‘Big brother’ black boxes to soon be mandatory in all new cars
bgr.com
bgr.com
(b) Limitations on Information Retrieval-
(1) OWNERSHIP OF DATA- Any data in an event data recorder required
under part 563 of title 49, Code of Federal Regulations, regardless of
when the passenger motor vehicle in which it is installed was
manufactured, is the property of the owner, or in the case of a leased
vehicle, the lessee of the passenger motor vehicle in which the data
recorder is installed.
(2) PRIVACY- Data recorded or transmitted by such a data recorder may
not be retrieved by a person other than the owner or lessee of the
motor vehicle in which the recorder is installed unless--
(A) a court authorizes retrieval of the information in furtherance of
a legal proceeding;
(B) the owner or lessee consents to the retrieval of the information
for any purpose, including the purpose of diagnosing, servicing, or
repairing the motor vehicle;
(C) the information is retrieved pursuant to an investigation or
inspection authorized under section 1131(a) or 30166 of title 49,
United States Code, and the personally identifiable information of the
owner, lessee, or driver of the vehicle and the vehicle identification
number is not disclosed in connection with the retrieved information;
or
(D) the information is retrieved for the purpose of determining the
need for, or facilitating, emergency medical response in response to a
motor vehicle crash.
You're wondering, "section 1131(a) or 30166 of title 49"? That's the NTSB. Highway safety investigations.For perspective: had this standard not been pushed federally, the private sector could probably do far worse; your (mandated, and reasonably so!) car insurance influences all sorts of standards on the vehicles we drive.
23.1.23.44 (Page 198 of 301) "Your use of this vehicle grants us your irrevocable and permanent consent to download, transmit, or otherwise obtain the information contained in the onboard data recorder, and to share that data with third parties, including but not limited to law enforcement (without a court order), and marketing companies."
Note that Honda (and most other manufacturers) were inevitably going to put event data recorders in cars anyways. They are too cheap and they make too much sense not to have.
So without the federal rules, what you'd have is market full of cars with event data recorders and no rules regarding data ownership or requirements to disclose (this bill requires full disclosure about the devices and their purpose).
But BGR doesn't want to tell you that, because their purpose here isn't to inform, it's to generate rageviews.
"Rageview" may be my new favorite word. Thank you for expanding my vocabulary.
Ah yes, the "free market" in action. That has worked so well for us in protecting our privacy, as evidenced by the plethora of commercial software with EULAs that respects the user's rights.
Or are you saying Richard Stallman is going to build us a car next?
Here's how it works:
1. Government is constitutionally forbidden from collecting this information.
2. Government observes that private corporations can collect this information.
3. Government grants private corporations immunity from prosecution and civil liability if it collects this information and hands it to the government. Threatens prosecution and civil liability if corporations fails to collect information and "something bad happens".
4. US Supreme Court pretends this is acceptable by ignoring "intent" and "consequences" and then goes on to uphold "intent" and "consequences" in every other case before it.
> (2) PRIVACY- Data recorded or transmitted by such a data recorder may not be retrieved by a person other than the owner or lessee of the motor vehicle in which the recorder is installed
also, you say
> Ah yes, the "free market" in action. That has worked so well for us in protecting our privacy, as evidenced by the plethora of commercial software with EULAs that respects the user's rights.
this bill is exactly the opposite of free market. it says everyone has to put recorders and cars and then explicitly forbids certain uses of them.
Obviously, though: Honda's EULA is lawful and binding without the bill. This bill can only improve matters at this point. You can be irritated that it doesn't improve them enough, but that's not the case BGR is making.
It would be interesting to get the whole way through the new car negotiating process, then strike this line right before signing. What would the reaction be? How badly does the dealership want to sell that car?
It's not like selling Windows 7 in Best Buy. The cashier at Best Buy does not care whether I hate the EULA or buy Windows. The car salesperson probably cares very much about whether I buy the car, and they probably don't care much about some random EULA term.
Granted: a bit off-topic perhaps. I would hope that such blanket permissions terms on sales contracts would be overridden by the protections written into the law. For instance I don't think health providers can undercut HIPAA protections no matter what their contractual terms say.
I'm not saying it's not great we're talking about the implications of event data recorders. Upthread, someone noticed Honda selling you out to marketing companies. That's good to know. It's great that we're talking about this stuff.
But that BGR story is horseshit, and you should hold it against them in the future. It is a bad thing when businesses spin up bullshit stories to profit off pointless outrage.
