14 ms·

Researchers Could Have Uncovered Volkswagen’s Emissions Cheat If Not for DMCA

641 points by panarky 11y ago

userbinator 11y ago
I think that if emissions tests are distinctive enough from normal driving that they can be detected, they're not representative of realistic driving conditions. It's like microbenchmarking.
- throwaway2048 11y ago
  its highly likely the firmware is tuned specificly before the test events.
  - rconti 11y ago
    The other sources I've seen specifically said ANY time a vehicle was tested, this did not show up. Tests are typically done on a dynomometer. One easy solution would be trigger the clean mode when the front (driven) wheels are spinning but the rears are not.
  - hliyan 11y ago
    It's a lot worse than that: "Only then did VW admit it had designed and installed a defeat device" that purposely lowered emissions while a vehicle was being inspected, the agency said. During regular driving, emissions would return to as much as 40 times the level of pollutants allowed under clean air rules. http://www.reuters.com/article/2015/09/21/usa-volkswagen-idINL5N11R0TU20150921 http://www.reuters.com/article/2015/09/21/usa-volkswagen-idI...
mikeyouse 11y ago
I support the EFF with regular donations and definitely don't care for DMCA but this feels like quite a stretch.. Most estimates put the number of lines of code in a new car at near 100 million, it'd be trivial for a company with intent to obfuscate the 'emissions mode' criteria in a manner that would be completely invisible to researchers.
- vvpan 11y ago
  I wonder what sort of code it is that it's that many lines. Is it lookup tables, or real-deal code?
  - joezydeco 11y ago
    This article breaks it down a little better. http://www.redbend.com/data/upl/whitepapers/red_bend_update_car_ecu.pdf http://www.redbend.com/data/upl/whitepapers/red_bend_update_... The biggest chunk is obviously the radio/nav system.
  - deleted 11y ago
    [deleted]
  - jzwinck 11y ago
    It's probably mostly real code, though cars certainly do use plenty of lookup tables, starting from one of the earlier uses of computers in cars, the engine control unit. Modern cars have tons of things needing code: Power seats with memory Drive by wire gas pedal and cruise control Keyless entry Stereo system (auto volume by speed, etc.) GPS/Navigation (perhaps third-party) USB outlets for iPods, USB sticks for music Reverse-gear proximity sensors Emissions controls (oops!) OnStar-type services Cellular phone integration, e.g. mute on ring Lighting (DRL, smart cabin dimming) Traction control and ABS Variable suspension Dashboard diagnostics OBD-II Self-parking Windshield wipers (auto speed, rain sensors) Antitheft systems I'm sure I've left out plenty, but even something "simple" like keyless entry has a lot of features (integration with OnStar, alarm system, reprogramming support for new remotes, ...). How many LOC do you think that entails? I imagine at least 100K LOC (keeping in mind it's likely written in C or similar).
    - InclinedPlane 11y ago
      Most of those are not part of the ECU code.
      - jzwinck 11y ago
olympus 11y ago
On a slightly related note, here's a story from back when the EEPROMs for cars were on DIP chips and slightly more hackable: The old OBD I GM cars had a feature called "highway mode" which would lean out your fuel mixture when cruising to give you better gas mileage [1]. The downside was that your car had worse emissions. This feature was known to (or discovered by) the EPA, and they forced GM to turn off the feature. GM did so not by re-writing the fuel maps and cutting out all the highway mode code, they just created a disable bit that kept the ECU from ever entering highway mode-- the EPA was satisfied with that fix. People today with an EEPROM writer (can get a cheap one for under $100), a bit of soldering skill and access to the internet can remove the disable bit and give their car highway mode. [1] first thing resembling a source: http://www.thirdgen.org/forums/diy-prom/408964-highway-mode.html http://www.thirdgen.org/forums/diy-prom/408964-highway-mode....
- kuschku 11y ago
  That "highway mode" sounds like exactly what VW did here.
- rcthompson 11y ago
  How can you get better mileage but produce more emissions? I would assume that emissions are proportional to the amount of gas used. If you're using less gas, wouldn't you produce less emissions?
  - brownbat 11y ago
    I had the same question. It seems like Nitrogen Oxide output increases as the fuel combustion temperature increases. So when you're at a cruising speed that burns fuel more efficiently, it alters the balance of waste products. Somehow. I'll defer to anyone who claims any real knowledge about this at all, I'm just doing some motivated googling. http://capita.wustl.edu/CAPITA/CapitaReports/EmisTrends/soxnem.html http://capita.wustl.edu/CAPITA/CapitaReports/EmisTrends/soxn... http://www3.epa.gov/climatechange/ghgemissions/gases/n2o.html http://www3.epa.gov/climatechange/ghgemissions/gases/n2o.htm...
    - 11y ago
cmurf 11y ago
The primary code needs to be published, and the publication kept current (versioning). I don't know what kind of open source license is well suited to this that also limited reuse and use modification since those things can open a liability can of worms potentially. But the idea that code applying to the primary control functions of an automobile cannot be known (is not published and cannot legally be reverse engineered) is just a bad idea. Consumers are injured, the environment is damaged, and arguably even a bunch of shareholders and national pride are damaged because none of the participants had a say in VW's decision. Well, they get a say if the code is published. User apps and UI/UX code I'd say can probably be proprietary, closed, and not published.
