
Automakers Say You Don’t Really Own Your Car - nthitz
https://www.eff.org/deeplinks/2015/04/automakers-say-you-dont-really-own-your-car
======
miander
My honest opinion here is that almost everyone is completely missing a crucial
point. Nearly all of the reasons given for locking people out of modifying
their cars apply equally to cars without computers. Changing the odometer?
It's far easier to do that on a car with a mechanical odometer. Making the
vehicle non-emissions compliant? Nobody used the DMCA to argue that people
shouldn't be allowed to remove their catalytic converters. All of this has
been fought for far longer than computers have existed. People have been
successfully fooled into thinking that this is a new situation, when
technology is only being used to prop up an ancient ideology. Very frustrating
indeed!

~~~
belorn
Of course this has nothing to do with lawsuits, fear of car modifications or
emissions compliance. It is a businesses decision in order to establish new
revenue streams where before there only was a single sale (and revenue) per
product.

See all that data that is generated when people use the product? That could be
mined, refined, and made into new products. All those computer screens in the
car are suddenly new avenues to push advertisements. All those critical
equipment are a avenue to sell repairs, where the producer has monopoly. And
if nothing else, the computer inside the car can always be made into a
platform.

Take a product, throw in some DRM, and voila, you can create revenue after
sale. The DRM and the accompanying user agreement is the glue from which all
that extra revenue can be made.

From a company perspective, I don't see how much of a choice they've got. A
competitor can use that extra revenue to lower prices for which a consumer
won't be able to assess when buying. Selling equal-looking products at higher
prices normally spells doom, and regulations haven't even begun addressing the
issue.

~~~
bri3d
It's not only the data, but also the continued promotion of dealer service
lock-ins.

There are many modern cars where (for example) the "service in XXX miles"
indicator for oil changes can't be reset except by the access-restricted and
very expensive factory service tool.

Many independent shops already have to buy reverse-engineered tools to allow
them to service these cars and continue to stay in business. It's clear that
automakers are very interested in abusing copyright laws to force a monopoly
on after-sales service.

~~~
snarfy
> very expensive factory service tool.

You can buy an ODB2 reader for ~$20 on amazon. If you are working on any car
newer than 1990, an ODB2 reader is a standard tool in your drawer.

The real problem is, to change the headlights on my car, you have to remove
the front wheels and part of the wheel well. If anything these shenanigans
help independent shops. If they built cars to last and be maintainable, there
would be a lot fewer independent shops.

~~~
bri3d
An OBD2 reader doesn't work for proprietary diagnosis, only
regulated/standardized emissions related issues.

The example I supplied (Service Now mileage indicator, not Check Engine Light)
was a very specific one with Porsche in mind. Most post-2004 Porsches have no
procedure to reset that indicator without using an official PIWIS ($13000 +
subscription, if you can even get one) or reversed Durametric ($250 + illegal
if automakers claim their software can't be reversed).

Another example of anti-competitive dealer software is "coding." Replacing the
headlight control module in a BMW, for example, requires it be "coded" to the
car's control systems. Many DIYers and independent shops use straight-up
pirated BMW diagnostic tools, because again, the "blessed" way to do so costs
thousands of dollars.

~~~
philwelch
I'm gonna just be cynical and say that BMW just _wants_ it to be expensive to
maintain a BMW. How else is it going to remain a Veblen good?

------
kileywm
The core automaker message I got out of this is:

Automakers want to lock out consumers and unapproved mechanics from tinkering
with vehicle software on the grounds that (1) they could purposefully or
accidentally make the vehicle non-compliant with safety/emission standards,
and (2) they could use the vehicle's computers to infringe copyright
(presumably ripping streaming audio?), and (3) closed source = more difficult
for malicious hacking of vehicles.

There are already laws in place to deter all of the outcomes of these actions.
To deter the action that _might_ lead to unlawful action... sigh.

~~~
chiph
I bet it's primarily the fear of being sued.

If your cousin's friend changes the code for the ABS to "work better on gravel
roads" and then you wreck, who's going to get sued? Not your cousin's friend -
he's living in a van down by the river. The automaker is, because they're the
ones with the money.

~~~
JimboOmega
But how is this different than if I put in aftermarket braking pads and then I
wreck? What if my cousin's friend installed them wrong?

Is the litigation risk any different with software rather than hardware?