If this law required the boxes to be installed surreptitiously (like they are now), or stipulated that the data on the boxes belonged to the government, or stipulated that they RF backhaul the data back to some central government computer, that would indeed be cause for alarm.
But this bill does the exact opposite of that.
So there are benefits here, and the public is more educated about the risks. Another benefit of the Senate legislation is that it applies to all EDRs in cars, so folks who put EDRs into your car today and do sell information to third parties (I'm looking at you OnStar) will also be bound by this.
So a more reasonable story might have been:
EDRs are in a lot of vehicles now, they represent both a privacy threat and a potential benefit. There are no explicit rules around what folks can do with them. Your government is 'fixing' that by making explicit what can and can not be done. Generally that would be an encouraging sign, and participating early in the process will help ensure its done in the best interest of the consumer rather than the installer.
Regarding your last sentence though: a likely trend may arise where all EULAs for modern cars include giving consent to the manufacturer to do what they please with the information from the EDR.
This would bypass the discussed bill because the bill allows you to give such consent. I think most people wouldn't be in an uproar about this. Thereby making this bill rather irrelevant; at least tooth-less against protecting the data.
Unlike CISPA, however, it means assholes who drive 70MPH down residential side streets in Benzes will be accountable when they cause accidents (Benzes don't have EDRs now). In other words: unlike CISPA, it actually does what it sets out to do.
That's enough of a win for me.
I wonder how much data these devices can store...I doubt they're putting a 100GB HD in every car to create a full historical record. It seems to me that all you would need for accident investigations is a few hours prior.
1. This adds cost without adding value to the consumer of the product.
2. The only value add is the ability of a democratic government run by the people...to track its people.
3. We already carry cell phones and use facebook. Do you really to build a whole new physical platform to get this done? Can you do it better than the cell phone providers and facebook?
4. We're not deep enough in debt yet? Want me to skip to the end game and just cut out my liver and hand it to you?
Every day I read HN and politico. I think politico is destroying things faster than HN is building them.
I want to see a PG post titled "Lets Hack Washington". I think the RIAA is too small a target.
http://www.computerweekly.com/blogs/the-data-trust-blog/2009...
This one in particular attacks what it considers consistency. It suggests that we cannot be sure that the data that is collected will consistently used accurately. It suggests that having ones fingerprints on file were the cause of a number of false arrests.
While I agree that if we collected no data, we'd probably have less false arrests, they convinently avoid talking about how many people have been correctly (as far as we can tell) convicted because of that data.
I'm not saying this has anything to do with the whole car article- I'm just saying that if someone is swayed either way by that simple computer weekly article, they haven't really thought the issue through themselves.
http://www.bbc.co.uk/news/technology-16969509
Makes it a lot cheaper for young drivers to get insurance.
I have to fact check everything, and frequently find these alarmist articles to have nothing behind them. If the powers-that-be are conspiring against us, a big part of their methodology must be blowing all this smoke in our faces so that whenever we see a "big brother" or conspiracy story we immediately assume it's false.
I'd like more facts in articles like this, e.g. the specific wording in the proposed law that requires transmission, not just recording, of data.
If we had the same degree of control over these recorders, I'd be less concerned.
By very definition of the capitalist society, no.
The only reason you exist in the wheel is to spend money, so of course more and more creative ways to do so will always be found.
What we've learned through repeated experience is that data collection always leads to some future configuration that we are not happy with. Maybe it's advertisers tracking our every move on the web. Maybe it's the police getting all of our cell phone records simply by filling out a form. Perhaps it's the government tracking all international calls. Maybe it's the cops taking COTS GPS devices and using them to track cars without a warrant. Whatever. The pattern is clear: one day we start collecting data. Somewhere down the road somebody starts using that data in a way we do not like. Big Data is simply too attractive to too many entities to leave alone.
While the cops angle is the one that's most emotional, my money says the real players behind the scenes here are the insurance companies. Initially, the spin will be for accident litigation, but within a few years they'll have "collecting any relevant data" clauses in all their new car insurance policies. And then they'll be able to see exactly how you drive. Insurance companies are already trying to do this voluntarily. I think Progressive has some kind of Orwellian name for it like "Safe Driver Program" or something. Don't know. All I know is that whenever I see their commercials it reminds me of how stupid they think their customers are.
