5 ms·

MA voter who's genuinely torn here. The thing that bugs me out about this law is that, AFAICT, this data is _already_ required to be available to any 3rd party

MA voter who's genuinely torn here. The thing that bugs me out about this law is that, AFAICT, this data is _already_ required to be available to any 3rd party manufacturer through a physical "non-proprietary interface" (so far, an OBD-II port) after a similar ballot initiative from 2013 [0]. This law essentially just makes the data available wirelessly. I care about security holes and I care about consent. Having a physical interface makes it easy to provide data with consent to repair shops who need while trivially making sure no third party manufacturer or insurance company is leaked a massive database of everyone's driving data. I really don't see how the "wireless" addition gives me more of a right to repair, but I clearly see how it forces manufacturers to significantly increase their surface area of possible data leaks. I'm all for Ben Franklin's liberty/safety argument, but with the 2013 law already in place, I honestly don't see the upside of the 2020 law. [0] https://malegislature.gov/Laws/SessionLaws/Acts/2013/Chapter165#:~:text=All%20content%20in%20any%20such,diagnostic%20and%20repair%20information%20system https://malegislature.gov/Laws/SessionLaws/Acts/2013/Chapter....

mkhcodes 6y ago
I'm in the same boat. I don't understand the argument that manufacturers are using telematics as a loophole, since it seems that the 2013 law specifically says that while many uses of telematics are not covered by the law, those that are "necessary to diagnose and repair a customer's vehicle" ARE still covered. > With the exception of telematics diagnostic and repair information that is provided to dealers, necessary to diagnose and repair a customer’s vehicle and not otherwise available to an independent repair facility [...] nothing in this chapter shall apply to telematics services [...]. So, are manufacturers doing things like including telematics that they claim "aren't necessary" but in reality are pretty important? If so, then independent repair shops are at a disadvantage, but the solution should be to force those signals to be available through the physical port. Or is it a matter of independent repair shops not being able to compete with the dealerships who can get telematics to do things like email you when it is detected that your oil is low?
- bzbarsky 6y ago
  As far as I can tell, the 2013 law doesn't actually define "telematics" or "telematics data". This intiative does define the latter to be data that the car collects and phones home, and which the car itself may not store at all (but the "remote receiving point", as the law calls it, does store). It seems to me that you can't reasonably require access via the physical port on the car to data that is not actually present in the car's systems. Or am I missing something?
Shivetya 6y ago
If they are transmitting it then it should be available to the vehicle's owner otherwise the law should state that they cannot transmit it. As in, if they want the data it can only be retrieved while in service and physically connected with a copy made available to the vehicle owner
CivBase 6y ago
I was also extremely confused by the smartphone app requirement. I don't imagine most car guys want to fumble around with their personal, expensive, fragile smartphone while doing automotive work. Modern vehicles generally have very advanced media consoles installed in the dash. Why can't they just display the information there? Or just add a standardized port under the hood with a publicly documented interface that mechanics could plug a device into?
- bzbarsky 6y ago
  I'm not a fan of the smartphone app requirement (as opposed to, say, a web app requirement), not least because it presupposes ownership of a smartphone. But I _think_ the intent is for "normal people" to be able to know at least as much about their own car and its behavior as the manufacturer does, and more importantly to know what it is their manufacturer knows. Importantly, this is all about data that got shipped off wirelessly to the manufacturer and does not reside in the car itself anymore. The media console approach would require the existence of such a console and for the media console to connect to "the cloud" to retrieve the data. Possible, presumably, since the car is connecting somehow to ship the data out to start with, but I'm really not sure what the tradeoffs are there. The standardized port idea unfortunately suffers from that last problem too: it relies on the car itself to make a connection to "the cloud"; depending on what's going on with the car that may or may not be possible, I'd think.
mindslight 6y ago
I see where you're coming from, and this proposed law doesn't seem super useful in isolation. But consider: 1. Publishing the same data over OBD-2 ends up being an afterthought. Without even looking at the specifics, I guarantee that there is data transmitted through telemetry that is not output through OBD-2. That's just how embedded development works - focus on making the main feature work, then forget about the rest. It seems quite hard to apply the law to the details of a technical system ("Sorry, when developing we didn't consider that type of data necessary for repairing the car, even though we are using it to diagnose. Anyway we'll fix it in the model year after next"). Whereas it's straightforward to say that no matter how many different interfaces automakers develop, independent auto repair has to be able to access all of them. 2. If we're concerned with privacy (and we should be), then we need an orthogonal privacy law that prohibits automakers from backhauling this information without consent, and selling this information without consent (eg to insurance companies). Letting them unilaterally collect and only make it accessible to their dealers, practically guarantees a terrible security implementation - something like one master login for each "trusted" dealer, that can access any car's data by VIN. Mandating access for third parties will actually result in the attack surface being properly designed and audited. 3. Once you're taking the privacy hit, then there is a stored history that won't be available over OBD-2. Imagine going to a repair shop and they tell you to borrow a dongle and drive around for two weeks, where a dealer can help you immediately. This ties into data ownership, in that you should be able to retrieve your own records. 4. Imagine a hypothetical service that keeps tabs on your car's metrics and alerts you to developing conditions. With mandated access, this can be done as a simple web service. Without that, you'll need a separate dongle, probably specific to your car if things advance beyond OBD-2. I'd personally rather have a dongle and a local service that I control (coupled with a privacy law or pulling the cell modem), but unfortunately that's not how the consumer market works.
- unholiness 6y ago
  These are definitely valid points. Unfortunately your last example (3rd party web services easily discovering when I need an oil change, or what days I've been driving aggressively) is the kind of hypothetical I would want laws actively preventing. Arguably, it's not this law's job to introduce such a protection! But best I can tell, no other law covers it in MA. It is perfectly legal for 3rd parties to sell this and other data without my explicit consent or even an opportunity to opt out (I think only CA has such an opt-out [0]). Granted, manufacturers already have and can sell this data with no recourse. But at least manufacturers have national brands which could be hurt by selling or leaking massive amounts of data about their customers. Perhaps some brands could even make privacy a selling point. It seems like this law erodes that thin shell of protection. [0] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180AB375 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

