Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

Infowars. Right. Also:

    (b) Limitations on Information Retrieval-
    
    (1) OWNERSHIP OF DATA- Any data in an event data recorder required
    under part 563 of title 49, Code of Federal Regulations, regardless of
    when the passenger motor vehicle in which it is installed was
    manufactured, is the property of the owner, or in the case of a leased
    vehicle, the lessee of the passenger motor vehicle in which the data
    recorder is installed.
    
    (2) PRIVACY- Data recorded or transmitted by such a data recorder may
    not be retrieved by a person other than the owner or lessee of the
    motor vehicle in which the recorder is installed unless--
    
    (A) a court authorizes retrieval of the information in furtherance of
    a legal proceeding;
    
    (B) the owner or lessee consents to the retrieval of the information
    for any purpose, including the purpose of diagnosing, servicing, or
    repairing the motor vehicle;
    
    (C) the information is retrieved pursuant to an investigation or
    inspection authorized under section 1131(a) or 30166 of title 49,
    United States Code, and the personally identifiable information of the
    owner, lessee, or driver of the vehicle and the vehicle identification
    number is not disclosed in connection with the retrieved information;
    or
    
    (D) the information is retrieved for the purpose of determining the
    need for, or facilitating, emergency medical response in response to a
    motor vehicle crash.

You're wondering, "section 1131(a) or 30166 of title 49"? That's the NTSB. Highway safety investigations.

For perspective: had this standard not been pushed federally, the private sector could probably do far worse; your (mandated, and reasonably so!) car insurance influences all sorts of standards on the vehicles we drive.

Honda Civic 2015 EULA:

23.1.23.44 (Page 198 of 301) "Your use of this vehicle grants us your irrevocable and permanent consent to download, transmit, or otherwise obtain the information contained in the onboard data recorder, and to share that data with third parties, including but not limited to law enforcement (without a court order), and marketing companies."

Sounds like a reason not to buy a 2015 Honda.

Note that Honda (and most other manufacturers) were inevitably going to put event data recorders in cars anyways. They are too cheap and they make too much sense not to have.

So without the federal rules, what you'd have is market full of cars with event data recorders and no rules regarding data ownership or requirements to disclose (this bill requires full disclosure about the devices and their purpose).

But BGR doesn't want to tell you that, because their purpose here isn't to inform, it's to generate rageviews.

>Sounds like a reason not to buy a 2015 Honda.

Ah yes, the "free market" in action. That has worked so well for us in protecting our privacy, as evidenced by the plethora of commercial software with EULAs that respects the user's rights.

Or are you saying Richard Stallman is going to build us a car next?

Here's how it works:

1. Government is constitutionally forbidden from collecting this information.

2. Government observes that private corporations can collect this information.

3. Government grants private corporations immunity from prosecution and civil liability if it collects this information and hands it to the government. Threatens prosecution and civil liability if corporations fails to collect information and "something bad happens".

4. US Supreme Court pretends this is acceptable by ignoring "intent" and "consequences" and then goes on to uphold "intent" and "consequences" in every other case before it.

Yeah, if you had a car you might think about driving it across a state line and buy gas in another state, therefore it's interstate commerce or something, and thus the government can do whatever it pleases.

which might be true except for

> (2) PRIVACY- Data recorded or transmitted by such a data recorder may not be retrieved by a person other than the owner or lessee of the motor vehicle in which the recorder is installed

also, you say

> Ah yes, the "free market" in action. That has worked so well for us in protecting our privacy, as evidenced by the plethora of commercial software with EULAs that respects the user's rights.

this bill is exactly the opposite of free market. it says everyone has to put recorders and cars and then explicitly forbids certain uses of them.

It doesn't explicitly forbid use of them. Honda's EULA is lawful and binding under the new law. But the case could be made that without the new law, Honda wouldn't need a EULA (although having it probably cuts down on their legal bills).

Obviously, though: Honda's EULA is lawful and binding without the bill. This bill can only improve matters at this point. You can be irritated that it doesn't improve them enough, but that's not the case BGR is making.

their purpose here isn't to inform, it's to generate rageviews

"Rageview" may be my new favorite word. Thank you for expanding my vocabulary.

WOW. That's a deal-breaker.

It would be interesting to get the whole way through the new car negotiating process, then strike this line right before signing. What would the reaction be? How badly does the dealership want to sell that car?

Yes, this might cost a Honda dealership as many as 1 sale every 5 years.

I didn't say that it would cost x sales in y time, or even that it would harm sales at all. My point is that it would be interesting to see the interaction between a car manufacturer's EULA, and a dealership's retail staff. I mean, do car salespeople even understand what a EULA is?

