Slashdot Mirror
How the Car Industry Has Hidden Its Software Behind the DMCA
Lucas123 writes: The DCMA has allowed carmakers to keep third parties from looking at the code in their electronic control modules. The effect has been that independent researchers are wary of probing vehicle code, which may have lead companies like Volkswagen to get away with cheating emissions tests far longer than necessary. In a July letter to the U.S. Copyright Office, the Environmental Protection Agency expressed its own concern of the protection provided by the DMCA to carmakers, saying it's "difficult for anyone other than the vehicle manufacturer to obtain access to the software." Kit Walsh, an attorney with the Electronic Frontier Foundation, said the legal uncertainly created by the DMCA "makes it easier for manufacturers to conceal intentional wrongdoing. The EFF has petitioned the U.S. Copyright Office for an exemption to the DMCA for embedded vehicle code so that independent research can be performed on electronic control modules (ECMs), which run a myriad of systems, including emissions.
Eben Moglen was right.
Eben Moglen is always right. Now take some time and watch some of his lectures on internet freedom, privacy and open source software
It may push even Congress to allow us access to our own cars' ECM and diagnostic systems.
Wouldn't it be nice to be able to make your own ecm with a arduino or raspberry pi? Last one I had to replace was $700.
That kind of money will buy a lot of add on boards.
Minimum threshold fixed. Thanks!
Why should "researchers" get to view the code? Here in Silicon Valley I cannot think of any instances where any outsiders routinely get access to a company's code.
But it's even worse with the FCC taking shots at free software (ie sources are available). They want devices locked down and it isn't (despite the implication by some) exclusive to wireless routers as some articles make out. Any device with a 5Ghz wireless radio is going to be locked down because manufacturer have no incentives or real good means of complying short of locking everything down. When market pressure is to go lower on price and core pieces are designed by only a handful of companies (like Qualcomm, Intel, AMD, Broadcom, and similar) the actual produce becomes cheap as market pressured push pressure on price resulting in expensive fixes only a niche audience will care/understand unlikely.
ThinkPenguin is the *only* company directly participating in the Save Wifi campaign selling and working on a *truly* freedom respecting router and embedded distribution (libreCMC). The rest are upstream (Qualcomm) and/or organizations within the privacy, free software, or open source communities. In fact the core brands (Linksys, D-Link, Netgear, and Asus) haven't even been willing to comment on the problem. They've got incentives to even deny there is an issue because the *rest* of the rules are going to make things cheaper/easier for them. They're likely willing to sacrifice your freedom for those other benefits.
may have lead companies
The past tense of "lead" is "led".
Captcha: mislead
like: fraud?
Professional engineers, not self proclaimed ones. Ones that sign on the dotted line taking personal responsibility for the code they write. With self driving cars, robots, drones, etc. we need to be able to hold coders responsible, the same way we hold held civil and mechanical engineers responsible.
A myriad of consumer goods now depend on code. And if that code has problems there may be safety, environmental or cost consequences. I'm talking about all kinds of computer and networking devices of course, but also phones, industrial control systems, medical devices, smart meters, aircraft, ships and household appliances.
If the code cannot be scrutinized, there is no way to check its quality. Plus, as others have noted, no way to maintain or improve it. The only exceptions I can think of offhand are some routers (FCC is trying to plug that), and PCs (Microsoft is trying to plug that). But these exceptions entail a complete replacement, as the original code is secret.
Prove anything by multiplying Huge Number times Tiny Number
The person or company who own the requirements owns all responsibility.
Their requirements, their testing criteria.
The coder will produce code to fit a requirement but they are not responsible for the requirement.
rgds
Please define mobility scooters as vehicles also :///
20 unique controllers that all do exactly the same thing :(
An auto drive messes up and kills someone and due to EULA / DMCA / Etc no logs can be used in court / you can't have your own lab look at them.
So the owner / driver goes to prison for some years learns how be good a real crime and when they get out after a run of mc jobs they set out get revenge on google / the court system and us gov.