mkhcodes 6y ago

I'm in the same boat. I don't understand the argument that manufacturers are using telematics as a loophole, since it seems that the 2013 law specifically says that while many uses of telematics are not covered by the law, those that are "necessary to diagnose and repair a customer's vehicle" ARE still covered. > With the exception of telematics diagnostic and repair information that is provided to dealers, necessary to diagnose and repair a customer’s vehicle and not otherwise available to an independent repair facility [...] nothing in this chapter shall apply to telematics services [...]. So, are manufacturers doing things like including telematics that they claim "aren't necessary" but in reality are pretty important? If so, then independent repair shops are at a disadvantage, but the solution should be to force those signals to be available through the physical port. Or is it a matter of independent repair shops not being able to compete with the dealerships who can get telematics to do things like email you when it is detected that your oil is low?

bzbarsky 6y ago
As far as I can tell, the 2013 law doesn't actually define "telematics" or "telematics data". This intiative does define the latter to be data that the car collects and phones home, and which the car itself may not store at all (but the "remote receiving point", as the law calls it, does store). It seems to me that you can't reasonably require access via the physical port on the car to data that is not actually present in the car's systems. Or am I missing something?

Shivetya 6y ago

If they are transmitting it then it should be available to the vehicle's owner otherwise the law should state that they cannot transmit it. As in, if they want the data it can only be retrieved while in service and physically connected with a copy made available to the vehicle owner

CivBase 6y ago

I was also extremely confused by the smartphone app requirement. I don't imagine most car guys want to fumble around with their personal, expensive, fragile smartphone while doing automotive work. Modern vehicles generally have very advanced media consoles installed in the dash. Why can't they just display the information there? Or just add a standardized port under the hood with a publicly documented interface that mechanics could plug a device into?

bzbarsky 6y ago
I'm not a fan of the smartphone app requirement (as opposed to, say, a web app requirement), not least because it presupposes ownership of a smartphone. But I _think_ the intent is for "normal people" to be able to know at least as much about their own car and its behavior as the manufacturer does, and more importantly to know what it is their manufacturer knows. Importantly, this is all about data that got shipped off wirelessly to the manufacturer and does not reside in the car itself anymore. The media console approach would require the existence of such a console and for the media console to connect to "the cloud" to retrieve the data. Possible, presumably, since the car is connecting somehow to ship the data out to start with, but I'm really not sure what the tradeoffs are there. The standardized port idea unfortunately suffers from that last problem too: it relies on the car itself to make a connection to "the cloud"; depending on what's going on with the car that may or may not be possible, I'd think.

mindslight 6y ago

I see where you're coming from, and this proposed law doesn't seem super useful in isolation. But consider: 1. Publishing the same data over OBD-2 ends up being an afterthought. Without even looking at the specifics, I guarantee that there is data transmitted through telemetry that is not output through OBD-2. That's just how embedded development works - focus on making the main feature work, then forget about the rest. It seems quite hard to apply the law to the details of a technical system ("Sorry, when developing we didn't consider that type of data necessary for repairing the car, even though we are using it to diagnose. Anyway we'll fix it in the model year after next"). Whereas it's straightforward to say that no matter how many different interfaces automakers develop, independent auto repair has to be able to access all of them. 2. If we're concerned with privacy (and we should be), then we need an orthogonal privacy law that prohibits automakers from backhauling this information without consent, and selling this information without consent (eg to insurance companies). Letting them unilaterally collect and only make it accessible to their dealers, practically guarantees a terrible security implementation - something like one master login for each "trusted" dealer, that can access any car's data by VIN. Mandating access for third parties will actually result in the attack surface being properly designed and audited. 3. Once you're taking the privacy hit, then there is a stored history that won't be available over OBD-2. Imagine going to a repair shop and they tell you to borrow a dongle and drive around for two weeks, where a dealer can help you immediately. This ties into data ownership, in that you should be able to retrieve your own records. 4. Imagine a hypothetical service that keeps tabs on your car's metrics and alerts you to developing conditions. With mandated access, this can be done as a simple web service. Without that, you'll need a separate dongle, probably specific to your car if things advance beyond OBD-2. I'd personally rather have a dongle and a local service that I control (coupled with a privacy law or pulling the cell modem), but unfortunately that's not how the consumer market works.

unholiness 6y ago
These are definitely valid points. Unfortunately your last example (3rd party web services easily discovering when I need an oil change, or what days I've been driving aggressively) is the kind of hypothetical I would want laws actively preventing. Arguably, it's not this law's job to introduce such a protection! But best I can tell, no other law covers it in MA. It is perfectly legal for 3rd parties to sell this and other data without my explicit consent or even an opportunity to opt out (I think only CA has such an opt-out [0]). Granted, manufacturers already have and can sell this data with no recourse. But at least manufacturers have national brands which could be hurt by selling or leaking massive amounts of data about their customers. Perhaps some brands could even make privacy a selling point. It seems like this law erodes that thin shell of protection. [0] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180AB375 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...