VW so far. Maybe Mercedes did as well. BMW was, as if now, more or less cleared of illegal wrong doing. They still had to pay fines, so.
Other car makers are, as far as we now today, "only" using the legal loop holes. Still shitty behavior but at least legal. PSA (Peugeot, Citroen, DS and as of last year Opel) are themselves a major Diesel engine supplier and while they paid fines as well, if I remember correctly, they didn't use defeat devices.
EDIT: For clarity, PSA wasn't found to use defeat devices. They had to pay fines in France AFAIK.
But Bosch covered their ass by writing something along "Please note that this is just for testing and cannot be used on production.".
Come on, if your billion-Euro client asks you (or your boss) for this software...