Slashdot Mirror
How the Car Industry Has Hidden Its Software Behind the DMCA
Lucas123 writes: The DCMA has allowed carmakers to keep third parties from looking at the code in their electronic control modules. The effect has been that independent researchers are wary of probing vehicle code, which may have lead companies like Volkswagen to get away with cheating emissions tests far longer than necessary. In a July letter to the U.S. Copyright Office, the Environmental Protection Agency expressed its own concern of the protection provided by the DMCA to carmakers, saying it's "difficult for anyone other than the vehicle manufacturer to obtain access to the software." Kit Walsh, an attorney with the Electronic Frontier Foundation, said the legal uncertainly created by the DMCA "makes it easier for manufacturers to conceal intentional wrongdoing. The EFF has petitioned the U.S. Copyright Office for an exemption to the DMCA for embedded vehicle code so that independent research can be performed on electronic control modules (ECMs), which run a myriad of systems, including emissions.
Eben Moglen was right.
Eben Moglen is always right. Now take some time and watch some of his lectures on internet freedom, privacy and open source software
It may push even Congress to allow us access to our own cars' ECM and diagnostic systems.
Wouldn't it be nice to be able to make your own ecm with a arduino or raspberry pi? Last one I had to replace was $700.
That kind of money will buy a lot of add on boards.
Minimum threshold fixed. Thanks!
Why should "researchers" get to view the code? Here in Silicon Valley I cannot think of any instances where any outsiders routinely get access to a company's code.
may have lead companies
The past tense of "lead" is "led".
Captcha: mislead
like: fraud?
Professional engineers, not self proclaimed ones. Ones that sign on the dotted line taking personal responsibility for the code they write. With self driving cars, robots, drones, etc. we need to be able to hold coders responsible, the same way we hold held civil and mechanical engineers responsible.
A myriad of consumer goods now depend on code. And if that code has problems there may be safety, environmental or cost consequences. I'm talking about all kinds of computer and networking devices of course, but also phones, industrial control systems, medical devices, smart meters, aircraft, ships and household appliances.
If the code cannot be scrutinized, there is no way to check its quality. Plus, as others have noted, no way to maintain or improve it. The only exceptions I can think of offhand are some routers (FCC is trying to plug that), and PCs (Microsoft is trying to plug that). But these exceptions entail a complete replacement, as the original code is secret.
Prove anything by multiplying Huge Number times Tiny Number
Please define mobility scooters as vehicles also :///
20 unique controllers that all do exactly the same thing :(
An auto drive messes up and kills someone and due to EULA / DMCA / Etc no logs can be used in court / you can't have your own lab look at them.
So the owner / driver goes to prison for some years learns how be good a real crime and when they get out after a run of mc jobs they set out get revenge on google / the court system and us gov.
Actually, in some countries/states/provinces, there are laws that protect AND also can prosecute engineers who are guilty of such offenses. For example, here in Canada, to use the term engineer, means a professional engineer (a P. Eng). It's a protected professional designation bound by various laws and regulations. A large portion of the profession is ethics and the legal requirement to whistle-blow, REGARDLESS of who pays your salary. If you want proof of this, and why this is a good thing, here is an example:
In Ontario, Canada, there was a mechanical or structural engineer (can't remember which) who signed off that a mall parking garage (was built on the roof of the mall, oddly), was in fact structurally safe. Even though there was numerous concerns by tenants and visitors about the safety of the structure, weeks after the engineers last 'pass' inspection, the roof collapsed killing two people. (see story: http://www.cbc.ca/news/canada/...).
The gist is, the engineer knew there was deficiencies and signed off on it anyway. Needless to say, he is facing criminal charges, and likely has had his licence revoked, and his career is over! If you are an engineer in Canada, you can't pull the 'my boss told me to' excuse. I know this because my father worked 35+ years as a licensed electrical engineer in Canada. You tend to pick up on things like this growing up. However, I can't speak about engineering in other countries but I would hope this is the case in the US.
You don't have to buy a router/AP combo.... I get what you are saying but this is an absolutely trivial problem to solve, separate your router and Wifi AP into discrete devices and tell the FCC to suck it.
Good-bye
Whenever the topic of allowing government or public access to review source code comes up (like with, oh, say, voting machines) I always think of these guys:
http://gaming.nv.gov/index.asp...
and I realize that not of this is as important as gambling (and the collection of taxes thereon).
At least if you judge by how seriously we take access to the code. Just try to deploy a slot machine in Reno without letting someone at the Nevada State Gaming Control Board review your code. Won't happen.
Government oversight is not "third party". Compliance verification of manufacturer's emissions performance should extend to software design validation. Why doesn't it? It's not like it's difficult.
The same thing has been going on with the FCC and WiFi for many, many years.
The EPA isn't any different, see the quote from the article below.
"A group of automobile manufacturers said that opening the code to scrutiny could create “serious threats to safety and security.” And two months ago, the E.P.A. said it, too, opposed such a move because people might try to reprogram their cars to beat emission rules."
The EPA or FCC won't be the ones that will fix this.
There is only one solution, start creating the open source code, it will take many, many years but eventually it will be as good or even better than the original manufacturers.
