Do we have a copy of the letter?
If this is based on law, the NHTSA doesn't have a choice. It has to enforce federal law, and federal law trumps state law. If it is based on a rule, the NHTSA has discretion and something screwy is going on.
If this is based on law, the NHTSA doesn't have a choice. It has to enforce federal law, and federal law trumps state law. If it is based on a rule, the NHTSA has discretion and something screwy is going on.
https://s3.documentcloud.org/documents/23846284/nhtsa-letter...
The letter only calls out one very specific part of the law around allowing open-access to send commands, which the letter states is an unacceptable security risk and would qualify as a "manufacturer defect", which manufacturers cannot knowingly include in their cars by federal law.
> The open remote access to vehicle telematics effectively required by this law specifically entails “the ability to send commands.” Open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking, as well as equipment required by Federal Motor Vehicle Safety Standards (FMVSS) such as air bags and electronic stability control. A malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently. Vehicle crashes, injuries, or deaths are foreseeable outcomes of such a situation.
Hopefully, the response to the letter by manufacturers is to say "Okay, we won't include that clear and obvious security flaw, but we will comply with the rest of the Massachusetts law and allow free access to other telematics such that they're available AND secure."
I wouldn't put money on that being their response though.
It looks like this is at the NHTSA's discretion.
If the vehicle's owner wants to modify their car's code, or pay someone else to do it, there are many legitimate reasons to do that and it's no different than the mechanical modifications that people have been doing since cars were invented.
Moreover, this rule is about remote access, not what someone can do who has direct physical access.
If the dealer hadn't mentioned that, I'd never have known. I don't even know if the person we bought it from knew about it since he was the second owner.
That's ridiculous. The person who is liable for the murder is the murder, not the car company. It's a transparent excuse because they want to force people to have their car repaired at the dealership. Nobody's buying it.
"Remotely" is just how the code gets installed. But installing updates for any of those features over the air is perfectly fine when authorized by the owner of the vehicle.
Then, even with federal preemption, the auto manufacturers would be forced to comply.
For it to work, I'm guessing that additional states would need to join Massachusetts.
Unfortunately, as we've seen with New York, that would probably be opposed by significant back-room sleaze.
“ Subaru and another automaker, Kia, have been especially aggressive in resisting the law. While other companies are counting on a long-running federal lawsuit to overturn the statute, Kia and Subaru opted to shut off the features in their vehicles that are covered by the law.”
I'm not familiar with Massachusetts politics. It's a game of chicken between Boston and the NHTSA (or Congress), not the automakers--they have to comply with the law.
At which point people are going to notice, and ask why, and when they learn the answer is that the NHTSA is captured by automakers, maybe the NHTSA would like to avoid this hit to their reputation more than the commonwealth of Massachusetts would like to avoid looking like it's standing up to Big Auto.
Massachussetts would be banning the registration of new cars. Manufacturers wouldn't have a choice because they can't comply with the Massachussetts law. Maybe consumers who don't want to register their cars will still buy, I don't know.
It's a high-stakes gamble at pressuring the NHTSA. There are likely better ways to do that than shutting down the state's car business.
You know perfectly well that hardly anybody is going to do that.
> There are likely better ways to do that than shutting down the state's car business.
Like what? You have to do something that gets people to notice enough to put pressure on the captured regulators.
Get the state's Congressional delegation to introduce a law that would explicitly protect state right to repair laws, taking it out of the regulators hands, moving the debate about cybersecurity claims vs right-to-repair to a different and more visible venue.
Obviously, the State gov can't compel that, but if the right-to-repair rule is sufficiently popular with the state electorate, it should be easy to convince the State's representatives in Congress to push on the matter.
Something can be popular (in the sense that a significant majority are in favor) without having enough interest or organization behind it to cause federal representatives to care. Moreover, Massachusetts is about 2% of the federal legislature. Even if their citizens and representatives care about it a lot, they may not have the votes to do anything at the federal level.
Whereas if they refuse to be cowed, it costs the automakers something. Maybe they'd like to be able to sell cars more than they'd like to be able to lock third party mechanics out of them, and stop pressuring federal regulators to keep doing what causes them to be prohibited from it.
Which is why I said "Massachussetts would be banning the registration of new cars."
> Like what?