It's a fair cop to say that many of these stories are overblown, emotional, and manipulative. But that's a far cry from saying they are useless. The problem here is trying to guess a future world in which this goes south. For every ten guesses, maybe one is close. So looking at it from that angle, what a terrible track record! But looking at it from the proper (in my opinion) angle, the problem is simply one of style. Nobody wants to read a long-winded discussion of the problems here, but everybody will click on "The police are checking your underwear every night using your iPad!" stories. Simply because that's the nature of the business doesn't mean there aren't also serious concerns.
I imagine if this trend continues we'll see "packagers", intermediary companies that assemble packages of just about everything there is to know about you and formatting it in a nice timelime -- public posts, blogs, travel records, phone call records, etc -- perhaps with an ongoing subscription service for those folks you want to keep close tabs on. It's a very interesting product idea. "Joe got up, tweeted about the football game last night, then posted this comment on HN. After driving to the gym at 10 mph over the speed limit, he called his mistress for 15 minutes...."
I'm surprised this isn't being done already by cell phone providers.
There have been several meta apps like this in the past. Spockeo comes to mind (http://www.spokeo.com/) These guys are focused on data retrieval from mostly online sources. What gets interesting is mashing it all up and putting it in a narrative, tracking format. Going for a job interview tomorrow? Take some time today and read a narrative of how this guy spent his days for the last month and gain a bit of an advantage. Welcome to the 21st century.
So it would be helpful if, while recognizing the implications of EDRs to law enforcement and the 4th Amendment, we made sure we kept the right framing.
They gave her this thing that she plugs into her car's diagnostic port. The incentive is that if an insured driver agrees to use the thing and wants to "prove" they are a good driver they can. In return the user gets an insurance discount if their driving stats are good.
The little object does something very basic: It counts the number of "hard stops" in every trip and uses cellphone networks to report the data. People can then go look up the stats online. 2 hard stops for this trip, 7 for this trip, etc. It's neat to see your stats.
Eventually it turns into a sort of game to eliminate the hard stops from your driving routine. You pay more attention to driving because of it and therefore become a more attentive driver.
At the end of 6 months you send the device back and your insurance is adjusted (or not).
This is a huge win-win for software making people behave better:
1. Girlfriend gets a lower insurance rate
2. Progressive has evidence she is not an insane driver
3. Most interestingly, the device has forced her to be (seemingly) permanently more conscious about her driving and has made her a better driver. Not only does the device find bad drivers, but it can convince many to become better drivers, possibly without them realizing it!
Literally software has consciously and unconsciously made her into a better driver and literally every party involved (her, progressive, people near her on the road) are better off for her having used this device.
~~~
All of that is good, as far as I can tell. But all of it was optional, too, and I understand that the topic at hand involves what happens when it becomes less-than-optional. It is not hard to envision a future where it will be impossible to get affordable insurance if you opt out.
This is a huge win-win for surveillance software making people behave better:
1. Well-behaved citizens carry on in their lives relatively freely
2. Gov't has evidence of your innocence (notice the implication here)
3. The constant surveillance has forced society to be permanently more
conscious about their behavior and made them better citizens.
Not only does it identify "bad people", but it can convince them
to become better people, possibly without them realizing it!
I realize I am putting words in your mouth and I apologize. You probably don't believe my "translation" but I want to point out that it doesn't take too much work to go from your words to mine.But the problem is that you can spin just about any kind of data collection in just the same way. In the 1960s, this exact scenario would have been part of a futuristic horror story. Robots and computers monitoring your every move, with your permission and encouragement, in an effort for you to become "better." In fact, I seem to remember several old sci-fi shows with just this kind of plot.
It's interesting to note that such a scenario doesn't seem so horrific any more, and those warning about it are more and more seen as alarmists. I'm not sure where this is all heading, but the trajectory in public opinion is not very heartening. Modern marketing is turning its attention to popularizing your life "assisted" by machines which then take lots of observations about your behavior and report on them back to some third party.
Scarier than "a future where it will be impossible to get affordable insurance if you opt out" is one where we get arrested/fined/penalized for making "too many hard stops" (whatever "too many" is, whatever a "hard stop" is and regardless of whether or not having "too many hard stops" makes you an unsafe driver).
We should be wary of Big Data because it is all too easy for people in control to report data that supports whatever theory they are trying to prove.
So stopping on amber lights or for idiot pedestrians or cyclists penalises her?
Of course a side effect of this is that rates for BMW drivers will plummet. I don't know how bad the brakes on a BMW are - but I've yet to see one stop for anybody.
