Skip to main content

Automakers are trying to stop you from hacking your car

Automakers are trying to stop you from hacking your car

Share this story

Last September, a New York-based company named Autel got an unpleasant surprise. It had made a diagnostic tool for figuring out what was wrong with a car and what parts were needed to fix it — but according to a lawsuit, they had done it by infringing on Ford's own diagnostic software. The smoking gun was a list of Ford car parts, stored in encrypted form in Ford's dealership tools, and uncovered within Autel's diagnostics. The list itself was useless — it was just a bunch of car parts — but it was copyrighted material, and prying it loose meant breaking through Ford's own digital protections, a violation of the notorious Digital Millennium Copyright Act. In the process of trying to build a diagnostic tool, the mechanics had accidentally run afoul of copyright law.

Many details of the suit are still unclear — did Autel take more than just the list? how much did their tool really borrow from Ford’s work? — but what’s striking is how thoroughly the deck is stacked against them. Simply accessing the code was a crime. It was copyrighted material, the property of the manufacturer, and tinkering with it was both difficult and illegal.

Simply accessing the code was a crime

It's a growing danger, as cars are increasingly reliant on an array of powerful processors and proprietary software. But copyright activists are pushing back against the idea in a new round of legal wrangling, claiming a fundamental right to tinker with that software, the same way an earlier generation of enthusiasts might tinker with a carburetor. Car companies have pushed back against the idea, citing safety and emissions regulations, but the fight is already raising fundamental questions of ownership in the digital age. If you can't control what happens under the hood, do you really own your car at all?

The fight is centered around a set of proposed exceptions to the Digital Millennium Copyright Act. Every three years, groups can propose such exceptions based on non-infringing uses that might otherwise be covered under the act. This time around, the EFF filed for two auto exemptions: one covering "diagnosis, repair, and modification" and another covering security research. (There was also a general "security research" exception, something vulnerability researchers have long been asking for.) If the exceptions are granted, it would be more than just a protection for companies like Autel. It would mean prying open the black box of car software, giving the driver new rights over the car's onboard processor.

"Code brings with it this whole legal doctrine that was created for different content."

In some sense, this is an old fight. For decades, automakers have tried to steer drivers toward dealership-based repairs, and for decades some drivers have resisted that pull, preferring to work on their rides at home and in third-party shops. But the computerization of the modern automobile has upset that balance, thanks to the unique legal status of software. It's possible to patent a car's transmission system (companies do it all the time), but it’s hard. It has to be a truly unique transmission system, and even then there will be years of applications and filings at the patent office. But copyrighting the software for an electronic transmission system is easy, and it gives companies a huge advantage in locking out third-party repair shops. Aggressive copyright laws like the DMCA compound that advantage, giving grounds to prosecute anyone who breaks through the car company's digital protections. "Code brings with it this whole legal doctrine that was created for different content," says the EFF's Kit Walsh, who's working on the exemptions. "The default has shifted dramatically in favor of the manufacturer."

Cars have also become less tinker-friendly for basic mechanical reasons. Open up the hood of a modern car and you’re likely to find a plastic cover, physically preventing the driver from doing much more than checking the oil. Telematics systems mean even physical fixes like changing a tire often require coordination with the protected central computer. There have been some bright spots — like new systems for pulling data from OBD ports — but the overall trend is clear: cars are becoming less accessible and more opaque.

The EFF claims would be a chance to fight back, through the same process that made it legal to unlock an iPhone. These exemptions are more narrow than the phone-unlocking measures, but they raise many of the same fundamental issues of ownership. "It's the same basic principle," says Walsh. "If you own something, you ought to be able to see what code is running in it and modify that code."

"If you own something, you ought to be able to see what code is running in it and modify that code."

At the same time, would-be car hackers may have bigger problems than just copyright law. Cars already exist in a web of laws and regulations, many of which are enforced through the car's processors. As General Motors points out in its rebuttal to the EFF, a driver that tinkers with a car's emissions systems or airbags might end up breaking EPA guidelines or car safety laws. There’s also the liability issue: if a hacked car ends up crashing because of bad brakes, the manufacturer could still be on the hook for a lawsuit. Many of those decisions are currently being made not by drivers or car companies but by the federal government — and for automakers, complying with those decisions means keeping control of the car's core electronics.

As a result, some in the auto industry favor a split system, in which systems like entertainment and telematics are left open while safety and emissions systems are locked down. Mike Tinskey, who directs Ford’s electric car and infrastructure projects, says he understands the nostalgia for mechanical tinkering and thinks there’s a way to preserve it as cars go electronic. "I think there's a whole set of things that can be customizable and a whole set of non-touchables," Tinksey says. "And we've essentially set the architecture of our vehicle up that way today. So you can access the CAN bus [the internal network that coordinates a car’s various systems], but you can't change, say, the transmission strategy." That customizable realm is usually where software platforms like Android Auto live, but tinkerers hoping for a deeper reach into the car's systems may end up being left in the cold.

Still, the most immediate concern for drivers is whether the DMCA will lock them out of their onboard computers entirely, and whether companies like Autel will still be accused of infringement for building on top of an automaker's platform. The Librarian of Congress will decide later this year whether EFF’s exemptions should be approved, but the larger issues will probably be fought out for years to come. It’s still hard to say whether tinkerers will have more or less power as cars grow more electronic and less mechanical. "As the years progress, cars will look even more like a tablet on wheels," Walsh says, "and the same regime of choice should apply."