~~~
viggity
it is much easier to look at an after market part and determine if it was
cause of the failure because it is a physical object. Software and the state
and sequence of events are much harder to look at and conclusively say "yes,
this was the culprit".

It's hard for me to pick a side here. I want that freedom, but the auto makers
have a compelling reason for wanting to stop it (getting sued, warranty
issues, etc). I'm 60/40 on the automaker's side.

~~~
Zak
A variety of systems which _can_ be flashed with modified or entirely third-
party firmware but usually shouldn't be have tamper flags that make detecting
the modification easy, even if the system is restored to its factory
configuration afterward. This could be a good solution for car makers,
especially if laws were updated to limit their liability in such cases.

To be specific: car makers should not be liable for unsafe modifications made
by third parties, even if they intentionally made the car easy to modify and
did foresee that some people would make unsafe modifications. To subject the
car maker to liability in the case of a modified car, the plaintiff should
have to show by a preponderance of evidence that the modification did not
cause the crash.

~~~
pyre
> the plaintiff should have to show by a preponderance of evidence that the
> modification did not cause the crash.

I can see this going the opposite way too. E.g. the automaker says that they
are not liable because the customer modified the audio system, even though it
was the ABS that failed.

~~~
Zak
Sure, but they'd have a very uphill battle convincing a jury of that. This
isn't "breaking seal voids warranty". This is "you, and you alone are
responsible for the results of modifications you make".

------
forrestthewoods
"Own" is such an overloaded term. What do you own when you own anything? It's
almost always complicated! If you own a music album on compact disc then
people say they own that album. But you aren't allowed to make copies of that
disc. And you absolutely can't makes copies and then sell the copies. You
can't even use that disc whenever and whereever you want. For example you
can't play that disc through stadium speakers at a sporting event. Nor can you
use host a concert and play parts of that album. You can't do it to mix with
other music and you can't even play it directly.

So again I say, own is such an overloaded term. I wish people used it far less
than they do.

~~~
sgustard
"Own" is just clickbait here. They don't quote any automaker who says you
don't own your car. They do quote automakers referring to "owners" as the
people who paid for and drive the cars. There are other items I can own but
cannot modify in certain ways, such as firearms.

~~~
dikaiosune
Worth noting that it's illegal to modify a firearm in certain ways, but other
ways are totally legal. Which relates back to the distinction between laws
that prevent modification vs. laws that enforce safety standards. It's not OK
to modify a semi-automatic rifle to be fully-automatic, the same way it's not
OK to exploit security holes in your car computer's firmware. However, it's
not OK to swap out your car computer's firmware entirely, but it is OK to swap
out the barrel, upper, lower, or whatever on your weapon, provided it's
certified for sale.

~~~
peter_l_downs
Great analogy.

------
bane
You know, I'd be okay with that if I no longer had to pay property tax,
insurance, maintenance, fuel and other costs on the vehicles I no longer owned
and instead that burden fell to the automakers.

------
cakeface
Who is going to start publishing open source car firmware? I imagine that
putting something together that would run some of the newer cars would
actually be quite difficult. I'm guessing that writing enough software to just
get a Tesla to turn on safely and pull out of the garage will be quite an
undertaking.

I can see a huge benefit from having FOSS versions of car firmware in the
future. It could be especially important if you don't agree with your
manufacturers choice of ethics for automatic driving (See the AI Tunnel
Problem).

[http://robohub.org/an-ethical-dilemma-when-robot-cars-
must-k...](http://robohub.org/an-ethical-dilemma-when-robot-cars-must-kill-
who-should-pick-the-victim/)

~~~
CHY872
Probably never. The amount of software that your car runs will easily stretch
into the millions of lines of code, it's incredibly complicated and the
combined efforts of thousands of programmers.

Then, insurers wouldn't insure you on some software, which would mean that
you'd be illegal to drive your car in many countries.

------
jordigh
Hahaha, remember when we always made car analogies about how we could use or
modify software?

[https://www.fsf.org/blogs/community/the-car-
analogy](https://www.fsf.org/blogs/community/the-car-analogy)

They're no longer analogies! They're the literal truth! This is very sadly
funny. :-( :-/ :-)

------
sgustard
When we have self-driving cars will we still expect to hack on the software? I
really feel my pedestrian avoidance is too sensitive, let's tighten that up a
little. And I want to win all four-way stops!

