11 ms·
NHTSA tells automakers not to comply with Massachusetts right-to-repair law
- wackycat 3y agoThis is a predictable consequence of federal regulators being beholden to industry.
- CoastalCoder 3y agoHas that been a problem for NHTSA? I honestly don't know.
- kbos87 3y agoWatch the episode of PBS’s Frontline that dropped last week about the danger of trucks on US roadways because of the lack of underride prevention devices. They interview several former officials at NHTSA who talk about the agency being under a chokehold of regulatory capture.
- drewda 3y agoAlso written up as a story by ProPublica: https://www.propublica.org/article/underride-crashes-nhtsa-dot-iihs-safety-cars-trucks https://www.propublica.org/article/underride-crashes-nhtsa-d... And here are the HN comments: https://news.ycombinator.com/item?id=36332086 https://news.ycombinator.com/item?id=36332086
- CoastalCoder 3y agoThanks for the reference. I knew about the under-ride story, but I wasn't aware of the regulatory-capture part.
- robgibbons 3y agoHere's the episode: https://www.youtube.com/watch?v=1LyaWzOesXk https://www.youtube.com/watch?v=1LyaWzOesXk
- 1MachineElf 3y agoOdd. I used to work there, and the subject matter here isn't really their wheelhouse. That would be Federal Motor Carrier Safety Administrative (FMCSA). They are the ones PBS should have interviewed.
- sp332 3y agoIt's a little weird right now, because Biden issued an executive order in 2021 backing existing right-to-repair rules. And last year he doubled down, making public statements in favor of enforcement. https://www.extremetech.com/extreme/330906-biden-formally-backs-right-to-repair-movement https://www.extremetech.com/extreme/330906-biden-formally-ba... The NHTSA is part of the administration, but it's also unlikely they totally went rogue here. Not sure what's up.
- westmeal 3y agoIt took everything I had not to roll my eyes.
- dangus 3y ago> They warned complying with the Data Access Law would require an automaker "to remove essential cybersecurity protections from their vehicles." The group declined to comment Tuesday on NHTSA's letter. > "Vehicle manufacturers appear to recognize that vehicles with the open remote access telematics required by the Data Access Law would contain a safety defect," NHTSA said in its letter to General Motors, Tesla, Ford, Toyota, Rivian, Volkswagen and others. I guess they’re just taking it at the manufacturers’ word that there’s just no way to implement this feature securely. ”We've tried nothing and we are all out of ideas!”
- rolph 3y agoremoving telematics is of course unthinkable.
- bluGill 3y agoMost of us are in software and so are well aware how hard making things work againt future attacks are. Either there is no remote connection at all, or security is hard. Given that I trust Ford more than random mechanic, even if the majority if mechanics are more honest than Ford, there is at least one bad actor mechanic who will abuse telematics to do something ththey shouldn't.
- deleted 3y ago[deleted]
- TheLoafOfBread 3y agoIf a random mechanic can screw with remote access to your car, it should not be there at a first place. Like Windows 98 login prompt with "Cancel" to login anyway.
- piperswe 3y agoThe pre-NT login prompts weren't for authenticating with _your_ computer, they were for authenticating with network services. The fact that they kept a casual intruder out was just a bonus.
- VectorLock 3y agoWas just buying a new Toyota thats supposed to be delivered in about a month and was thinking about how to hit them with the "So about that new law..."
- JumpCrisscross 3y agoDo we have a copy of the letter? If this is based on law, the NHTSA doesn't have a choice. It has to enforce federal law, and federal law trumps state law. If it is based on a rule, the NHTSA has discretion and something screwy is going on.
- teeray 3y agoMassachusetts could probably double down and say “no car can be registered in the state of Massachusetts not in compliance with right-to-repair by 202X”. Then, even with federal preemption, the auto manufacturers would be forced to comply.
- CoastalCoder 3y agoIt sounds like that would become a game of chicken. For it to work, I'm guessing that additional states would need to join Massachusetts. Unfortunately, as we've seen with New York, that would probably be opposed by significant back-room sleaze.
- acranox 3y agohttps://www.bostonglobe.com/2023/06/15/business/subaru-buyers-take-hit-mass-right-to-repair-fight/ https://www.bostonglobe.com/2023/06/15/business/subaru-buyer... “ Subaru and another automaker, Kia, have been especially aggressive in resisting the law. While other companies are counting on a long-running federal lawsuit to overturn the statute, Kia and Subaru opted to shut off the features in their vehicles that are covered by the law.”
- thatguy0900 3y agoSo in massechutses my car doesn't send any telemetry to the manufactorer or random dealerships, and can't receive remote signals to start, stop brake or turn on its own? Sounds like a pretty good win. Also rich hearing about security concerns coming from Kia at the moment.