- uxp 11y ago
  So you're basically arguing for an Android-esque project for cars, where Samsung or Ford basically fills the device with crapware and bloat over a simple base system? I'd be fine with that, as long as there were firmware signing mechanisms in place to prevent every 16 year old with a USB cable and a penchant for speed from modding the family car. Early Android ROMs were a lesson in how not to modify things; luckily there wasn't a lot of widespread damage done with the quantity of compiled binaries of unknown origin being distributed over typical filesharing sites like Mediafire.
- dsuth 11y ago
  > But the idea that code applying to the primary control functions of an automobile cannot be known (is not published and cannot legally be reverse engineered) is just a bad idea. Why is it a bad idea? Do we know the code base of airplanes? Critical infrastructure, like power and water plants? How about military software that controls missile guidance? The answer isn't to open source everything and let programmers sort it out. We have regulatory and safety boards specifically to counter the issues around public safety that software in critical applications causes. A huge amount of time and money is spent developing standards, and verifying and monitoring compliance with them. Obviously these processes are not always perfect. In this case, it will be interesting to see how far the corruption necessary to include a pollution-defeat spreads. But throwing out the whole process and just publishing code in its place is not a reasonable solution. More stringent black box testing by experts could have caught this issue far sooner.
sandworm101 11y ago
Examining, reporting, and eventually litigating the ins and outs of emissions control software is beside the point. This could have been, was, detected by measuring the junk coming out the tailpipe. The thing to do is to allow researchers to test cars in realworld situations and then actually listen to them when they report anomalies.
- bobbles 11y ago
  It seems crazy that the way to test emissions was the test what the car computer said... and not what actually came out of the car
  - azinman2 11y ago
    Especially since, as far as I'm aware, when my car gets smogged they measure the pipe itself. Was isn't this already in place (at least in CA)?
    - sandworm101 11y ago
      The testing was in place, but the software was designed to detect the testing process. A simple hack would be something like: (Hood open)or(doors open)+(Throttle>0)=I'm being tested. That would be enough to hide from standard testing procedures. Systems designed to defeat specific test are nothing new. The biggest example I can think of are the Buell (Harley) bikes that use an exhaust bypass designed to keep the bike quite at RPMs used during the CA test.
      - phire 11y ago
        The emissions test takes place on a dynamometer, which would result in a large number of weird things the car could test for. Such as open doors/hood while the wheels are spinning, no acceleration or a stationary GPS signal. The fact that cars have GPSs, make it next to impossible to design tests that can't be cheated, you would need a testing rig that could be mounted on a moving car, that didn't cause an increase of pressure on the exhaust system (cars could detect that) And then you would need to do testing on public roads, so the car didn't switch to a different mode when it's GPS showed it was on a known test track.
dzhiurgis 11y ago
More then few times I could smell some distinct smell that some diesel cars produce, which reminds me something. When I was a kid I've traded with someone on IRC to get some HNO3 with plans to make... dynamite. Few weeks later, the lid of mason jar rusted thru and my room had this distinct smell. I doubt that is NO as I would probably be dead now, but coupled with all the experiments involving nitrates I probably do hold more nitrates than usual.
dsuth 11y ago
I'm surprised that the EFF would suggest going to the level of having companies publish their code. A huge number of manhours goes into developing the software that runs a car, and a significant amount of IP is tied up in it. Forcing vendors to release software would allow competitors to steal it outright, and open up the entire industry to a massive set of lawsuits. I don't think that's a very beneficial outcome. As someone who works in a technical safety auditing role, I strongly doubt that NDAs would preclude the widespread release of this software. I have a hard enough time convincing vendors that the lifecycle documentation they are already mandated by law to provide, should be provided. This is just unrealistic.
- bad_user 11y ago
  It wouldn't be only a beneficial outcome, it would be the best and the only morally right outcome. Consider that before the advent of software, people actually owned the things they bought. And you could argue that it isn't fair to impose such standards on markets that haven't existed before software and you might be right, after all people have to eat, but when it comes to automobiles people have historically owned the car they paid for. And in practice what this meant is that they can get it inspected and repaired by third-parties should they want to do that, which means longer lifecycles and cheaper service, among other side-effects that come as a natural consequence of actually owning things, a freedom that is essential for the proper functioning of capitalism itself. But now with the advent of software in these computerized cars all of that is about to change. And lets place that in the context of the never ending copyright terms, with the excruciatingly low threshold for awarding patents, with the price of IP lawsuits going through the roof, along with the fact that software leads to natural monopolies. As that's the context we live in, a context in which innovation happens only because the giants whose shoulders we stand on haven't protected their "IP". And I get it, we are software developers, we've got to sell our labor, but nothing makes the stealing argument any less bullshit. And we could start from stating the obvious, which is that copyright or patent infringement is not stealing.
