Car hacking: Navigating the regulatory landscape

Abstract

In the summer of 2015, two American hackers succeeded in hacking into a car and taking over vital functions such as the engine and the brakes. Although this had been done before, the new element of the hack was that it no longer required physical access to the car. The hack took place at a distance via the mobile telephone network. This is a worrying development. It raises the question whether automobile manufacturers are doing enough to counter cyber security threats and, if that is not the case, whether a regulatory intervention is necessary and, if so, how to fashion regulation.

Introduction

In July 2015, American hackers Mahassey and Rogers claimed to have hacked a Jeep Cherokee. They stated they could control vital functions of the car from a distance, i.e. via the mobile telephone network. To prove their claim, they convinced Wired journalist Andy Greenberg to drive their Jeep while the two hackers from the couch in their living room played tricks on the Jeep. While Mr. Greenberg was driving on a highway, the hackers put the transmission in neutral, leaving the Jeep and its occupant rather helpless in a stream of fast moving traffic. It does not require much imagination to understand what the potential of cyber vulnerabilities in cars is when falling in the wrong hands.

The new technical development that allows this type of hack is that the internal ICT networks of cars increasingly become wirelessly connected to the outside world. Therewith, cyber security has become an issue for automobiles. In policy documents, much attention has been paid to cyber security of vital infrastructures,¹ but automobile cyber security has not received much attention to date. Even though no road ‘accident’ has occurred because of a failure of automobile cyber insecurity, the potential consequences for the transportation infrastructure and for individuals involved in accidents are large. This article contends that prevention of accidents should receive more attention and that code is an important part of the solution: technically, cars should possess sufficient resistance against hacks. The task to realize this falls on the shoulders of manufacturers. This raises the question whether manufacturers should take up this task voluntarily or that regulation is needed to safeguard automobile cyber security and, if so, what kind of regulation would be needed.²This is the central question of this article.

The outline of this article is as follows. In the second section, the relevant technology is clarified for as far as necessary for understanding the rest of the article. The third section addresses the need for regulation. The fourth section describes a bill that has been tabled by two senators in the US. Furthermore, the section develops first thoughts about how regulation could be set up.

Legal issues will be dealt with according to EU law, unless indicated otherwise.