I think I would be okay with this information being aggregated, analyzed, and even sold to insurance companies (perhaps even marketers, why not?).
But as soon as the data is being shuffled around with personally identifiable information attached to it, I agree with you.
Is there a better line between acceptable and non-acceptable?
It's called Snapshot, and that program's the main reason I chose Progressive. I very much appreciate that there's an insurance company that agrees that I should be able to get a lower rate if I can prove that I'm a more prudent driver. Sure, they gotta collect some data on my driving habits first. But how the heck else am I supposed to demonstrate to them that I have safer driving habits?
Personally, I think I'd have to be stupid to not take them up on the offer.
"Safe driving" is not a cut and dry thing, you may have to do things that, in a vacuum, appear unsafe in order to avoid an even less safe situation...
No, safe driving is not cut-and dry. Nor are the terms of their program. The discount you can get can fall anywhere within a very wide range, and depends on multiple non-binary factors.
I haven't looked into Progressive's program in particular, but car insurance is a huge information asymmetry problem. If I think I'm a better-than-average driver (thanks to Dunning-Kruger, most people do), then I'd benefit from my insurance company knowing more about my driving habits. Just because you value your privacy above the potential savings doesn't mean everybody who would prefer the savings is stupid.
Ok.
"...and transmit data"
Wait, what?
Are there any further details on how this is supposedly going to work? Do the boxes have built-in cellular modems with permanently-activated SIMs? What network are they connecting to? Where are they transmitting the data? Who maintains the servers?
Transmitting black-box data is a huge leap beyond simply recording it.
One computer company famously had an OS that met a US top security classification which required that all user events were logged. There was no way of reading these logs - but the security standard only required that there were logs, it didn't say anything about extracting them!
The law merely requires that black boxes be interoperable with specified tools for reading from black boxes, i.e., by incorporating a standard data transfer protocol (USB, Bluetooth, etc.).
http://news.ycombinator.com/item?id=3863555
The submitted article is just passing on the content of an Infowars post
http://www.infowars.com/mandatory-big-brother-black-boxes-in...
but the true primary source for this story is one of the United States federal government sources, for example
http://www.govtrack.us/congress/bills/112/s1813/text
with the text of the legislation.
Skimming the table of contents and looking through SEC. 31406. VEHICLE EVENT DATA RECORDERS I couldn't find it. I could only find requirements to record data, not transmit it.
Which doesn't mean "start hyperventilating", of course.
This repost of a repost of a repost of a reposted blog article is useless and needs downmodding.
I've noticed you seem to dedicate a lot of time to denouncing privacy and civil liberties issues on HN lately, but that statement is absurd.
If you feel like I spend a lot of time shouting down civil liberties issues, consider that maybe that has less to do with me --- a liberal ACLU supporter and donor --- and more to do with the tenor of civil liberties discussions on HN.
... I mean, if you care enough to consider why I'm on the other side of this issue. If you just want to yell at me, that's fine too. (Really, it's fine; I'm not being snide).
I also don't understand why you keep using "they can already do this" as an argument against those who are opposed to these issues. The fact that many people are unknowingly already equipped with EDRs is completely irrelevant. Or that companies already share breach data. Your logic is such that if X is already doing Y, being opposed to X is an invalid position. What?
I don't think you can call anything a tinfoil hat concern without understanding every individual's reasons for being opposed to something.
I don't want someone logging everything I do and everywhere I go, and not being in control of that data (yes I own a cell phone; see previous). Why? The same reason many people want the right to own a gun.[1] "Because fuck you, that's why." The fact that I have nothing to hide, to me, is all the more reason I deserve to be left alone.
[1] I personally don't actually believe society is better off with guns. I think the "protection" argument is equivalent to what tinfoil hats say. But it doesn't matter what I think. That's what it means to be a civil libertarian. I don't care what your voter registration says or who you donate to, if you don't understand this, you are not a civil libertarian.
"Hacker News comment threads: where people apply 'works on my machine' to social problems."
Here's the source:
http://thomas.loc.gov/cgi-bin/query/F?c112:3:./temp/~c112n8J...:
A much superior source is the one you linked - factual and free of sensationalistic spin.
I'm not even convinced the primary use case is helpful. Most people have cell phones nowadays, and sometimes systems like OnStar. Furthermore, who is going to handle the data (storage, responses, etc.)? How much money are we going to spend on this? Scary monitoring implications aside, this seems like a terrible idea.