- JumpCrisscross 3y ago
- Simulacra 3y agohttps://s3.documentcloud.org/documents/23846284/nhtsa-letter.pdf https://s3.documentcloud.org/documents/23846284/nhtsa-letter...
- rblatz 3y agoNo shocker here, car manufacturers typically have been trash at software. They don’t want to open up so they lean on security/their own incompetence to say they couldn’t possibly open up telematics safely.
- x3874 3y ago$TSLA which NHTSA is in bed with (too). Just "tesla nhtsa probes" and look for those that concluded in actionable items, especially any for regulating their deadly FSD. NTSB OTOH...take their responsibilities more (or at all) serious.
- zaroth 3y agoDriving is deadly. FSD makes it less so.
- FireBeyond 3y agoCitation needed, beyond Tesla's misleading attempt to push statistics that compare "a limited subset of driving conditions where conditions are sufficiently optimal that FSD will engage, including but not limited to weather, location, time of day and road condition" against "all drivers in all weather, locations, all times of day and all road conditions".
- giantg2 3y agoWasn't there some sort of aircraft autopilot study that showed something like less actual control time ended up making pilots less skilled in the more dangerous conditions simply due to having fewer hours of actually controlling the aircraft? I wonder if something similar might be the case for FSD, if that study were to ever take place.
- ZoomerCretin 3y agoNot to mention, they purposefully disengage autopilot right before crashes, so they aren't included in crash statistics.
- M4v3R 3y agoLouis Rossmann did a video with his take on this specific topic if anyone's interested: https://www.youtube.com/watch?v=2nXVljRUnoc https://www.youtube.com/watch?v=2nXVljRUnoc
- scohesc 3y agoIt's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] If criminals are able to figure out and exploit a relatively simple compromise, what other exploitable secrets are auto manufacturers hiding using obscurity that right to repair would expose to the public? Any US residents know if the NHTSA is captured by corporate interests, or are they relatively free of corruption? [1]https://www.thedrive.com/news/shadetree-hackers-are-stealing-cars-by-injecting-code-into-headlight-wiring https://www.thedrive.com/news/shadetree-hackers-are-stealing...
- Rantenki 3y agoThis is hardly a new problem though. Thieves used to be able to pull the wires from under the steering column and start a car. For the more serious attacks mentioned, the automakers are essentially saying that they build extremely vulnerable systems and are afraid to disclose that fact. I suspect we're in violent agreement though, that the correct outcome is to fix the vulnerabilities AND to document the repair methods.
- zaroth 3y agoExtremely vulnerable is a mischaracterization. Read up on how the CANBUS attack works, it’s actually quite sophisticated. It’s the “evil maid” problem, and it’s extremely difficult to protect against, such that you pay huge premiums to get equipment hardened against these types of attacks.
- CoastalCoder 3y ago> It's been shown that people are able to rip headlights out of vehicles, plug into diagnostic ports behind them, unlock the doors and start the car. [1] Question about the U.S. legal system: If that's true, and if NHTSA's position is based on rule rather than law, then can NHTSA be (successfully) sued because the rule is capricious? IIRC courts have set a really low bar for the rationality of administrative rule-making, but I may not know what I'm talking about.
- 3y ago
- jimbob45 3y agoBecause federal conflicts with and therefore preempts the state law, "NHTSA expects vehicle manufacturers to fully comply with their Federal safety obligations." Isn't that the exact opposite of how things actually work?
- JumpCrisscross 3y agoNo; the Supremacy Clause [1]. [1] https://en.wikipedia.org/wiki/Supremacy_Clause https://en.wikipedia.org/wiki/Supremacy_Clause
- jimbob45 3y agoRight, insofar as those laws are made within the scope of the Constitution. My understanding is that the NHTSA and its authority aren't found within the scope of the Constitution except by the broadest of interpretations.
- JumpCrisscross 3y ago> My understanding is that the NHTSA and its authority aren't found within the scope of the Constitution except by the broadest of interpretations This is legally incorrect. There are challenges to agency authority, which might change the status quo. But even in their most ambitious forms, the NHTSA pre-dates Chevron by two decades. In any case, that's an aside in terms of what can and cannot be federal law. Federal law trumping state law was always intended.
- marcinzm 3y agoAnd the constitution has a mechanism for determining what falls within the scope of the constitution and that mechanism says this falls within the scope of the constitution.
- deathanatos 3y agoI think the more nuanced argument here is that while there are often federal agencies regulating various things, states have long been able to add additional requirements more stringent than the federal ones, so long as they do not conflict with the federal ones. CA has stricter environmental regulations. Numerous states have stricter minimum wage laws. Labor laws. Etc. (And yes, these can get challenged in court. In fact, the MA right to repair bill is being challenged presently.) But these are the same bad-faith arguments (FUD around remote vehicle takeover, which is not required by the MA bill) the voters of MA heard during the election season that this bill was (overwhelmingly) passed during. MA voters do not expect auto-makers to not uphold their federal obligations: MA voters expect them to uphold both.
