Police Slowly Waking Up To Fact That Vehicle Network Security Is A Joke To Hackers, Thieves

from the internet-of-not-so-smart-things dept

We've been talking for several years now about how modern "smart cars" don't adhere to particularly smart security practices. Nissan recently opened Leaf owners to remote attack via a nasty vulnerability in the car's app. The Mitsubishi Outlander was similarly unveiled to be relatively trivial to hack. And last year, hackers showed just how easy it was to manipulate and disable a new Jeep Cherokee running Fiat Chrysler's UConnect platform.

Most of these attacks involve the intruder worming so deeply into a vehicle's systems that they're in some cases able to actually control most if not all of the car systems from anywhere on the planet. So as you might imagine, simply unlocking the doors and starting the engine while in or near the car isn't proving too difficult for many hackers.

The Wall Street Journal notes how police and insurance companies are only just now waking up to the problem this creates for owners, one of which last month posted this video of a thief using a laptop to hack into and steal a 2010 Jeep:

Filed Under: car thieves, cars, connected cars, security, vehicle security

Copyright As Censorship: Questionable Copyright Claim Forces Indie Musician To Destroy All Physical Copies Of New Album

from the isn't-that-nice dept

Indie musician Will Toledo has a band (it's all him, actually) called Car Seat Headrest that just (sorta) put out its first album with a label (pretty famous indie record label) after a whole bunch of self-released albums, and lots of (well-deserved) internet buzz. The album was released this past Friday... sorta. Apparently one of the songs included an homage to a song by The Cars. I've read a bunch of articles on this and Toledo's own statement, and the homage is called a bunch of different things, from a "sample" to a "cover" and no one ever clarifies which it actually is. And that's important because the legal issues are potentially different with each. But, it also doesn't matter at all because Toledo and Matador have agreed to destroy all the physical copies of the album after The Cars' Ric Ocasek complained that he didn't like it. So the digital release came out, with a replacement version of the song that Toledo apparently rewrote a week before the album was released, and a new physical version will come out... sometime.

Here's the way Toledo explained it:

Life happens and sometimes not in ideal ways. If you’ve heard anything about the new album, then you’re probably aware that one of its songs made use of The Cars song “Just What I Needed.” Now, obviously, when we called the record ‘done’ and sent it off to be printed, we were working in full confidence that we had the legal side of it all worked out. We found out last week that this was not the case. I’m not going to get into the nitty-gritty of email chains and invested parties; suffice it to say that Matador (and I) were neither pulling a Banksy nor operating in ignorance of the law, but that we truly believed we had the issue resolved months ago, until last week.

As you may have heard, vinyl is being pulled from stores right now. There’s a total recall out, and all copies with the original version of the song will be destroyed. Nevertheless, Teens of Denial WILL COME OUT ON MAY 20TH, at least digitally. I spent the last 48 hours working on an alternate cut of the track, which is now called “Not What I Needed”. It’s not merely an edit – it is its own thing, about half a minute longer than the original track, and goes in a much different direction. Honestly, despite the apparent clusterfuck, I had fun doing it, and I think it’s a stronger song now. In any case I’ve grown up accustomed to working on an album right up to its drop date, so this is not a freak-out scenario for me. The album is going to come out on time and it’s going to be good.

The physical release will not come out on time, obviously. We’ll likely see a street date of sometime in July. I’m very sorry to everyone who was anticipating a preorder (it does sound GREAT on vinyl). It will be in your hands eventually. But it was very important to me that we keep the digital release for May. We’ve all been waiting long enough. Most of my music only exists online anyways, so it makes sense that this album should start the same way.

Thanks for your continued support, and I am very excited for this fucking record to come out already.

-Will Toledo aka Car Seat Headrest

In short, "we thought we had a license, but turns out we didn't." But I'm still confused as to whether or not a license is truly needed here. Of course, there's enough ambiguity over the law that I can see why no one would want to chance it. If it was truly a "cover" then we have compulsory licenses for that, and it wouldn't matter what Ocasek thought, because he couldn't stop it. But, one of the true oddities of copyright law is that such compulsory licenses really only apply if you do a cover that is a faithful representation of the original, and from folks who have heard the now vanished song, it was not that at all:

“There Is a Policeman in All Our Heads, He Must Be Destroyed” starts off sounding like a straightforward cover of The Cars’ “Just What I Needed”, but Toledo superimposes a different vocal melody on the intro to create what is essentially a brand-new song. Later, in the outro, he returns to the Cars song and adopts Ric Ocasek’s original vocal melody. The end result is strange and delightful — a kind of cover-within-a-song that plays around with expectations and comes across as entirely original.