Data recorded or transmitted by such a data recorder may not
be retrieved by a person other than the owner or lessee of
the motor vehicle in which the recorder is installed unless--
And proceeds to list a bunch of limitations that all sound fine to me. It's essentially saying that the police need a warrant to retrieve the data (duh), and that if you rent a car, the car's owner can't use the black box to monitor you without written consent.I see nothing in there to imply that these devices must transmit wirelessly. Much more likely, the device will transmit data the same way an airplane's black box does - via some sort of physical port that you have to plug into.
The need to attach physical hardware to get data out of it is made clear here: http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid...
And the conditions under which it's recording data, and the data being recorded, are described in the following two links: http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid... http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid...
Long story short, it's really not very exciting.
No other properly operated consumer item poses a risk of death as high as automobiles.
Here is CFR part 563 of title 49: http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid...
and you'll notice that all of the "data elements" captured are regarding velocity/acceleration, air bags and seat belts. There is nothing about the actual driver/occupants (except maybe how many occupants and in what seats) or location (gps tracking).
In fact there is a specific note in this CFR:
These data can help provide a better understanding of
the circumstances in which crashes and injuries occur.
NOTE: EDR data are recorded by your vehicle only if a
non-trivial crash situation occurs; no data are recorded
by the EDR under normal driving conditions and no
personal data (e.g., name, gender, age, and crash
location) are recorded. However, other parties, such as
law enforcement, could combine the EDR data with the
type of personally identifying data routinely acquired
during a crash investigation.
Here are further limitations as outlined in Section of 31406 of the linked bill: [EDIT: removed as `tptacek` already linked to this, see above]So, is there anything in here to get in a big fuss over? Maybe, but I don't see it.
Should we still keep a rational eye on it and make sure it stays this way? Absolutely.
On a related note, did anybody else cringe a bit when they noticed the original article came from infowars.com?
And yeah, the bill looks harmless to me. Just an EDR with no requirement for wireless transmission, and no identifying information. And when I saw the section on ownership I was pretty satisfied.
I could see this data being required by the insurance companies though.
They're actually a new initiative provided by the 1 insurance company, fitted to cars owned by young drivers. The data indicates your driving style in an attempt to bring car insurance down for more responsible young drivers. There's even an online dashboard to track your own info.
It's actually been well received especially since normal yearly insurance costs for teenage boys can be 3x the price of your first car!!!
http://www.co-operativeinsurance.co.uk/servlet/Satellite/128...
This is not a problem if you don't do stupid things.
Is going to take less than a megabyte to record an entire day(I use smartphones to record inertial movements), and everything is already on place on cars accelerometers, gyros, gps, and 3d compass(plus tacometers and maps).
They even can add microphones to the mixture(from the hands free phone system).
The problem in USA is the Patriot Act, every info the government takes about you should be clear, and it is not, they want to spy on you and they have no limits.
The problem is also the facebooks: "give us your inertial information and you will have a discount, or a free lollipop, or your friends will be able to know were you are driving".
This will happen, maybe it is a good thing. We need the wrong things that could happen with technology to happen fast so people develop antibodies as they do with every new tech.
That doesn't mean that it's clearly constitutional either, just that the basis for the court decision isn't applicable here.
I'm not very well versed with the political process in the US but why aren't these bill ever discussed (or voted on) before they are passed.
Doesn't the public get to vote on these important issues?
(By the way, I come from a country where I don't get to vote on individual bills. Just thought things were slightly better in America.)
Driving is a privilege, not a right. It's also a responsibility which more than a few-bad-apples don't take seriously. If you don't like it, don't drive.
so I suppose the question is, what's a reasonable time period?
This was introduced to protect the makers - there were lots of fears/claims that airbags had gone off and caused crashes. The car makers wanted to prove that you were braking hard or had hit some thing when they fired.
I suspect 'a reasonable time' means that the system needs an internal battery/static memory so that the data is available later after the engine is turned off or if the car battery is disconnected in the accident.
Obviously it wouldn't be coded fire only if you were braking ! But it might be at least logging all the data that is used for the seat belt pre-tensioning, ABS, stability control, traction control and all the other safety systems.
Seriously, what oversight is there over court orders? Wiretaps, getting private information from social networking sites, now car black boxes- who monitors and evaluates court orders to make sure the judges made the right decision?
Coming soon to a country near you.
/s