  - dsuth 11y ago
    Don't get me wrong, I'm the last person to defend the overuse of software patents. Where people are genuinely creating extremely complex functionality in software however, I think they deserve some protection for their outlay. On your point about historically owning vehicles, as a software developer you will understand that there is a very wide gap in competence between being able to tune a standard motor, and being able to inspect and modify software that controls a car safely. Currently this is protected so that only the vendor can change it, precisely because that's how we wrote the standards - vendors are responsible for their code, and responsible for the safety outcomes on the road. If we moved to an open model where anyone could modify the software in their car - what do you think would happen to the safety and reliability of that software? I don't think any of us could imagine that it would improve.
PinguTS 11y ago
To be honest, that is pure populism by the EFF. I am a supporter of EFF and against the DMCA. But that saying is BS. There are many different ECUs within a car (about 40 in a current Volkswagen Golf). Does EFF really thinks that someone would have found that issue, when everything is OpenSource? Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. We have seen such things in lots of OpenSource software, just reminding of the now legendary Debian bug in the random number generator or Heartbleed and such things. How long where those bugs present? To find this wrongdoing by VW you don't need access to the car. Put a measuring device to the pipe and drive around. The question: why did the engineers implemented a detection of the test environment? Because you need to. You just have to apply a little bit of thinking your self. Such a car is equipped with lots of assistants like traction control, like crash detection, and so on. In a test environment you have your car running on a dynamometer or alike. That means the car detects, that 2 wheels run at 30 mph while 2 wheels are standing still and there is no acceleration. The car now has to classify that situation. The car has to decide if the front wheels are just spinning in the mud and traction control must be applied, or is it a valid situation. So there are lots of those things you have to consider during development and which are valid use cases. Of course this should not be misused.
- scrollaway 11y ago
  > Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I would've been interested, and I don't even work in the field... Regardless, the EFF says "could", not "would". And they're right. This sort of code absolutely should have third party reviews. > The question: why did the engineers implemented a detection of the test environment? Yknow, maybe because they knew they didn't have to worry about people reviewing their code.
  - PinguTS 11y ago
    >> The question: why did the engineers implemented a detection of the test environment? > Yknow, maybe because they knew they didn't have to worry about people reviewing their code. You read the rest of the comment? You NEED to detect it to apply to correct algorithms for all those safety assistants. Otherwise you could decide to just cool down when a door is open, when the front wheels are spinning, while there is no acceleration, when the distance sensors detect obstacles. But that would make testing impossible.
shmerl 11y ago
It's time to axe DMCA-1201 completely.
cromwellian 11y ago
If the DMCA doesn't take care of it, there's always the right to be forgotten.
natch 11y ago
Dear Internet, can we have Lawrence Lessig as Librarian of Congress please?
- mlinksva 11y ago
  No but http://www.slate.com/blogs/future_tense/2015/09/10/brewster_kahle_creator_of_the_internet_archive_should_be_the_next_librarian.html http://www.slate.com/blogs/future_tense/2015/09/10/brewster_...
jlebrech 11y ago
don't they dyno at the same time as testing emissions, wouldn't that have shown up on the test that the car was in eco mode?
bart-is 11y ago
I'm far from suggesting that companies should publish their code for everyone to see, but one thing seems a little bit absurd. We require companies to have their financials audited by independent auditors, but we don't require any independent audits of their software which has potential to affect people's lives. Software will determine more and more aspects of our lives and we probably should shift our mindsets of what areas should be regulated or audited. There's lot of audit requirements in several areas which are intended to keep customers and the environment safe. If you want to manufacture food, you need to comply with food safety regulations and you will be subject to audits in this area. If you want to manufacture pharmaceuticals, there's long list of requirements and checks which are required. Even if you want to manufacture a simple electronic device with some wireless communication, you need to have it cleared by FCC. The list goes on. But nobody cares for your software. You can be as malicious or as incompetent as possible and you're allowed to sell products with software features or bugs which could take people's lives. Nobody will care until there's something wrong. The mindset here stayed in the 80s when software was considered spreadsheets and similar stuff and not that important for real life. We got our food, drugs, electronics and other safety regulations. In the age of software eating the world perhaps it is time to think about software audit regulations.