~~~
tdaltonc
I think that you should be allowed to hack your self driving car. But you
should have to submit the compiled code to the NHTSA and your insurance agent
so that they can run it through a bunch of black box simulations to determine
if it's street legal and how much to charge you per mile.

~~~
wstrange
This sounds possible in theory, but difficult in practice.

Designing a test suite that catches all possible life-critical errors is near
impossible. The cost of testing and certification will probably be quite high,
well outside the reach of amateurs.

Just as we advise people not to write their own crypto (its easy to get
wrong), I think the same will hold for safety critical software.

All that being said, I think it is very important that this software is open
source.

~~~
juliangregorian
I'd love for it to be open source (and I do believe that would be the safest
for all), but you know as well as I do that's not the world we live in. The
safety code is going to become a feature/price differentiator/trade secret
that car companies live and die by.

------
JoeAltmaier
Like you don't really own your iPhone? Yes, exactly like that.

~~~
venomsnake
Yep, we need legal rooting too.

~~~
ctdonath
It's legal to root your iPhone/etc.

However, the manufacturer is in no way obligated to make that easy or even
possible.

~~~
mikeash
Depends on how broadly you interpret "etc." For example, iPads are not legal
to jailbreak. Also, while jailbreaking an iPhone is legal, performing a
carrier unlock without the carrier's permission is illegal. (This is all for
the US. Other jurisdictions may and certainly do vary.)

~~~
zyx321
Do you actually own a carrier-locked phone though? It's not like a car that is
owned by the bank for a few years until you pay it off, and then you get the
title and keep driving it.

A phone you buy on a 2 year contract is yours at the end of the contract. Then
you get a new phone and give the old one to whoever in your family needs a new
one, or just put it on ebay for fifty bux and change.

------
seccess
"They warn that owners with the freedom to inspect and modify code will be
capable of violating a wide range of laws and harming themselves and others."

This argument is a bit silly, given how many laws can be broken and how much
harm can be done by anyone behind the wheel of an automobile, regardless of
how it has been modified.

~~~
bougiefever
Fear mongering is what it is. If average people who don't know how to read
code can be frightened into submission, they can do whatever they want.

------
solomatov
IMO, we should separate two things:

* Ability to modify firmware of your own car.

* Ability to inspect and review code in the car.

The first one is dangerous, imagine someone who wanted to improve ABS but
didn't do testings, and this led to a crash. Or, if we consider, more
intelligent self driving cars, possibilities for abuse, etc, are enormous.

The second one is discussable. On one hand, we want to make cars as safe as
possible, and there's no better way for this, than inspecting code. On the
other hand, the company wants to protect their intellectual properties from
competitors.

------
sehugg
"Right to Repair" laws have been in the works (and opposed by the auto
industry) for at least 15 years and recently passed by Massachusetts. One goal
is to level the playing field between dealers and independent shops by forcing
manufacturers to give up technical info, part of that being the interface with
computer systems. I'm not sure if the law mentions software modification at
all, but it sounds like a court battle waiting to happen.

[http://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_t...](http://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act)

------
zz1
We don't have cars anymore; we have computers we ride in. […] So when I get
into a car—a computer that I put my body into—with my hearing aid—a computer I
put inside my body—I want to know that these technologies are not designed to
keep secrets from me, or to prevent me from terminating processes on them that
work against my interests.

Cory Doctorow,
[http://boingboing.net/2012/01/10/lockdown.html](http://boingboing.net/2012/01/10/lockdown.html)

------
cynus_a
Well, if they're interested in selling more cars, I'm in the market for a car
that I can diagnose, repair and customize via a usb connection to my laptop.

There's an aversion to transparency in a lot of software stuff because you
can't prevent people from stealing your hard-earned work, but in giving your
customers more accessibility you'll have an immediate edge in the car market,
which, after all, is how you make money.

------
stolio
I generally agree with the EFF, I'd even say I'm a fan, but I disagree on this
one.

TL;DR == "tough"

Regulations can be bad, they can stifle innovation, enforce inequality,
maintain awful power structures, etc. But, they can also save lives. In
America there are a million things you can't do because they infringe on the
safety of others.

At an abstract level, an automobile is 3,000 lbs. of metal holding 10 gallons
of gasoline that carries human beings through public spaces at up to ~70mph.
It travels through neighborhoods where children live and play at up to 25mph.
It's a mixture of chemical, mechanical, computing and electrical systems that
an engineer needs about 10 years of study to be able to handle _after_ they
get to engineering school. Even then they'll specialize.

Car enthusiasts simply don't have the skills to merit carte blanche access to
mess around with cars that drive on public roads. In general, they probably
don't even have the skills necessary to evaluate their skills which is what
makes this so dangerous.

Tinkering with a mechanical system like your brakes is very different from
tinkering with a computing system that through an electrical system is
controlling the mechanical system that is your brakes. That's orders of
magnitude of new complexity. Do you really think the average car-guy will
understand the bugfix, written in optimized C or assembly, that accounts for
how a certain transistor behaves above 200 degrees Fahrenheit?

To be clear, these laws aren't to protect anybody from their own stupidity,
they protect the rest of us. If you _do_ have the skills to tinker at this
level then you're free to use them in race cars that aren't street-legal.