New things are always on the horizon
Protecting e.g. the code of the motor management system is a good first step. Leaving it at that however is sloppy work, as evidenced by the Volkswagen affair.
A more comprehensive protection would entail protecting the actual data with copyright safeguards too. Especially emission data. This data is, after all, proprietary and commercially sensitive data. Such data merits a high level of protection.
With adequate legal protection on the data itself, irresponsible and needlessly alarmist publication of unconfirmed, undigested and potentially misleading data can be prevented.
Of course there would be adequate means of raising questions and concerns with the manufacturer, on a full disclosure basis of course.
Let this be a warning for all of us: with the coming "Internet of Things" we must have DMCA protection for the data produced by devices too or risk a deluge of unauthorised, unconfirmed, and possibly alarmist data publication. We need legislative action today! Vote pro-business!
You don't have to buy a router/AP combo.... I get what you are saying but this is an absolutely trivial problem to solve, separate your router and Wifi AP into discrete devices and tell the FCC to suck it.
it's not even that. just separate your router from your wifi Radio. And router firmwares often already have different regions or even files for system and firmware flash (even more common in cellphones) so there's no problem letting you update the system firmware but not the radio firmware. just write-protect the radio portion of the firmware.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
In the EU, the controls you are saying will ruin cars/drivers are already in place.
Although things are being looked at in light of the VW scandal, the tests here are much stricter and all this will do is make them stricter still. The problem is not that the manufacturers NEED to break emission levels in order to achieve what the driver wants, it's that drivers are all expecting unnecessary road performance that wasn't present even 30-40 years ago. We're ALL driving cars that could bear Formula-One cars from certain eras. Do we need to be? No.
That emission control also gives fuel economy for the sacrifice of raw speed is not a bad thing. Every car in your country can do the speed limit - and more. They can all do 0-60 in under 12-15 seconds - and more. They don't need to be able to do that.
Suggesting that VW can't sell a car just because it doesn't go much faster than the speed limit misses out entire sections of the population (those that don't want that, those that have kids, etc.) in an era when people are voluntarily speed-limiting their vehicles (e.g. company cars), having the insurance companies track them, and the most road surveillance there's ever been (I contest that if you're learning to drive today, you're a prick to think that getting into the habit of speeding as a matter of course will serve you well in the future).
In the EU the limits are stricter, the testing more rigorous and - well, who cares? My 15-year-old car can still do 0-60 in under 10, can provably do 130-140 mph without any special preparation, etc. We don't need that. We need fuel economy and to stop them churning out crap.
"Being found out" will lead to the same speeds of cars, the same looks of cars, the same desirability of cars, but without all the crap in the air. The ENTIRE PURPOSE of car ECUs is to conform to emissions controls. They now - and always have - only slow the potential of the engine to stop it getting into bad burning that pollutes unnecessarily. Eliminating that does not destroy the market, the EU prove that - but being found to cheat the tests and maybe having all your customers cars recalled? That fucks you up big-time.
Nobody will care. The stricter standards already in the EU will come in. Old polluters will die out almost entirely within 10 years or so. And nobody will know any different because ALL the cars will have to pass the same tests. Diesel won't go away, cars will still be able to speed, pricks will still burn off at the lights, but we won't be giving kids asthma for the next 60 years either.
I think there should be such a thing for certain types of software. Let's call them mission critical applications for the sake of brevity and ease. Now, for example, such would be a good thing for software contained withing medical devices, power plants, controllers used in managing the electrical grid, etc... They will always have flaws but they should do so with a failsafe and with recovery as well as security baked in and not tacked on.
I am not, nor do I profess to be, a programmer but I have written many lines of code. I would have no business acting on this sort of thing and should not be allowed to work anywhere near it. I can't say, with any certainty, that I'm a good judge but I think we could do something like this idea. Would it mean greater expense and a longer time to roll out? Probably, at least at first. Would we need special languages? Maybe - though I understand it *might* be easier with languages such as ADA. However, again, I'm not a programmer in the truest sense of the word (or even a pretty loose definition, honestly) so I'm not qualified to opine.
Will this mean fewer features? Probably. If computing is so damned difficult then why the hell are we basing so many things on it? It's like designing software for the lowest common denominator and those who advocate for 'user friendly.' Umm... If you can't operate a computer then, just maybe, you should consider either learning how to or not basing your fucking livelihood on it.
The idea of a computer on every desktop was crazy from the outset and still is - that we carry massive amounts of compute power in our pockets (often by folks who have no idea how to effectively use it and designed to be easy enough for a child to basically operate) is absurd from the word. If you don't know how to operate a hammer you don't base your career on working in the construction industry. (Not the most perfect analogy but it's what I've got.) If you can't operate a computer then you probably shouldn't base your livelihood on it - seemingly off topic but tangentially related and hopefully fills out the point I'm trying to express. I'm not that articulate, unfortunately.
We need good software (and we have plenty of it, to be honest). We've rushed the industry and, sure, the benefits have been phenomenal. However, with all that growth has been some equally phenomenal failures. There are certain industries, mission critical application types, where there should have been accountability from the beginning. I doubt that it's too late to start with it now, it will just be time consuming, expensive, and difficult. Oh well. You don't really get to decide "needs." You only get to decide "wants."