The ISP's will force you to rent there hardware and they say no routers / your own wifi unless you buy our $200+ mo business plan.
For those in the US and all its terrortories but for the free world not at all. Or is it the position of these boring missionaries that only those from the land of the tamed can bear strange fruit from the poplar trees?
n/t
Whenever the topic of allowing government or public access to review source code comes up (like with, oh, say, voting machines) I always think of these guys:
http://gaming.nv.gov/index.asp...
and I realize that not of this is as important as gambling (and the collection of taxes thereon).
At least if you judge by how seriously we take access to the code. Just try to deploy a slot machine in Reno without letting someone at the Nevada State Gaming Control Board review your code. Won't happen.
Government oversight is not "third party". Compliance verification of manufacturer's emissions performance should extend to software design validation. Why doesn't it? It's not like it's difficult.
Do remember that the car software for critical areas like engine management are mostly developed using models rather than raw code. The majority of the logic is thus in configuration (of preprogrammed blocks of code), next to configuration of the parameters. So changing that optimized code would not be very smart. And reconfiguring it could jeopardize the safety critical behaviour in worst case, or create more emissions/be less efficient in some driving conditions in best case (for engine management sw).
Viewing it should be allowed, but you probably want the original model for eg Matlab.
This thing is as a former automotive tech. I have known for years that the "box" as many of us call it or the brains of engine management was the computer. With different programs you can make one engine work differently for many applications. From more torque in a truck to better horsepower for a car. The end result was less hardware changes and more through software. VW simply took that step in the direction on controlling emissions. I was never focused much on diesel but I do know diesel was kind of lagging in technology of gasoline engines. It had some inherent qualities built in such as better energy per volume of gas, and was always thought of as the dirty hard working fuel. Trucks, land movers, trains, and anything big in transportation used diesel. Frankly I have never thought any environmental agency was fond of diesel. But with VW now its probably been a death sentence for diesel in auto's. Its also going to mean even tighter and more regulations for automakers and thus more complicated certifications too. What is obvious is that manufactures like VW have simply given up on legally meeting these emission regulations and now are facing the fact they have to cheat in order to maintain a sense of driver satisfaction with their vehicles. I would not be surprised if other manufactures are doing similar software tweaks as VW has to make things work better. A lot of engineers are most likely sleeping bad at night after the VW discovery.
Actually, in some countries/states/provinces, there are laws that protect AND also can prosecute engineers who are guilty of such offenses. For example, here in Canada, to use the term engineer, means a professional engineer (a P. Eng). It's a protected professional designation bound by various laws and regulations. A large portion of the profession is ethics and the legal requirement to whistle-blow, REGARDLESS of who pays your salary. If.
My wife is an Environmental P.E. in the US and has the same professional responisbilities as Canadian P.E.s, if not more so - she is required to refuse employer's directives if the vilotate her professional judgement. Yes, this has caused her grief... We need the same standards for programmers of embedded code.
Protecting e.g. the code of the motor management system is a good first step. Leaving it at that however is sloppy work, as evidenced by the Volkswagen affair.
A more comprehensive protection would entail protecting the actual data with copyright safeguards too. Especially emission data. This data is, after all, proprietary and commercially sensitive data. Such data merits a high level of protection.
With adequate legal protection on the data itself, irresponsible and needlessly alarmist publication of unconfirmed, undigested and potentially misleading data can be prevented.
Of course there would be adequate means of raising questions and concerns with the manufacturer, on a full disclosure basis of course.
Let this be a warning for all of us: with the coming "Internet of Things" we must have DMCA protection for the data produced by devices too or risk a deluge of unauthorised, unconfirmed, and possibly alarmist data publication. We need legislative action today! Vote pro-business!
