Automakers try to scuttle Massachusetts ‘right to repair’ law

I’m not sure how this logic applies when having insurance is mandatory. If you don’t have insurance, you’re not driving legally.

Are there really people out there who wouldn’t otherwise buy insurance, but they choose to do so only because the cost of repairs is too high?

The facts in your post are wrong. Insurance companies establish rigorous processes to steer repairs to the low cost provider and push that provider to make only necessary repairs. Policy holders might go along with it and might not, same as other insurance scenarios.

> That’s why you see things like medical insurance not being aligned with lowering medical costs

Health insurance companies are lambasted all the time for denying coverage for certain procedures or medicines or requiring prior authorizations to prove it is medically necessary or evidence based treatment.

They were probably surprised because the insurance company would have paid the fair market rate for the replacement (parts & labor based on various quotes), regardless of if a professional did the work, if you DIYed it, or even if you never decided to repair it.

You likely talked yourself out of additional money.

People work on their own cars and have done so for at least a hundred years. Using technical means to prevent people from doing their own repairs, or from hiring someone of their choice to do the repair, is a relatively new thing.

All repairs are unlicensed.

No such thing as licensed repair thanks to Magnuson Moss Warranty Act.

This.

Back in 2013/2014, my Jeep was rear-ended. Some of the body panels were back-ordered, so the repair took 2 months longer than expected. Even if I was could have done the body repair, I couldn't have purchased the parts.

Likewise, a co-worker had his airbags stolen last year and it was many months until Acura had replacements available.

Does this not affect insurance?

We have categories of write off, so if insurance has paid out it affects the future value of the car.

This would be a category D [0], which makes a big difference on resell.

0: https://www.rac.co.uk/drive/advice/know-how/what-is-a-catego...

It's not as simple. For example, look at the distance sensors used for parking and the data coming from them over the CAN bus.

That bus needs to be able to (at least indirectly) reach the brakes so that automatic emergency braking can take their measurements as inputs. And that bus needs to be able to reach the audio system to provide audible feedback to the driver when parking, and also mute the radio. Ergo, you have a bus that reaches both brakes and radio. Now, you might want to prevent the radio firmware from sending data to the brakes over that bus, but physically you have to have a connection between them, as we don't really want to make many separate buses for reasons of complexity, cost and maintenance; moving from a separate end-to-end wire for each specific purpose towards a shared bus was a great improvement.

Without all that being connected how else would they use the built-in lte to send back all of the data about you from the car? Car companies cant be missing out on selling customer data too.

Because people want things like remote start, remote climate control, etc. that they can control from phone apps.

There really isn't any reason why your infotainment system can't be separate from core functioning control. It's just cheaper for the manufacturer to slap it all in one platform with the added advantage of huge profit margins on getting it fixed when something simple fails.

The reason is optimizing for lower cost.

No, your radio has to be able to talk to the engine controller. How else can you get the engine to backfire in time with the beat?

I fail to see the problem. Ditch the bullshit or at least corral it into a corner where it can't fuck with anything vital to vehicle operation and safety. ABS systems (for example) worked swimmingly decades before the first net-connected infotainment system was theorized.

Tesla already does this. You can reboot the user screen while driving the car. Everything works but the only negative thing I've noticed is that you get no indication of turn signals working (they're flashing).

What's wrong with doing that?

It's not about security by obscurity. A better analogy would be the fight over "tivoization". In safety-critical and highly-regulated systems like automotive and health care, there's a meaningful regulatory interest in ensuring that the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways. That means that the software and firmware running on each of the dozens of ECUs in a vehicle is part of the (regulated) functional safety spec of the system. There are real, meaningful technical challenges to overcome if you want to meet both the goal of ensuring that dangerous and malicious software can't run in safety-critical domains, and the goal of allowing users to modify their vehicles as they see fit.

I'm speaking as one of the authors of the Uptane standard for secure software updates in vehicles, and as a life-long proponent of user freedom and open access to the computers we buy. There are possible solutions here, but they are not easy.

It's an open secret in the industry that the CAN bus is not authenticated. If you connect, you can read the data on the bus and inject the data on bus.

But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it.

Now they have this security concept where every ECU on the car will have their own private key in their own secure enclave. You need that key to put authenticated data on bus and it can only be updated by the OEM's.

The authenticated bus infra will probably not protect against remote attacks ( since if you own the ECU SW you have the cert and you will still be able to publish signed messages) but will kill ability to change HW.

I really would not like to kill our ability to fix our vehicles but I feel this is the thing that is going to happen.

> Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity?

Yes

(I've reverse engineered the security system on an ABS controller for the top selling vehicle of a major auto manufacturer. It is atrocious. I'm pretty confident the whole reason it exists is so that they can claim they have one to use the DMCA to stop third party tools from interacting with it.)

I suspect that auto makers are fully aware of this and are salivating at the idea of extra income with upgrade and repair fees.

So far this has eluded public consciousness, but I expect it will hit the users hard at some point in the near future.

like this; an ECU is an ECU. match unit to make and model. gap the ECU from remote modifications. an ECU doesnt require keys, they are not part of the required properties of an ECU.

Direct democracy is easier to buy than representative democracies for two reasons: first, voters have other things to do with their time than become experts on every bit of law that comes before them. And second, they don’t have the ongoing interest in rule-making, implementation & enforcement an interested legislator does.

Reading the book Street Level Bureaucrats was eye-opening for me on why seemingly “common-sense” solutions like Direct Democracy end up either just not working or having the opposite of the intended effect. Laws are less like writing software for a computer and more like designing processes for a team writing software.

You can vote with your wallet by either not buying a car or only buying used cars.

Here's a source to support some of the above the above claims (including a link to PDF of NHTSA letter): https://www.techspot.com/news/99079-biden-administration-car...

There's some interesting context missing from the explanation too, which is that apparently the feds were consulted years ago and they said "it's fine."

The Massachusetts Right to Repair Coalition's response to the NHTSA letter:

On behalf of two million voters and thousands of independent auto repair shops across Massachusetts, we are outraged by the unsolicited, unwarranted, and counterproductive letter from NHTSA that conflicts with the Department of Justice's statement submitted two years ago in federal court stating that there was no federal preemption. NHTSA's letter is irresponsible, having been transmitted without any new evidence and after the conclusion of the federal trial, despite having been asked by the judge to participate in the court proceeding and declining. NHTSA's letter fails to acknowledge the evidence and testimony presented at the trial that demonstrated the viability and security of an open access platform. This is yet another delay tactic the manufacturers are using to thwart the will of their customers, Massachusetts voters who voted 75-25 in favor of their right to get their car repaired where they choose. The FTC, the Biden Administration, and many members of Congress have all come out in support of Right To Repair.