In the short term, their AG can sue under the Administrative Procedure Act. SCOTUS is re-working Chevron, and this case might thread the needle.
In the medium term, they could angle for DoT intervention. This would probably require coordination between their Senators and other like-minded states'. In the long term, the Congress must pass legislation that, if not granting a right to repair, at least explicitly enables it.
In summary, someone has to commit to making this one of the half dozen or so things one gets to do in office. I'm unconvinced Massachussetts voters would reward that.
You know, all that data they were hoping to make money on.
Not if manufacturers are federally prohibited from complying with the requirements of your registration conditions; there won’t be anything qualified for you to register.
I would, but the US Supreme Court in Gonzalez v. Raich, 545 U.S. 1 (2005) already did; the current state of nonenforcement of federal prohibition agaimst state-authorized use isn't from a Constitutional limit due to the interstate commerce clause, but from a federal law adopted by Congress, specifically, an appropriations rider adopted in each spending bill since 2014 prohibiting DoJ from spending funds to enforce federal marijuana laws against certain acts whetr authorized by state law.
That is a pretty convoluted process to do not enforce a law.
> The NHTSA said a malicious actor "could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently."
Yet, the Mass law is looking for...
> allow independent repair shops to access diagnostic data that newer cars can send directly to dealers and manufacturers to allow consumers to seek repairs outside dealerships.
It sounds like the same access to get data on the vehicles also allows control. For auto companies to comply with both laws could be possible but that it would require more fine grained access controls.
Or, am I missing something?
Right now they have a system where automakers granted themselves a dangerous and unreasonable level of remote access to cars that aren't theirs. Now they're claiming that it would be dangerous and unreasonable for third parties to have that level of remote access to cars that aren't theirs.
No kidding.
But you could easily have a system where a remote access server has to be authorized by the owner, e.g. by having to press a button inside the car while the key is present. And could be revoked by the owner in the same way. Then the car could be repaired by anyone... who is inside the car and has the key. Which is not only completely reasonable, it's more reasonable than the thing they're doing now.
Some car manufacturers have also attempted to use encryption and implemented it so poorly that it was easily cracked.
There is no technical reason that a car key can't effectively be a yubikey. The computer issues a challenge to the key, answering the challenge requires a secret stored in the key, so you need the key. It works as long as the encryption isn't broken.
And if "car can be remotely controlled" and the encryption is broken then that's a much bigger problem than anything your local mechanic is doing.
This is how most modern “smart key” systems work.
Really seems like a lot of fuss about stuff that has plenty of possible options. I might even call it FUD or a miscommunication it's so sloppy.
Personally, I don't want a car sending data to anyone. I disconnected OnStar in the one vehicle that had it. Pretty simple to remove the bridge between the cell board and the rest of the electronics.
This might be factually correct, but it's not how it works in practice.
The federal government exists at the behest of the states, not the other way around. When states start banding together in direct protest of the federal government, there's two paths forward: one escalates violence and leads to a civil war, the other peaceful strips the federal government of illegitimate power.
This is why the DEA cannot enforce their brain dead cannabis laws in California, and why the ATF cannot enforce their brain dead gun laws in Texas.
That is very fundamentally not true--it is the reason the US Constitution exists at all in the first place. In the US, it is neither the case that states exist at the behest of the federal government (that would be true in a unitary state, which most US states are, incidentally), nor that the federal government exists at the behest of the states (that would be true in a confederation, as the US was pre-1787). Instead, the US is a federal state, which means that the federal government and the constituent states have their own existences and loci of independent powers, and are in some sense co-equal.
And every time states decided they were going to disagree with the federal government by force, it is not the states who won that argument.
A rag-tag group of untrained goat herders and farmers kicked out the largest military force in the history of the world using basic fighting equipment. This is all despite their invaders having tanks, helicopters, jets, satellite imagery, night vision, body armor, and 10:1 ratio of boots on the ground.
The overwhelming majority of experienced combat veterans have been out of the US military for almost a decade and side themselves more with their state of residence than the federal government. There is an entire generation of Americans that have more combat experience than anyone currently in the armed forces.
Why exactly do you think the federal government is going to do anything again? The deck is stacked against them. It's much better if the federal government peacefully relinquished power and gave it back to the states.
The argument seems to be that anyone that disobeys the US federal government should be killed because it happened 150 years ago, therefore it will happen again the same way today.