From that, it certainly sounds like it was not "a sample" as many reporters are claiming, but rather just a transformative work paying homage to The Cars' original. And, as such, you'd think that there would be a very strong fair use argument. But, fair use and music remains a tricky minefield with no clear rules, and I can see why Toledo and Matador wouldn't want to spend time and money in court defending this, especially given that a positive result is no sure thing.

Still, for people who love music, this seems like a somewhat horrific result. Yes, Toledo is cheerful about the whole thing and insists that the revised work is a better track, but this is yet another example of copyright being used to literally destroy a piece of culture. And I think we should find that revolting. As the folks at Consequence of Sound, who heard the track, noted in their story on this:

The biggest bummer is that the listening public may never get to hear “There Is a Policeman in All Our Heads, He Must Be Destroyed”

I'm guessing that sooner or later (or perhaps already?) some version of this track will leak out and become available, because this is the internet. But it's still disappointing that Ocasek is using copyright as an effective veto on someone else's creativity.

Filed Under: car seat headreast, cars, copyright, covers, fair use, music, ric ocasek, samples, transformative
Companies: matador records

Tesla Fan 'Incivility' Forces Indiana To Back Off Direct Sales Ban... For Now

from the lessons-never-learned dept

We recently noted how Indiana was just the latest state to try and pass auto industry-backed bills banning Tesla's direct-to-consumer sales model. Under the latest GM-backed bill, Tesla's dealer license would have expired in 2018, forcing the company to embrace the traditional franchise dealership model -- or stop selling cars in the state entirely. Telsa had been reaching out for the last few weeks to Tesla fans in the state, quite-correctly highlighting how GM was buying protectionist law instead of competing.

Apparently the public attention worked, as the Indiana Senate Commerce and Technology Committee has tabled the bill for the time being, meaning Telsa can continue operating its showroom in the state -- at least until the bill is reconsidered next year. Amusingly, one of the bill's key supporters, Senator Jim Buck, says he received some "incivility" from Tesla fans because of his proposal:

Buck on Thursday opened the committee hearing by saying he has been on the receiving end of "incivility" from Tesla supporters this week, as the bill received national attention. Buck and the bill's author, Rep. Kevin Mahan, R-Hartford City, agreed to put the issue before a study committee. ​That means the legislature won't consider a ban on direct auto sales until at least next year. "We are trying to make what we are doing here fair to all," Buck said.

Right, what Buck experienced wasn't incivility (though I'm sure the e-mails weren't particularly nice), it was the public telling Buck clearly to stop being a protectionist jackass willing to shovel forth horrible legislation at the behest of legacy industry lobbyists. While Buck's at it, he may want to avoid adding insult to injury by trying to falsely equate protectionist cronyism with "fairness." Telsa has made it pretty clear that GM's bill is predominantly aimed at lessening the competitive threat faced by its upcoming electric car, the Chevy Volt:

"General Motors is trying to kick us out of the state for purely competitive reasons," said Todd Maron, general counsel for Tesla. "Their Chevy Bolt will be competing against our mass-market car, so they have timed this bill specifically so once we start selling the Model 3 against their Bolt, we can no longer sell in the state."

That this kind of nonsense persists in state after state says volumes of the integrity of the state legislative process, and the politicians that pay endless lip service to competition and innovation, yet do their best to hamper it if the price is right. Again, if you're a politician looking to avoid public "incivility," one easy way to accomplish this is to stop letting legacy industries write shitty state law.

Filed Under: car dealerships, cars, competition, indiana, jim buck, kevin mahan
Companies: gm, tesla

If We're Not Careful, Self-Driving Cars Will Be The Cornerstone Of The DRM'd, Surveillance Dystopias Of Tomorrow

from the who-controls-the-code dept

We've talked a lot about the ethical and programming problems currently facing those designing self driving cars. Some are less complicated, such as how to program cars to bend the rules slightly and be more more human like. Others get more complex, including whether or not cars should be programmed to kill the occupant -- if it means saving a school bus full of children (aka the trolley problem). And once automated cars are commonplace, can law enforcement have access to the car's code to automatically pull a driver over? There's an ocean of questions we're not really ready to answer.

But as we accelerate down the evolutionary highway of self-driving technology, the biggest question of all becomes: who gets to control this code? Will the automotive update process be transparent? Will the driver retain the ability to modify their car's code? Will automakers adapt and stop implementing the kind of paper mache level security that has resulted in the endless parade of stories about hacked automobiles it takes five years for automakers to patch?