Separate fields of programming should, indeed, be populated by professionals who are willing to put their name on their work and to accept accountability for the flaws within it. Automobiles are one such sector and would probably be better for it. You programmers should have unionized a long time ago and formed the professional engineering group yourselves and the failure to do so means that some government is going to come along and do it for you.
If you're going to get screwed you might as well get to pick the position. Additionally, think of some of the benefits to belonging to this protected group. There could even be multiple layers of certification - such as classes in boiler room engineering. Accountability is key and, again, you should do this before the government forces you and you have little or no input into the decision making process.
Someone smarter and more familiar with this than I am should act on this - making a governing body as well as formalization of a working group to establish standards (this could so be open source and collaborative) should do this. It is, eventually, going to happen in certain sectors - wait until a power plant melts down because of a bug in the code or because of improperly implemented security.
Hmm... As an aside, this might be a good thing and approved of by that AJT fellow who advocates micr
"So long and thanks for all the fish."
Here's an idea: pass a law saying that every car sold must include access to the source code for all the software in the car, and the ability to replace the pre-installed binaries (preventing tivoization).
Cars have a variety of sensors to warn you when you breaks don't work, emergency breaks, and improperly installed breaks usually just screw up your rotors, not prevent the car from stopping. A seat belt is hard to install wrong, and you're not going to hurt yourself installing it unless you're really dumb. And I suppose Honda might have cut corners somewhere on safety to get weight down or some such and be afraid of lawsuits.
But yeah, you're probably right and it's bullshit.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Dont cellphones run on this exact method you are describing? The cell radio is walled off from the OS.
Good-bye
Software in the auto industry is very heavily tested. Entire test teams that don't even exist in the desktop or phone world exist and beat the hell out of products.
A test team is far cheaper than a single recall.
And still some problems slip through (to say nothing of fraud like the recent emissions test scandal, which is exploding. Wait for it to tag the US companies) but that is next to nothing compared to any other software domain. It matters because of the potential for deaths, but to think they are taking things lightly currently is pure ignorance.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
...In the EU the limits are stricter, the testing more rigorous ....
I'm not so sure about that. The standards might be more rigorous on paper, but the EU testing methodology seems to have more industry-sponsored loopholes that are designed to make cars look much more efficient than they actually are.
No employee should ever have to choose between getting fired or getting prosecuted when that bridge falls down. No, that's not made ok by finding employment elsewhere. Nor by having to wait months or years, and spending thousands to tens of thousands of dollars on a wrongful termination suit that has no guarantee of success.
It seems like there should be a way to build into the hardware something to prevent the power used for broadcast from being over the limit. After that the firmware can do whatever it wants, no?
Back to reality -- innocent until proven guilty.
California is the only state with it's own EPA. It's only legal because of the federal EPA creation timeline.
Actual, approved smog tests are nothing like the tests being used to persecute VW and other diesel manufacturers in the press. But it gets better -- the approval levels are negotiated in secret. There is no actual "NOx" limit that applies to all vehicles. It's often based on the make, model, and vin.
When you look at the legal, approved system used to test the cars, for example, some counties in California, it's often a set of rollers and the vehicle is tested at a few different RPMs over a span matter of several minutes. It's intended to help clean the air, not monitor drivers or vehicles on a 24/7 basis.
Granted, an eco-terrorist, green weenie with a rolling lab isn't going to like a short, simple test. They don't like a lot of things. The system being described in the press, and sites like citylab, the systems being used to persecute VW in the press, are laboratory grade systems mounted in the vehicles. The cars are being driven over hill and dale for many miles under many conditions. That's not what the law requires, and it's not a violation of a smog test.
It would be useful to see one of the suspect vehicles placed on an actual, approved test bed and "defeat" the "defeat device" somehow. Let interested parties see the actual, approved test failure document, not some neurotic geekfest that could be nothing more than sensationalized eco-terrorism.
Reform the entire smog testing process to some sort of standardized limits, based on reasonable numbers. Dissolve politicized organizations like CARB, CAL-EPA, and get back to the original intent -- lowering emissions.
http://www.scientificamerican....
This article above is a small start at describing the massive political hurdles required for carmakers to even begin to pass the tests. It shouldn't be this way.
That's before anyone considers the tax issue in California. They suddenly dropped the NOx limits circa 2009, and they also charge around $1 more per gallon in taxes on gasoline. Diesel fuel is exempt from much of the taxation. That's a huge political incentive to screw diesel power, even though (with a properly designed urea system) the modern diesel engines are often cleaner and more powerful than their gasoline counterparts.
If the goal is clean air, we might be trying to get rid of the wrong engines. It's another damn good reason to stop sensationalizing science.
You can easily import a USA certified emissions vehicle into Europe but a vehicle built for the European emissions market generally will not make it into the USA. The reason is different gas are tested and rated differently.
This may all change in 2020 when tougher rules in most parts of Europe go into affect.
Also VM and some other companies are starting to get in trouble in Europe for the same issue that is causing all the news in the USA.