- cbsmith 11y ago
  "We require companies to have their financials audited by supposedly independent auditors" FTFY
- rogeryu 11y ago
  > I'm far from suggesting that companies should publish their code for everyone to see This would actually be a good punishment. If you screw up, you could be forced to open source your code. If VW is serious, they could do such a thing. I guess that Mercedes wants to keep its Formula 1 code closed, but for it's normal cars it is a different case. The big car companies share so many of their technologies and even complete cars, what's keeping them?
  - DINKDINK 11y ago
    >> I'm far from suggesting that companies should publish their code for everyone to see >This would actually be a good punishment No, it wouldn't. Want to sink you competitor? 1.) Pay a disgruntled competitor employee to deliberately sabotage part of their code base. 2.) Finger the company to the feds. 3.) Watch as competitor's IP is opened sourced (non consenting open sourced code) by feds as punishment.
doki_pen 11y ago
Does anyone know how the cheat worked? Did the computer detect it was under test mode and run worth less emissions?
lordnacho 11y ago
Perhaps one could take a page out of financial regulation, where banks need to calculate risk. According to this article in the Economist, the Fed runs certain stress tests without exposing the inner workings to the banks: http://www.economist.com/news/finance-and-economics/21665039-regulators-are-taking-firmer-stand-how-banks-gauge-risk-whose-model-it http://www.economist.com/news/finance-and-economics/21665039... If people are afraid of releasing the car's code, the agency doing the emission testing could make it a bit less obvious when the car is being tested. That would make it harder to cheat.
- throwaway7767 11y ago
  > If people are afraid of releasing the car's code, the agency doing the emission testing could make it a bit less obvious when the car is being tested. That would make it harder to cheat. I'd say requiring the release of all source code involved in or connected to control circuitry in the car (i.e. anything other than in-vehicle dash systems that are completely isolated from CAN, etc.) would be reasonable. The safety concerns outweigh any proprietary benefit to the companies involved. It would also create a lot of pressure for the manufacturers to actually isolate the non-critical value-add parts from the critical keep-the-car-driving parts, which would increase security.
- JimmaDaRustla 11y ago
  Exactly. I made some ignorant comments about the legitimacy of how much pollution is actually caused by these cars considering "tailpipe" emissions tests are a thing where the test is segregated from the car's computer system entirely, and we haven't heard much about these types of tests failing. The real question I have is, if the vehicles are actually producing less emissions during the test, how come they can't use the same method to produce less emissions during normal operation? If the "defeat device" had some adverse effects on the car's operation, which I imagine it does, I would also think that it would be apparent when running the test. "Sounds like this car is running on 2 cylinders at 75 RPM..." Edit: I'm just going to wait for the videos, someone will eventually detail what's going on.
EvanAnderson 11y ago
Source code for slot machine firmware is open for regulator scrutiny. Human lives aren't directly at stake, but apparently gambling rises to the level of importance that such scrutiny is accepted. How is is acceptable that automotive firmware, an application in which human lives are directly at stake, doesn't rise to that level of importance?
- mlinksva 11y ago
  Seems much more important, so should be open for independent researcher and general public scrutiny. The exemptions the EFF wants should absolutely be granted, but seem a very indirect way of enabling greater scrutiny of automotive and other life critical software.
- GuiA 11y ago
  Slot machine manufacturers don't have anything to hide, as there is nothing malicious about their software - it's programmed to mathematically make the players lose money most of the time, but everyone already knows that. Thus they have no incentive to fight against their firmware being open for regulator scrutiny. Automotive manufacturers, on the other hand, have very good incentives for their firmware not being open for regulator scrutiny, as the recent events have shown...
  - pc86 11y ago
    I mean, yes, but that has nothing to do with the comment to which you're replying and doesn't come close to answering the actual question posed.
    - GuiA 11y ago
      Huh, what? The commenter is asking why one industry is open to regulator scrutiny and the other isn't. My reply covers why lobbyists from one industry might have incentives for not being open to scrutiny, while lobbyists from the other industry might not. I'm not answering literally the question "why is it acceptable..." because that's not the real issue at play here.