Trying to force the issue before there's a hacker-induced automotive mass fatality, Ford, GM and Toyota were hit by a class action lawsuit earlier this year claiming the car companies were failing to adequately disclose the problems caused my abysmal auto security:

"Among other things, the lawsuit alleges Toyota, Ford and GM concealed or suppressed material facts concerning the safety, quality and functionality of vehicles equipped with these systems. It charges the companies with fraud, false advertising and violation of consumer protections statutes. Stanley continued, "We shouldn't need to wait for a hacker or terrorist to prove exactly how dangerous this is before requiring car makers to fix the defect. Just as Honda has been forced to recall cars to repair potentially deadly airbags, Toyota, Ford and GM should be required to recall cars with these dangerous electronic systems."

This month a court ruled that yes, we will have to probably wait for someone to die before automakers are held liable for lagging automotive security. The case was ultimately dismissed (pdf), the court ruling that the plaintiffs have yet to prove sufficiently concrete harms, and that potential damage (to the driver and to others) remains speculative. At the pace self-driving and smart car technology is advancing, one gets the sneaking suspicion we won't have long to wait before harms become notably more concrete.

But however complicated these legal, ethical, and technical questions are, they become immeasurably more complicated once you realize that smart cars will ultimately form the backbone of the smart cities of tomorrow, working in concert with city infrastructure to build a living urban organism designed to be as efficient as mathematically possible. As Cory Doctorow noted last week, this makes ensuring code transparency and consumer power more important than ever:

"The major attraction of autonomous vehicles for city planners is the possibility that they’ll reduce the number of cars on the road, by changing the norm from private ownership to a kind of driverless Uber. Uber can even be seen as a dry-run for autonomous, ever-circling, point-to-point fleet vehicles in which humans stand in for the robots to come – just as globalism and competition paved the way for exploitative overseas labour arrangements that in turn led to greater automation and the elimination of workers from many industrial processes.

If Uber is a morally ambiguous proposition now that it’s in the business of exploiting its workforce, that ambiguity will not vanish when the workers go. Your relationship to the car you ride in, but do not own, makes all the problems mentioned even harder. You won’t have the right to change (or even monitor, or certify) the software in an Autonom-uber. It will be designed to let third parties (the fleet’s owner) override it. It may have a user override (Tube trains have passenger-operated emergency brakes), possibly mandated by the insurer, but you can just as easily see how an insurer would prohibit such a thing altogether."

You'd hate to wander too casually into the hyperbole territory traditionally reserved for hysterical Luddites, but there's a laundry list of reasons to be worried about the trajectory of the lowly automobile. If we don't demand code transparency and consumer empowerment in automotive standards now, your car may find itself the cornerstone of a future in which DRM, encryption backdoors, lax security standards, eroded consumer legal rights, insurance companies and government power combine to create a supernova of dystopian dysfunction.

Filed Under: autonomous vehicles, cars, drm, privacy, self-driving cars, surveillance

Self-Driving Cars Have Twice The Accidents, But Only Because Humans Aren't Used To Vehicles Following The Rules

from the I'm-sorry-you-hit-me,-Dave dept

When Google discusses its latest self-driving car statistics (provided monthly at the company's website), the company is quick to highlight that with two million miles of autonomous and manual driving combined, the company's self-driving cars have only been involved in 17 minor accidents, none of them technically the fault of Google. Or, more specifically, these accidents almost always involve Google's cars being rear ended by human drivers. But what Google's updates usually don't discuss is the fact that quite often, self-driving cars are being rear ended because they're being too cautious and not human enough.

And that's proven to be one of the key obstacles in programming self-driving cars: getting them to drive more like flawed humans. That is, occasionally aggressive when necessary, and sometimes flexible when it comes to the rules. That's at least been the finding of the General Motors-Carnegie Mellon Autonomous Driving Collaborative Research Lab, which says getting self-driving cars onto the highway can still be a challenge:

"Last year, Rajkumar offered test drives to members of Congress in his lab’s self-driving Cadillac SRX sport utility vehicle. The Caddy performed perfectly, except when it had to merge onto I-395 South and swing across three lanes of traffic in 150 yards (137 meters) to head toward the Pentagon. The car’s cameras and laser sensors detected traffic in a 360-degree view but didn’t know how to trust that drivers would make room in the ceaseless flow, so the human minder had to take control to complete the maneuver."

