Critique of the SPY Car Act of Obaid Farooqui

Transcription

1 Critique of the SPY Car Act of 2015 Obaid Farooqui Introduction The Security and Privacy in Your Car Act (SPY Car) Act was proposed in 2015 by Senator Markey of Massachusetts and Senator Blumenthal of Connecticut, and is aimed at introducing standards for the automobile industry with regards to cyber security. First and foremost, it outlines that the National Highway Traffic Safety Administration (NHTSA) and the Federal Trade Commission (FTC) should formulate standards surrounding car safety. The Act targets not just the ability of hackers to gain control of vehicles but also calls for safeguards against data breaches. Second, it advocates for greater transparency between car manufacturers and consumers about what driving data is being collected, and allows for users to opt out without losing out on features (to the extent possible). Third, the Act calls for creating a cyber dashboard to be presented as a sticker on all new cars to help consumers understand the security measures implemented by the manufacturer. A Great Beginning The SPY Car Act is a fine start, and a much needed push for the automobile industry. Given the costs associated with developing ever- complicating security

2 features, the relatively low margins of the auto industry, the low volume of real world car hacks, and the resulting consumer complacency on the issue, there simply do not exist the market incentives for car companies to invest in the kinds of security features that modern car owners need. Thus, this first step to introduce government oversight incentivizes car manufacturers towards developing new models with cyber security and data privacy in mind. The Act has a number of high points. It sets lofty goals for protecting cars against hacks, including real- time detection and response mechanisms. It also sets the expectation of secure storage of data in all parts of the data pipeline, from onboard and off- board storage to the transmission in between. It also makes a bold move towards protecting consumer privacy interests, and prohibits manufacturers from strong- arming consumers into accepting data collection by withholding features from consumers; however, it also wisely recognizes that certain features may inherently require data collection, and cannot be offered if the user opts out, and makes an exception for such features. The idea of a dashboard that allows consumers to quickly understand what the different security features entail is a well- intentioned effort as well. It is in line with the larger push of the Act towards greater security coupled with greater consumer choice and understanding.

3 Points to Consider While it is a brilliant start and commendable that the Senate is starting to consider these issues as the security community is waking up to them, there are a number of finer points in the Act, many of whose details have yet to be decided on by the NHTSA and the FTC, which should be reconsidered. Cybersecurity Standards First, the notion of setting minimum standards is a sort of double- edged sword. The general goals that are outlined in the Act, especially in the first section on Cybersecurity Standards, hit the nail on the head quite well. However, the nature of the regulations that will come of it from the NHTSA and the FTC will have a great impact on the effectiveness of this Act. If the regulations are simply an enumeration of certain implementations or a battery of attacks that automakers must protect their cars from, then this Act poses the danger of making the automobile industry lazy in the face of new attacks, and lulling consumers into a false sense of security simply because the cars they purchase met the minimum standards months or years ago (which could very well have already become outdated at that time). In the case of automobile safety, we can say that we want cars to be able to withstand crashes of a certain force, and as long as the laws of Physics don t change, it stands to reason that a car that was up to

4 standard yesterday will be no less safe tomorrow. Cybersecurity is not like auto safety, however: we can say that we want data to be stored securely for instance, but a method of storage that is secure today may not be secure tomorrow for any number of reasons, say if an encryption algorithm is broken or a new vulnerability is found. Furthermore, the proposed regulations will take 18 months to formulate, and an additional 18 months to reach their final forms. While there s no good ways around this, and some may even argue that it s a relatively short amount of time given the massive number of attack vectors and the variety of car systems out there. But it serves the point made above that these regulations, then, cannot be a simple list of attacks they must present goals that are broad enough to be current, and specific enough to be meaningful. It s a fine line to walk, but one that the NHTSA and the FTC must consider very carefully. In addition, the regulations should include provisions to ensure that carmakers design systems that can be easily updated with retroactive security patches. The constantly changing nature of cyber threats and vulnerabilities necessitates that for a vehicle to remain secure, it should be easy for owners to have their cars updated at a later time when newer security features are introduced or previously unknown vulnerabilities come to light. Otherwise, a car that is secure at the time of manufacture may quickly become vulnerable after it leaves the lot.