It's cheaper and easier to protect everything. If you segregate it, then you have to have Interface documentation, you have to have a way to program each of them separately, one public, one not. You'll have to test and demonstrate that this can't be trivially compromised (no "with Jumper 32 in place, you can program the radio"). It's all running on the same chip in any case: it's not like they have one prom for the radio and another for the router. The radio part, if it's separate at all, is a generic device with a I2C or SPI interface that configures it, so you're back to the "everything is in one CPU" world again.
Nope, all that costs money, and is subject to compromise. Easier to lock down the whole thing.
In the US, there's what's known as the "industrial exemption" which essentially says that if you are building a product, the engineering work does not require licensure. That is, one can "practice" Engineering without having the license. If you are building a single "thing", then you need the license.
There are also rules (in most states) about the use of the title engineer. In California (where I'm licensed), you can't call yourself a "Petroleum Engineer" (as in list yourself in the phone book, hang up a sign, etc.) unless you have the license. Engineer titles on business cards within a large firm is a lost cause.
In California, there is no "practice" or "title" requirement for software engineering (although there are software questions on the PE exam). One might, as an Electrical Engineer, be responsible for doing something in which there is a software component, and one would be expected to exercise good engineering judgement on its design, testing, etc.
However, a engine controller is something that is part of a "product" and, as such, any work that goes into it is covered under the industrial exemption.
Here's an idea: pass a law saying that every car sold must include access to the source code for all the software in the car, and the ability to replace the pre-installed binaries (preventing tivoization).
Cars have a variety of sensors to warn you when you breaks don't work, emergency breaks, and improperly installed breaks usually just screw up your rotors, not prevent the car from stopping. A seat belt is hard to install wrong, and you're not going to hurt yourself installing it unless you're really dumb. And I suppose Honda might have cut corners somewhere on safety to get weight down or some such and be afraid of lawsuits.
But yeah, you're probably right and it's bullshit.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
No employee should ever have to choose between getting fired or getting prosecuted when that bridge falls down. No, that's not made ok by finding employment elsewhere. Nor by having to wait months or years, and spending thousands to tens of thousands of dollars on a wrongful termination suit that has no guarantee of success.
Back to reality -- innocent until proven guilty.
California is the only state with it's own EPA. It's only legal because of the federal EPA creation timeline.
Actual, approved smog tests are nothing like the tests being used to persecute VW and other diesel manufacturers in the press. But it gets better -- the approval levels are negotiated in secret. There is no actual "NOx" limit that applies to all vehicles. It's often based on the make, model, and vin.
When you look at the legal, approved system used to test the cars, for example, some counties in California, it's often a set of rollers and the vehicle is tested at a few different RPMs over a span matter of several minutes. It's intended to help clean the air, not monitor drivers or vehicles on a 24/7 basis.
Granted, an eco-terrorist, green weenie with a rolling lab isn't going to like a short, simple test. They don't like a lot of things. The system being described in the press, and sites like citylab, the systems being used to persecute VW in the press, are laboratory grade systems mounted in the vehicles. The cars are being driven over hill and dale for many miles under many conditions. That's not what the law requires, and it's not a violation of a smog test.
It would be useful to see one of the suspect vehicles placed on an actual, approved test bed and "defeat" the "defeat device" somehow. Let interested parties see the actual, approved test failure document, not some neurotic geekfest that could be nothing more than sensationalized eco-terrorism.
Reform the entire smog testing process to some sort of standardized limits, based on reasonable numbers. Dissolve politicized organizations like CARB, CAL-EPA, and get back to the original intent -- lowering emissions.
http://www.scientificamerican....
This article above is a small start at describing the massive political hurdles required for carmakers to even begin to pass the tests. It shouldn't be this way.
That's before anyone considers the tax issue in California. They suddenly dropped the NOx limits circa 2009, and they also charge around $1 more per gallon in taxes on gasoline. Diesel fuel is exempt from much of the taxation. That's a huge political incentive to screw diesel power, even though (with a properly designed urea system) the modern diesel engines are often cleaner and more powerful than their gasoline counterparts.
If the goal is clean air, we might be trying to get rid of the wrong engines. It's another damn good reason to stop sensationalizing science.