It's not like selling Windows 7 in Best Buy. The cashier at Best Buy does not care whether I hate the EULA or buy Windows. The car salesperson probably cares very much about whether I buy the car, and they probably don't care much about some random EULA term.

Granted: a bit off-topic perhaps. I would hope that such blanket permissions terms on sales contracts would be overridden by the protections written into the law. For instance I don't think health providers can undercut HIPAA protections no matter what their contractual terms say.

pretty simple - they (the dealership) do not have the right to modify a EULA - it would be like Best Buy accepting a EULA change for a MS software product.

You cite this like it proves that the headline isn't worrying.

The headline was intended to worry you. It's bait. Don't be a sucker. BGR is selling you to advertisers by getting you riled up about nonsense.

I'm not saying it's not great we're talking about the implications of event data recorders. Upthread, someone noticed Honda selling you out to marketing companies. That's good to know. It's great that we're talking about this stuff.

But that BGR story is horseshit, and you should hold it against them in the future. It is a bad thing when businesses spin up bullshit stories to profit off pointless outrage.

Which bit is bullshit? The bit I'm concerned about is data recorders in cars. Once cars start recording all that data, it's game over, as far as I'm concerned.

Virtually every American car already includes EDRs. Over 40 million cars are on the streets with them now. EDRs are cheap and incredibly useful in accident investigations. They were for obvious reasons only going to get cheaper and cheaper until it became economically irrational not to include them. They are an inevitability. All this bill does is codify the fact that you own the data on them, and that your data can't be taken without consent or court order.

Yes, but, this bill will also initiate the requirement of EDRs in all vehicles. I don't believe that is anything to go crazy about, but it is significant.

It's a sensible requirement. It seems like a reasonable clause in the social contract that if you're going to zoom around at 50-80MPH in a 4000 pound explosive metal box, we should be able to reconstruct as much as possible when that box collides with another box, or a building, or a bunch of people.

If this law required the boxes to be installed surreptitiously (like they are now), or stipulated that the data on the boxes belonged to the government, or stipulated that they RF backhaul the data back to some central government computer, that would indeed be cause for alarm.

But this bill does the exact opposite of that.

I keep missing out here somehow. the Senate bill includes law that says you can't exploit it. And yes the FBI will no doubt try to use this to 'fix' the issue of having to get warrants for gps tracking, which folks will watch out for, but the 'good' parts of an EDR are that you can find out just what the heck happened post 'event.' As a consumer you will be a lot happier if you know that your 'to spec' inflated tire just blew out and rolled you over causing a couple of million in damage isn't going to be your fault.

So there are benefits here, and the public is more educated about the risks. Another benefit of the Senate legislation is that it applies to all EDRs in cars, so folks who put EDRs into your car today and do sell information to third parties (I'm looking at you OnStar) will also be bound by this.

So a more reasonable story might have been:

EDRs are in a lot of vehicles now, they represent both a privacy threat and a potential benefit. There are no explicit rules around what folks can do with them. Your government is 'fixing' that by making explicit what can and can not be done. Generally that would be an encouraging sign, and participating early in the process will help ensure its done in the best interest of the consumer rather than the installer.

Agreed.

Regarding your last sentence though: a likely trend may arise where all EULAs for modern cars include giving consent to the manufacturer to do what they please with the information from the EDR.

This would bypass the discussed bill because the bill allows you to give such consent. I think most people wouldn't be in an uproar about this. Thereby making this bill rather irrelevant; at least tooth-less against protecting the data.

Like CISPA, then, the bill would be a no-op; at worst, a missed opportunity to add more privacy to the status quo.

Unlike CISPA, however, it means assholes who drive 70MPH down residential side streets in Benzes will be accountable when they cause accidents (Benzes don't have EDRs now). In other words: unlike CISPA, it actually does what it sets out to do.

That's enough of a win for me.

It's for the CHILDREN!!! Yes! that's exactly the kind of bone-headed thinking that's taking us down this path now.

If you own the data, are you allowed to destroy the data / turn off the EDR at any time?

You can't turn off the EDR. Deleting the data is a good question, but I expect the rulemaking that occurs after this passes will define compliant EDRs as devices with which the data cannot be tampered with or removed.

Probably not, since the point is to aid in accident investigation. Wouldn't want to give people the option to scrub incriminating evidence.

I wonder how much data these devices can store...I doubt they're putting a 100GB HD in every car to create a full historical record. It seems to me that all you would need for accident investigations is a few hours prior.

Reply on news.ycombinator.com