~~~
MichaelGG
The EFF isn't against regulations on cars. They're against companies using the
DMCA to restrict access. There are no regulations - that's precisely the point
of the article.

~~~
stolio
Can we just be honest about this? The EFF hates the DMCA and I think it's
clouding their judgement. They need to separate their very good fight against
the abuses of copyright law from this ridiculous fight to let people do stupid
and dangerous things to their cars.

If they have a better tool than the DMCA to keep the average person from
defeating safety features built in to their car, they should say it. But any
system strong enough to ensure there's no dangerous code running in any cars
on the road will be opposed by the EFF because it would be a whole new level
of surveillance.

~~~
MichaelGG
... Did we read the same article? The EFF is arguing exactly that. They say
that if the transportation authorities deem it necessary to regulate then
fine. But they haven't. Abusing the DMCA instead is just stupid and wrong.

~~~
stolio
We did read the same article, but I don't think it was very consistent
throughout. Their opening statement is this:

> EFF is fighting for vehicle owners’ rights to inspect the code that runs
> their vehicles and to repair and modify their vehicles, or have a mechanic
> of their choice do the work.

So I see "inspect" as read access, "repair and modify" as write access and I
think _what would we do if we had read-write access to our cars?_ Relly think
about that one for a second.

I disagree with the "regulation will be enough" idea in the same way I
understand the law regulates people from entering my house but I still lock my
door.

Later in the article they go into why the DMCA is the wrong tool for the job
and they're probably right, this shouldn't be done in the name of ending music
piracy.

------
Zigurd
Before you go down the path of "Would you want people altering the way their
autonomous vehicle works?" consider that it's already too late. There is open
source software for a variety of autonomous self-propelled robots, land
vehicles, and aircraft.

Why hasn't a problem manifested already, when I can build a drone, download
software for it, and tweak it all I want? It's because very few people do
that. And vanishingly few do it will ill intent.

I'm sure that 15 years form now there will be a true crime show about someone
who programmed their car to run over their spouse. (It's always the spouse.)
But that shouldn't be an excuse to stifle the thousands of beneficial results
from hacking automotive systems that will come about from people satisfying
their curiosity about what's on the CAN bus.

------
robgibbons
As much as I am pro-FOSS, don't vehicle manufacturers have a right to
copyright protection too? Why should vehicle computers be somehow different
from other computers, which we allow to run proprietary code?

I guess my point is that, even being a FOSS advocate and pro-DIY, I don't see
why car makers should be compelled to hand over their code, unless of course
they're already using GPLed or similar OSS code.

Troubleshooting diagrams would be reasonable to ask for, or perhaps some
documentation of the protocols used. But demanding that a company release
their source code because you essentially feel entitled to it is pushing the
buck if you ask me.

------
EliRivers
I recall that it's common to make one kind of processor, and deliberately
cripple them to varying degrees to ensure you can sell to every price point
without having to go through the extra expense of making a range of
processors.

The analogy with car engines, I presume, is to make one kind of car engine,
and to use the electronic control system to present a range of performances to
the consumer market, without having to go to the expense of actually making
different engines. Does this already happen, or is it yet to come?

~~~
Zak
It's not common yet. Usually, the higher-performance version has hardware
differences involving either more expensive materials, a more expensive
manufacturing process or greater mechanical complexity. I did notice a
possible example though: the Volkswagen Crafter, a full-size van popular in
Europe has 5-cylinder turbocharged diesel engines in several different power
ratings. I'm fairly confident they're mechanically identical and just have
different maximum boost settings for the turbocharger, though they _may_ have
different sizes of turbocharger.