641 points by panarky 11y ago

I think that if emissions tests are distinctive enough from normal driving that they can be detected, they're not representative of realistic driving conditions. It's like microbenchmarking.

throwaway2048 11y ago
its highly likely the firmware is tuned specificly before the test events.
- rconti 11y ago
  The other sources I've seen specifically said ANY time a vehicle was tested, this did not show up. Tests are typically done on a dynomometer. One easy solution would be trigger the clean mode when the front (driven) wheels are spinning but the rears are not.
- hliyan 11y ago
  It's a lot worse than that: "Only then did VW admit it had designed and installed a defeat device" that purposely lowered emissions while a vehicle was being inspected, the agency said. During regular driving, emissions would return to as much as 40 times the level of pollutants allowed under clean air rules. http://www.reuters.com/article/2015/09/21/usa-volkswagen-idINL5N11R0TU20150921 http://www.reuters.com/article/2015/09/21/usa-volkswagen-idI...

mikeyouse 11y ago

I support the EFF with regular donations and definitely don't care for DMCA but this feels like quite a stretch.. Most estimates put the number of lines of code in a new car at near 100 million, it'd be trivial for a company with intent to obfuscate the 'emissions mode' criteria in a manner that would be completely invisible to researchers.

vvpan 11y ago
I wonder what sort of code it is that it's that many lines. Is it lookup tables, or real-deal code?
- joezydeco 11y ago
  This article breaks it down a little better. http://www.redbend.com/data/upl/whitepapers/red_bend_update_car_ecu.pdf http://www.redbend.com/data/upl/whitepapers/red_bend_update_... The biggest chunk is obviously the radio/nav system.
- deleted 11y ago
  [deleted]
- jzwinck 11y ago
  It's probably mostly real code, though cars certainly do use plenty of lookup tables, starting from one of the earlier uses of computers in cars, the engine control unit. Modern cars have tons of things needing code: Power seats with memory Drive by wire gas pedal and cruise control Keyless entry Stereo system (auto volume by speed, etc.) GPS/Navigation (perhaps third-party) USB outlets for iPods, USB sticks for music Reverse-gear proximity sensors Emissions controls (oops!) OnStar-type services Cellular phone integration, e.g. mute on ring Lighting (DRL, smart cabin dimming) Traction control and ABS Variable suspension Dashboard diagnostics OBD-II Self-parking Windshield wipers (auto speed, rain sensors) Antitheft systems I'm sure I've left out plenty, but even something "simple" like keyless entry has a lot of features (integration with OnStar, alarm system, reprogramming support for new remotes, ...). How many LOC do you think that entails? I imagine at least 100K LOC (keeping in mind it's likely written in C or similar).
  - InclinedPlane 11y ago
    Most of those are not part of the ECU code.
    - jzwinck 11y ago

olympus 11y ago

On a slightly related note, here's a story from back when the EEPROMs for cars were on DIP chips and slightly more hackable: The old OBD I GM cars had a feature called "highway mode" which would lean out your fuel mixture when cruising to give you better gas mileage [1]. The downside was that your car had worse emissions. This feature was known to (or discovered by) the EPA, and they forced GM to turn off the feature. GM did so not by re-writing the fuel maps and cutting out all the highway mode code, they just created a disable bit that kept the ECU from ever entering highway mode-- the EPA was satisfied with that fix. People today with an EEPROM writer (can get a cheap one for under $100), a bit of soldering skill and access to the internet can remove the disable bit and give their car highway mode. [1] first thing resembling a source: http://www.thirdgen.org/forums/diy-prom/408964-highway-mode.html http://www.thirdgen.org/forums/diy-prom/408964-highway-mode....

kuschku 11y ago
That "highway mode" sounds like exactly what VW did here.
rcthompson 11y ago
How can you get better mileage but produce more emissions? I would assume that emissions are proportional to the amount of gas used. If you're using less gas, wouldn't you produce less emissions?
- brownbat 11y ago
  I had the same question. It seems like Nitrogen Oxide output increases as the fuel combustion temperature increases. So when you're at a cruising speed that burns fuel more efficiently, it alters the balance of waste products. Somehow. I'll defer to anyone who claims any real knowledge about this at all, I'm just doing some motivated googling. http://capita.wustl.edu/CAPITA/CapitaReports/EmisTrends/soxnem.html http://capita.wustl.edu/CAPITA/CapitaReports/EmisTrends/soxn... http://www3.epa.gov/climatechange/ghgemissions/gases/n2o.html http://www3.epa.gov/climatechange/ghgemissions/gases/n2o.htm...
  - 11y ago

cmurf 11y ago

The primary code needs to be published, and the publication kept current (versioning). I don't know what kind of open source license is well suited to this that also limited reuse and use modification since those things can open a liability can of worms potentially. But the idea that code applying to the primary control functions of an automobile cannot be known (is not published and cannot legally be reverse engineered) is just a bad idea. Consumers are injured, the environment is damaged, and arguably even a bunch of shareholders and national pride are damaged because none of the participants had a say in VW's decision. Well, they get a say if the code is published. User apps and UI/UX code I'd say can probably be proprietary, closed, and not published.