And while Google may crow that none of the accidents their cars get into are technically Google's fault, accident rates for self-driving cars are still twice that of traditional vehicles, thanks in part to humans not being used to a vehicle that fully adheres to the rules:

"Turns out, though, their accident rates are twice as high as for regular cars, according to a study by the University of Michigan’s Transportation Research Institute in Ann Arbor, Michigan. Driverless vehicles have never been at fault, the study found: They’re usually hit from behind in slow-speed crashes by inattentive or aggressive humans unaccustomed to machine motorists that always follow the rules and proceed with caution."

But with a sometimes-technophpobic public quick to cry foul over the slightest self-driving car mishap, car programmers are proceeding cautiously when it comes to programming in an extra dose of rush-hour aggression. And regulators are being even more cautious still. California last week proposed new regulations that would require that all self-driving cars have full working human controls and a driver in the driver's seat at all times, ready to take control (which should ultimately do a wonderful job of -- pushing the self-driving car industry to other states like Texas).

The self-driving car future is coming up quickly whether car AI or self-driving auto philosophical dilemmas (should a car be programmed to kill the driver if it will save a dozen school children?) are settled or not. Google and Ford will announce a new joint venture at CES that may accelerate self-driving vehicle construction. And with 33,000 annual fatalities caused by highway-bound humans each year, it still seems likely that, overly-cautious rear enders aside, an automated auto industry will still likely save significant lives over the long haul.

Filed Under: accidents, autonomous vehicles, cars, driving, rules, self driving cars
Companies: google

Driver Leaves Scene Of Accident, Gets Turned In By Her Car

from the prosecution-would-like-to-submit-this-jumble-of-circuits-and-wires-as-Exhibit-A dept

It's no secret today's vehicles collect tons of data. Or, at least, it shouldn't be a secret. It certainly isn't well-known, despite even some of the latest comers to the tech scene -- legislators -- having questioned automakers about their handling of driver data.

More than one insurance company will offer you a discount if you allow them to track your driving habits. Employers have been known to utilize "black boxes" in company vehicles. These days, the tech is rarely even optional, although these "event data recorders" generally only report back to the manufacturers themselves. Consumer-oriented products like OnStar combine vehicle data with GPS location to contact law enforcement/medical personnel if something unexpected happens. Drivers can trigger this voluntarily to seek assistance when stranded on the road because of engine trouble, flat tires, etc.

They can also trigger this involuntarily, as one Florida woman found out.

Police responded to a hit-and-run in the 500 block of Northwest Prima Vista Boulevard on Monday afternoon. The victim, Anna Preston, said she was struck from behind by a black vehicle that took off. Preston was taken to the hospital with back injuries.

Around the same time, police dispatch got an automated call from a vehicle emergency system stating the owner of a Ford vehicle was involved in a crash and to press zero to speak with the occupants of the vehicle.

The owner of the vehicle seemed surprised to be receiving a call from a 911 dispatcher. The driver, Cathy Bernstein, first claimed she hadn't been in an accident. Unfortunately, the call was triggered by her airbag deploying, which can happen without a corresponding impact, but rarely enough that the dispatcher sent police officers to the driver's home following the phone call.

At that point, her story changed.

Police went to Bernsteins's home on Northwest Foxworth Avenue and saw that her vehicle had extensive front-end damage and silver paint from Preston's vehicle on it. Bernstein's airbag had also been deployed.

Police said Bernstein again denied hitting another vehicle, saying she had struck a tree.

From that point, the story gets even better.

It was later discovered that Bernstein had been involved in another accident prior to the one with Preston and was fleeing from that incident.

The whole recording is worth a listen, especially as Bernstein buys time after being blindsided by the unexpected incoming call.

Dispatcher: Are you broke down?
Bernstein: No. Unfortunately [looooooong pause] I'm fine.

[...]


Bernstein: The guy who hit me […] I could not control that.
Dispatcher: So, you HAVE been in an accident.
Bernstein: [pause, then very slowly] No.

In this case, the system worked, although not in the way anyone really expected. Someone who thought they had gotten away with two consecutive hit-and-runs found herself talking to police officers after her car tried to help her out by dialing 911. The onboard system is meant to ensure the safety of the driver. In this case, it was apparently everyone else that needed the protection, but the circuitous route still reached the most desirable conclusion.

Filed Under: accidents, cars, hit and run, internet of things

Connecticut Police Announce Plan To Open Unlocked Vehicles And Seize Valuables

from the WE-CARE-BECAUSE-YOU-DON'T dept

No criminal activity. No suspicion of wrongdoing. Just cops wandering around, opening car doors and seizing valuables. But they're doing it for YOU.