------
sebastianconcpt
Is not that I don't like smart cars, the problem is that they allow a transfer
of control from who's supposed to be the owner to institutions and hackers:
[https://www.youtube.com/watch?v=3jstaBeXgAs](https://www.youtube.com/watch?v=3jstaBeXgAs)

Lets say that by a surreal act of good software engineering, you get rid of
the hackers problem, what are the odds of getting rid of corruptible
institutions?

------
lizzard
This applies as well to mobility devices like powerchairs and scooters and
other things like motorized beds that change your position. Without the
service manuals, it can be very hard to fix these.

------
spiritplumber
So do I get to bill them for parking fees on my property?

------
nhebb
Do cars actually run much software? I would think that most of the computing
was done via firmware.

~~~
Nursie
Firmware generally is software isn't it?

~~~
nhebb
I think the downvoters are missing my point. By definition, firmware is read-
only software, so I was asking sure what (potentially modifiable) software the
EFF is referring to.

~~~
Nursie
Is it?

I'm not saying it's not, I haven't even looked up a definition, but I do know
I've written firmware update code before... I think the way the term gets used
is probably a little blurry...

My car, for instance, is a bit old. It has some sort of ARM device in it
running a proprietary GPS system. There is an update mechanism that can be
triggered when you put a new DVD full of map data into the drive in the trunk.
This updates the stuff that runs the ICE as well as the GPS. I would be very
concerned if it had anything to do with engine-control I suppose.

~~~
nhebb
Maybe I'm being myopic as far as the definition of firmware. I've never heard
of a firmware update for a car, but if it's not happening already, it'll
probably be part of the regularly scheduled maintenance in the future.

~~~
CamperBob2
The term "firmware" originally referred to code that ran from nonvolatile
memory, such as EPROMs. Originally these devices weren't electrically
reprogrammable; you had to pull them off of the board, erase them with UV
light, and burn your new code and data onto the chip with specialized
equipment. Firmware was also commonly shipped on mask-programmed ROM chips
that were cheaper than EPROMs but that couldn't be reprogrammed at all.

Essentially nothing like that is used anymore. Almost every programmable part
is reprogrammable in-system unless someone takes extraordinary measures to
prevent it from happening. That means that there is no longer any real
distinction between "firmware" and "software," and there is no such thing as
"read-only software," as you put it earlier. There is only "software" and
"locked software."

This thread is all about who should own the keys to the lock.

------
diminoten
And its titles and articles like this which prevent me from send a _dime_ to
the EFF.

Automakers aren't trying to take ownership of my car away from me. This is
linkbait... no, it's donationbait, and as long as the EFF keeps this up, they
get nothing from me, and they should get nothing from you, either.

~~~
bhayden
This is a little overly black and white in my opinion. Yes, the EFF is not
flawless in their articles and writing. They have written questionable things
before and I don't always agree with what they say. Regardless, they are a
huge force for the rights of every day Americans and I think our rights would
be tremendously eroded without them. This is why I donate.

~~~
diminoten
The ACLU is a better/bigger force, I would argue.

The EFF actively misrepresents and _lies_ about issues to convince folks to
give them money. It's just too blatant, and they represent themselves as
technically savvy, so even if it's unintentional, I can't forgive them for
those kinds of errors.

------
larrys
I strongly disagree with the eff. Safety trumps all and there simply isn't a
compelling need (that I can think of) that requires the need to tinker with
the auto software. All of the "arguably restricts vehicle inspection, repair,
and modification" is just a red herring.

"The reach of copyright law has expanded so far that it now threatens people's
ability to repair their own cars and protect them against malware. Yesterday,
EFF launched a legal campaign to fend off that threat."

Can't even think that I have read any stories (so far) about malware having an
impact on auto operation. Hard to believe that opening up the software won't
result in something bad happening either.

~~~
Zikes
In the short term, they could easily use this to lock people out of being able
to perform certain routine maintenance operations on their vehicles, forcing
them to go to authorized dealers and paying exorbitant markups.

In the long term, tires, filters, and brake pads could become proprietary in
the same way as Keurig's K-Cups are now, though I imagine with more complex
DRM.

~~~
crististm
This already happens with other machines (washing ones). Only the dealers get
access to a proprietary DRM software that updates a 4KB firmware. I bet that
not for too long.

[http://www.scc-service.com](http://www.scc-service.com)