uxp 11y ago
So you're basically arguing for an Android-esque project for cars, where Samsung or Ford basically fills the device with crapware and bloat over a simple base system? I'd be fine with that, as long as there were firmware signing mechanisms in place to prevent every 16 year old with a USB cable and a penchant for speed from modding the family car. Early Android ROMs were a lesson in how not to modify things; luckily there wasn't a lot of widespread damage done with the quantity of compiled binaries of unknown origin being distributed over typical filesharing sites like Mediafire.
dsuth 11y ago
> But the idea that code applying to the primary control functions of an automobile cannot be known (is not published and cannot legally be reverse engineered) is just a bad idea. Why is it a bad idea? Do we know the code base of airplanes? Critical infrastructure, like power and water plants? How about military software that controls missile guidance? The answer isn't to open source everything and let programmers sort it out. We have regulatory and safety boards specifically to counter the issues around public safety that software in critical applications causes. A huge amount of time and money is spent developing standards, and verifying and monitoring compliance with them. Obviously these processes are not always perfect. In this case, it will be interesting to see how far the corruption necessary to include a pollution-defeat spreads. But throwing out the whole process and just publishing code in its place is not a reasonable solution. More stringent black box testing by experts could have caught this issue far sooner.

sandworm101 11y ago

Examining, reporting, and eventually litigating the ins and outs of emissions control software is beside the point. This could have been, was, detected by measuring the junk coming out the tailpipe. The thing to do is to allow researchers to test cars in realworld situations and then actually listen to them when they report anomalies.

bobbles 11y ago
It seems crazy that the way to test emissions was the test what the car computer said... and not what actually came out of the car
- azinman2 11y ago
  Especially since, as far as I'm aware, when my car gets smogged they measure the pipe itself. Was isn't this already in place (at least in CA)?
  - sandworm101 11y ago
    The testing was in place, but the software was designed to detect the testing process. A simple hack would be something like: (Hood open)or(doors open)+(Throttle>0)=I'm being tested. That would be enough to hide from standard testing procedures. Systems designed to defeat specific test are nothing new. The biggest example I can think of are the Buell (Harley) bikes that use an exhaust bypass designed to keep the bike quite at RPMs used during the CA test.
    - phire 11y ago
      The emissions test takes place on a dynamometer, which would result in a large number of weird things the car could test for. Such as open doors/hood while the wheels are spinning, no acceleration or a stationary GPS signal. The fact that cars have GPSs, make it next to impossible to design tests that can't be cheated, you would need a testing rig that could be mounted on a moving car, that didn't cause an increase of pressure on the exhaust system (cars could detect that) And then you would need to do testing on public roads, so the car didn't switch to a different mode when it's GPS showed it was on a known test track.

dzhiurgis 11y ago

More then few times I could smell some distinct smell that some diesel cars produce, which reminds me something. When I was a kid I've traded with someone on IRC to get some HNO3 with plans to make... dynamite. Few weeks later, the lid of mason jar rusted thru and my room had this distinct smell. I doubt that is NO as I would probably be dead now, but coupled with all the experiments involving nitrates I probably do hold more nitrates than usual.

dsuth 11y ago

I'm surprised that the EFF would suggest going to the level of having companies publish their code. A huge number of manhours goes into developing the software that runs a car, and a significant amount of IP is tied up in it. Forcing vendors to release software would allow competitors to steal it outright, and open up the entire industry to a massive set of lawsuits. I don't think that's a very beneficial outcome. As someone who works in a technical safety auditing role, I strongly doubt that NDAs would preclude the widespread release of this software. I have a hard enough time convincing vendors that the lifecycle documentation they are already mandated by law to provide, should be provided. This is just unrealistic.