- judge2020 3y ago> Notwithstanding anything in the preceding paragraph, motor vehicle owners’ and independent repair facilities’ access to vehicle on-board diagnostic systems shall be standardized and not require any authorization by the manufacturer, directly or indirectly, unless the authorization system for access to vehicle networks and their on-board diagnostic systems is standardized across all makes and models sold in the Commonwealth and is administered by an entity unaffiliated with a manufacturer. So the manufacturer cannot use their own software to manage authn/authz to their cars? What would stop the unaffiliated entity from giving anyone access to anyone's car? They wouldn't even have a financial stake in making sure they implement proper authn/authz and internal access controls to stop employees/contractors from accessing this information improperly. https://web.archive.org/web/20230510205950/https://malegislature.gov/Laws/SessionLaws/Acts/2020/Chapter386 https://web.archive.org/web/20230510205950/https://malegisla... The NHTSA complaint: https://s3.documentcloud.org/documents/23846284/nhtsa-letter.pdf https://s3.documentcloud.org/documents/23846284/nhtsa-letter... (bump from a comment further down by Simulacra )
- 58028641 3y agoWhy couldn’t it be authorized by the owner of the car?
- judge2020 3y agoIt sounds like the actual software that facilitates giving third parties access to remotely access car diagnostics can't be ran by the car manufacturer. So while they likely envision the user controlling the authorization for their car, my point is that this third party likely has little reason or obligation to safeguard access and authorization to this data and ensure only the user can authorize access to their car. If the automaker themselves ran the software for this, they have a financial stake to make sure it's done right, since "hyundais being remotely controlled due to bad hyundai 2fa" is not a good headline. But with a third party, it'll have to be a de-facto monopoly over access to a manufacturer's cars, so once they have the contract and are years after the initial rollout, they might cut costs and leave the authorization/authentication system to rot, or have support agents incorrectly "recovering" user accounts for themselves or being phished into doing so.
- some_random 3y agoBetween industry capture and ideological capture, federal agencies seem to be the weakest part of America's democratic system as of late
- hn_version_0023 3y agoIt's almost like weakening the federal government has been a plank in a party platform for at least the last 47 years of my life...
- some_random 3y agoYeah but that only sorta solves the issue of agency overreach, which is typically the ideological part. I think it's more of an ideological/values based position than a practical "protect our democracy" position.
- SrslyJosh 3y ago> NHTSA added that "open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking." If this is accurate: 1. Manufacturers have created systems wherein they can murder their customers remotely. (I expect this to be true, at least to a degree, for Tesla, but other manufacturers should know better than to introduce something as insane as OTA brake control.) 2. What the fucking FUCK is NHTSA doing allowing manufacturers to create systems for remote steering, braking, and acceleration?
- briffle 3y ago> (I expect this to be true, at least to a degree, for Tesla, but other manufacturers should know better than to introduce something as insane as OTA brake control.) https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...
- activiation 3y agoNHTSA need to be replaced or something
- korethr 3y agoIf I am understanding the article correctly, NHTSA asserts that to open up telematics to 3rd parties would allow remote attacks on multiple vehicles' safety-critical systems simultaneously. This implies telematics has remote control on those safety critical systems. This raises a question for me: Why the actual fuck are safety-critical systems able to receive commands from anywhere other than the driver's controls or diagnostic port? Perhaps I am old-scool, naive, ignorant, etc, but given what "safety-critical" means, that strikes me as egregiously unacceptable. I can sympathize with the idea of convenient remote diagnostic and repair, but in my opinion, this is a case where the saftey risk not just to the driver and passengers, but anyone else nearby, outweighs the convenience of logging into Ford's/BMW/Honda's website, click button, car works again.
- neuralRiot 3y agoWouldn’t be easy for the gateway module to prevent incoming commands if the vehicle is moving?
- jgerrish 3y agoThis isn't out of the blue. During the legislative process there was back and forth among NHTSA and MA sentators and representatives: https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/nhtsa_testimony_in_response_to_ma_committee_letter_july_20_2020.pdf https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/nhtsa_... That frankly shows this was not unexpected. And there was responsible transparent discussion between relevant parties. The NHTSA was doing their job. Maybe the MA senators and representatives were lobbing them a softball, explicitly calling out cybersecurity instead of leaving review topics up to NHTSA, in hopes of this happening. But that is obviously paranoid and an avenue of discussion that is difficult to talk about. So, I'll just let that go.