5 Privacy Standards The second part of the Act that deals with privacy standards is a strong one, and sets a powerful precedent with regards to what consumers might be able to expect from companies. But a question that the automobile industry will no doubt and rightfully ask is why this special treatment of driving data? After all, just about every tech company from the multi- billion dollar giants to every Tom, Dick, and Harry that develops iphone apps out of their basement collects data. This can range from wristbands that collect health data to productivity apps that scan s to recommendation and navigation apps that track location data (which is essentially the same, if not more privacy- invading, then driving data). This begs the question: is this part of the Act just the first step in attempting to tame the Wild West that is user data collection? Can the rest of the tech industry expect similar regulations in the near future? It s important to keep in mind that data collection is the name of the game these days, and is an integral part of developing key new features and personalizing user experiences, and is a stepping- stone to making discoveries about aggregate usage that can in turn guide future products. For car companies specifically, collecting driving data has many benefits, not least of which is helping to design self- driving cars and introducing new and improved safety features. Pushing for complete openness with consumers might negatively impact the level of data collection that these companies can then conduct.

6 Nevertheless, this move to require car companies to be open about their data collections and usage policies is a laudable move, but perhaps it would be best to consider this as part of a separate bill that deals with user privacy issues, and not the SPY Car Act that focuses on vehicle security. Cyber Dashboard The last part of the Act that proposes the idea of the cyber dashboard is an interesting idea, but again, its efficacy will depend entirely on the details of its implementation. It's certainly well- intentioned to try and educate the populace about cyber- attacks, but the fact of the matter is that even many engineers within the tech industry don t have a solid grasp on what different cyber attacks and their defenses entail. Simply providing consumers with information on what a manufacturer has done beyond the minimum requirements will not necessarily help them to understand how safe a car might be. More importantly and as discussed above, this may cause the industry to focus their efforts off of a list of requirements rather than reform the engineering process to take security into consideration at every step. A better implementation of the cyber dashboard might be to create it in the form of a five- star security rating system similar to the car safety rating that already exists. The rating body should have a list of common and reasonable attacks that it tries to execute against a car, and the rating it awards should be based off of how

7 immune a car is to those attacks relative to other vehicles in the market. This list of attacks can and should be updated on a yearly basis, and should strive to be as technically advanced as possible. Additionally, design decisions that manufacturers make to secure their cars (such as the use of encryption, or the separation of essential and non- essential systems), while they may not directly protect against specific attacks, should be rewarded and favored in the rating process. The benefits of such a system are twofold. For the consumers, it s a lot more meaningful to shop for cars that have four or five stars and to avoid cars that have two or three stars, even if these cars can claim to have met the minimum requirements. The five star system is already related to car safety, is easy to understand, and leaves little room for consumers to be deluded about the meaningfulness of security features that manufacturers may try to trumpet. For manufacturers, this incentivizes being at the top of their class in terms of security, since the rating system is inherently competitive. They can meet whatever standards are set forth and legally be allowed to sell cars, but if they innovate in the security space, they can turn that into a real competitive advantage that everyday consumers can understand and respond to. Conclusion In summary, the SPY Car Act is a fantastic start, and it is an important step for the government to take to keep up with the dizzying speed of the tech and car

8 industries. With the above considerations, the Act can become more effective and compelling, and will hopefully prevent the auto industry from making the sorts of security mistakes that subsets of the tech industry have made in the past.

9 Sources Carter, Gene. "Ramifications of the SPY Car Act." Embedded Computing Design. N.p., 29 July Web. 15 Dec < computing.com/guest- blogs/ramifications- of- the- spy- car- act/>. Greenberg, Andy. "Senate Bill Seeks Standards For Cars Defenses From Hackers." Wired.com. N.p., 21 July Web. 15 Dec < bill- seeks- standards- cars- defenses- hackers/>. Howard, Alexander. "Senate Bill Aims To Lock Hackers Out Of Connected Cars." Huffington Post. N.p., 21 July Web. 15 Dec < act- car- hackers- senators- security_55ae4e72e4b0a9b b>. S , 114 Cong. (2015). Print. "Sen. Blumenthal Introduces Bill To Protect Connected Cars From Hackers." NPR. NPR, 22 July Web. 15 Dec < blumenthal- introduces- bill- to- protect- connected- cars- from- hackers>.

10 "Sens. Markey, Blumenthal Introduce Legislation to Protect Drivers from Auto Security, Privacy Risks with Standards & Cyber Dashboard Rating System." Senator Ed Markey. N.p., 21 July Web. 15 Dec < releases/sens- markey- blumenthal- introduce- legislation- to- protect- drivers- from- auto- security- privacy- risks- with- standards- and- cyber- dashboard- rating- system>. "Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk." (2015): n. pag. Ed Markey, United States Senator for Massachusetts. Web. 15 Dec < 06_MarkeyReport- Tracking_Hacking_CarSecurity%202.pdf>.