bad_user 11y ago
It wouldn't be only a beneficial outcome, it would be the best and the only morally right outcome. Consider that before the advent of software, people actually owned the things they bought. And you could argue that it isn't fair to impose such standards on markets that haven't existed before software and you might be right, after all people have to eat, but when it comes to automobiles people have historically owned the car they paid for. And in practice what this meant is that they can get it inspected and repaired by third-parties should they want to do that, which means longer lifecycles and cheaper service, among other side-effects that come as a natural consequence of actually owning things, a freedom that is essential for the proper functioning of capitalism itself. But now with the advent of software in these computerized cars all of that is about to change. And lets place that in the context of the never ending copyright terms, with the excruciatingly low threshold for awarding patents, with the price of IP lawsuits going through the roof, along with the fact that software leads to natural monopolies. As that's the context we live in, a context in which innovation happens only because the giants whose shoulders we stand on haven't protected their "IP". And I get it, we are software developers, we've got to sell our labor, but nothing makes the stealing argument any less bullshit. And we could start from stating the obvious, which is that copyright or patent infringement is not stealing.
- dsuth 11y ago
  Don't get me wrong, I'm the last person to defend the overuse of software patents. Where people are genuinely creating extremely complex functionality in software however, I think they deserve some protection for their outlay. On your point about historically owning vehicles, as a software developer you will understand that there is a very wide gap in competence between being able to tune a standard motor, and being able to inspect and modify software that controls a car safely. Currently this is protected so that only the vendor can change it, precisely because that's how we wrote the standards - vendors are responsible for their code, and responsible for the safety outcomes on the road. If we moved to an open model where anyone could modify the software in their car - what do you think would happen to the safety and reliability of that software? I don't think any of us could imagine that it would improve.

PinguTS 11y ago

To be honest, that is pure populism by the EFF. I am a supporter of EFF and against the DMCA. But that saying is BS. There are many different ECUs within a car (about 40 in a current Volkswagen Golf). Does EFF really thinks that someone would have found that issue, when everything is OpenSource? Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. We have seen such things in lots of OpenSource software, just reminding of the now legendary Debian bug in the random number generator or Heartbleed and such things. How long where those bugs present? To find this wrongdoing by VW you don't need access to the car. Put a measuring device to the pipe and drive around. The question: why did the engineers implemented a detection of the test environment? Because you need to. You just have to apply a little bit of thinking your self. Such a car is equipped with lots of assistants like traction control, like crash detection, and so on. In a test environment you have your car running on a dynamometer or alike. That means the car detects, that 2 wheels run at 30 mph while 2 wheels are standing still and there is no acceleration. The car now has to classify that situation. The car has to decide if the front wheels are just spinning in the mud and traction control must be applied, or is it a valid situation. So there are lots of those things you have to consider during development and which are valid use cases. Of course this should not be misused.

scrollaway 11y ago
> Nobody would have examined such things, because nobody would have been interested in examining it, if it would be OpenSource. I would've been interested, and I don't even work in the field... Regardless, the EFF says "could", not "would". And they're right. This sort of code absolutely should have third party reviews. > The question: why did the engineers implemented a detection of the test environment? Yknow, maybe because they knew they didn't have to worry about people reviewing their code.
- PinguTS 11y ago
  >> The question: why did the engineers implemented a detection of the test environment? > Yknow, maybe because they knew they didn't have to worry about people reviewing their code. You read the rest of the comment? You NEED to detect it to apply to correct algorithms for all those safety assistants. Otherwise you could decide to just cool down when a door is open, when the front wheels are spinning, while there is no acceleration, when the distance sensors detect obstacles. But that would make testing impossible.

shmerl 11y ago

It's time to axe DMCA-1201 completely.

cromwellian 11y ago

If the DMCA doesn't take care of it, there's always the right to be forgotten.

natch 11y ago

Dear Internet, can we have Lawrence Lessig as Librarian of Congress please?

mlinksva 11y ago
No but http://www.slate.com/blogs/future_tense/2015/09/10/brewster_kahle_creator_of_the_internet_archive_should_be_the_next_librarian.html http://www.slate.com/blogs/future_tense/2015/09/10/brewster_...

jlebrech 11y ago

don't they dyno at the same time as testing emissions, wouldn't that have shown up on the test that the car was in eco mode?

bart-is 11y ago

I'm far from suggesting that companies should publish their code for everyone to see, but one thing seems a little bit absurd. We require companies to have their financials audited by independent auditors, but we don't require any independent audits of their software which has potential to affect people's lives. Software will determine more and more aspects of our lives and we probably should shift our mindsets of what areas should be regulated or audited. There's lot of audit requirements in several areas which are intended to keep customers and the environment safe. If you want to manufacture food, you need to comply with food safety regulations and you will be subject to audits in this area. If you want to manufacture pharmaceuticals, there's long list of requirements and checks which are required. Even if you want to manufacture a simple electronic device with some wireless communication, you need to have it cleared by FCC. The list goes on. But nobody cares for your software. You can be as malicious or as incompetent as possible and you're allowed to sell products with software features or bugs which could take people's lives. Nobody will care until there's something wrong. The mindset here stayed in the 80s when software was considered spreadsheets and similar stuff and not that important for real life. We got our food, drugs, electronics and other safety regulations. In the age of software eating the world perhaps it is time to think about software audit regulations.

cbsmith 11y ago
"We require companies to have their financials audited by supposedly independent auditors" FTFY
rogeryu 11y ago
> I'm far from suggesting that companies should publish their code for everyone to see This would actually be a good punishment. If you screw up, you could be forced to open source your code. If VW is serious, they could do such a thing. I guess that Mercedes wants to keep its Formula 1 code closed, but for it's normal cars it is a different case. The big car companies share so many of their technologies and even complete cars, what's keeping them?
- DINKDINK 11y ago
  >> I'm far from suggesting that companies should publish their code for everyone to see >This would actually be a good punishment No, it wouldn't. Want to sink you competitor? 1.) Pay a disgruntled competitor employee to deliberately sabotage part of their code base. 2.) Finger the company to the feds. 3.) Watch as competitor's IP is opened sourced (non consenting open sourced code) by feds as punishment.

doki_pen 11y ago

Does anyone know how the cheat worked? Did the computer detect it was under test mode and run worth less emissions?

lordnacho 11y ago

Perhaps one could take a page out of financial regulation, where banks need to calculate risk. According to this article in the Economist, the Fed runs certain stress tests without exposing the inner workings to the banks: http://www.economist.com/news/finance-and-economics/21665039-regulators-are-taking-firmer-stand-how-banks-gauge-risk-whose-model-it http://www.economist.com/news/finance-and-economics/21665039... If people are afraid of releasing the car's code, the agency doing the emission testing could make it a bit less obvious when the car is being tested. That would make it harder to cheat.

throwaway7767 11y ago
> If people are afraid of releasing the car's code, the agency doing the emission testing could make it a bit less obvious when the car is being tested. That would make it harder to cheat. I'd say requiring the release of all source code involved in or connected to control circuitry in the car (i.e. anything other than in-vehicle dash systems that are completely isolated from CAN, etc.) would be reasonable. The safety concerns outweigh any proprietary benefit to the companies involved. It would also create a lot of pressure for the manufacturers to actually isolate the non-critical value-add parts from the critical keep-the-car-driving parts, which would increase security.
JimmaDaRustla 11y ago
Exactly. I made some ignorant comments about the legitimacy of how much pollution is actually caused by these cars considering "tailpipe" emissions tests are a thing where the test is segregated from the car's computer system entirely, and we haven't heard much about these types of tests failing. The real question I have is, if the vehicles are actually producing less emissions during the test, how come they can't use the same method to produce less emissions during normal operation? If the "defeat device" had some adverse effects on the car's operation, which I imagine it does, I would also think that it would be apparent when running the test. "Sounds like this car is running on 2 cylinders at 75 RPM..." Edit: I'm just going to wait for the videos, someone will eventually detail what's going on.

EvanAnderson 11y ago

Source code for slot machine firmware is open for regulator scrutiny. Human lives aren't directly at stake, but apparently gambling rises to the level of importance that such scrutiny is accepted. How is is acceptable that automotive firmware, an application in which human lives are directly at stake, doesn't rise to that level of importance?

mlinksva 11y ago
Seems much more important, so should be open for independent researcher and general public scrutiny. The exemptions the EFF wants should absolutely be granted, but seem a very indirect way of enabling greater scrutiny of automotive and other life critical software.
GuiA 11y ago
Slot machine manufacturers don't have anything to hide, as there is nothing malicious about their software - it's programmed to mathematically make the players lose money most of the time, but everyone already knows that. Thus they have no incentive to fight against their firmware being open for regulator scrutiny. Automotive manufacturers, on the other hand, have very good incentives for their firmware not being open for regulator scrutiny, as the recent events have shown...
- pc86 11y ago
  I mean, yes, but that has nothing to do with the comment to which you're replying and doesn't come close to answering the actual question posed.
  - GuiA 11y ago
    Huh, what? The commenter is asking why one industry is open to regulator scrutiny and the other isn't. My reply covers why lobbyists from one industry might have incentives for not being open to scrutiny, while lobbyists from the other industry might not. I'm not answering literally the question "why is it acceptable..." because that's not the real issue at play here.