Officers in East Rock (CT) are starting a pilot program.

“Cars will be checked for visible valuables,” said New Haven City Spokesperson Laurence Grotheer.

If they see a valuable Grotheer says they’ll take it if your car doors are unlocked. They’ll leave a note and you can pick it up at the police station property room.

Arguably, residents will be better off having their valuables stolen by the police rather than by criminals. But what gives cops the right to enter vehicles and take stuff? The city's spokesperson says it's built right into warrant exception statutes.

Grotheer says there’s a *caretaker* provision in state law that allows them to do it.

“There is an exemption in standard search warrant provisions to allow for this caretaker action,” said Grotheer.

Except that's not really what the "caretaker" provision is for. Generally, it's used to allow officers to approach and question motorists who appear to be in distress or enter homes in cases of medical emergencies, etc. What it's not there for is the seizure of valuables under the assumption that someone's poor personal decision may result in criminal activity at some undetermined point in the future.

What the exception does do is wholly separate police searches and seizures from law enforcement purposes.

Community Caretaker Function: The Courts have created a Caretaker exception under which local police officers are charged with community caretaking functions, totally divorced from the detection, investigation, or acquisition of evidence relating to violation of any criminal statute An example is checking on motorists parked in rest areas, especially in winter, or opening an unlocked door of a parked vehicle when the officer is acting out of concern for the well-being of the person inside.

This removes pesky roadblocks like "reasonable suspicion" and "probable cause." That's why it's routinely abused to perform warrantless searches. Several court decisions related to "community caretaking" exceptions can be found at the indispensable FourthAmendment.com.

State v. Matalonis

Even if we had determined that the police were exercising a bona fide community caretaker function when they searched Matalonis’s residence, the entry would not fall within the community caretaker exception because it fails under the third inquiry–“whether the public interest outweighs the intrusion upon the privacy of the individual such that the community caretaker function was reasonably exercised within the context of a home.”

State v. Garrison

Warrantless entry into defendant’s car at the scene of a three vehicle accident, when she was being attended to by paramedics to see if she was alright, was not legally sustainable entry under the community caretaking function because she was still there and conversing with EMTs. The officer never asked for consent to look for the papers; he just went into the car.

State v. Graham

A couple kissing in a car is not particularized suspicion that a crime is occurring or about to occur. Instead of “moving them along,” the officer detained them, and the detention was unlawful. The state’s community caretaking justification for rousting them also failed.

But as there is no clear delineation of what does or doesn't fall under the "community caretaking" warrant exception, searches and seizures are handled on a case-by-case (and state-by-state) basis when challenged in court by criminal defendants or plaintiffs in civil rights lawsuits. So, when the city's spokesperson says the following, it's unfortunately very true.

Grotheer says all laws are open to interpretation.

And most interpretations will favor law enforcement, who have a multitude of exceptions, including the incredibly expansive "good faith" exception, to insulate them against allegations of misusing their power.

The program raises several questions, most of which will remain unanswered as the New Haven police have chosen to speak solely through the city's spokesperson.

First: Do the searches only implicate valuables visible through windows? Or are officers digging around in vehicles like the thieves they're "saving" citizens from, reaching under seats, opening storage consoles or peeking in the glove compartment?

Second: If the police are simply emulating thieves, would this supposed "community caretaking" function allow them to seize vehicles if ignition keys are present in unlocked automobiles? If not, WHY NOT?

Third: What does the department define as a "valuable" for the purposes of its warrantless entry into unlocked vehicles? Is it simply wallets, checkbooks, credit cards or electronic devices? Or does it cover anything someone could conceivably take, like clothing, groceries or anything else that might be found in plain sight?

Fourth: Would this same exception allow officers to check for unlocked house doors and remove valuables from residences? Would this also allow the fire department to enter unlocked homes if a firefighter spotted oily rags or frayed cords or whatever through an open window?

As long as the city is going to "interpret" this exception to enter vehicles and seize valuables, it should at least maintain its consistency across all other areas. Crossing into a person's home generally raises Fourth Amendment issues faster than unlocked vehicles on public streets, but considering the exception cited by the city is more frequently used to provide warrantless access to residences, it would only make sense for cops to go door-to-door to save citizens from their own careless actions.

I have reached out to both the city and police department for more clarification but I'm not expecting any answers. My guess is this program will be shut down sometime in the next few days. The city has hugely miscalculated the public's receptiveness to its warrantless search and seizure "public service." When it does get shut down, it will likely be accompanied by complaints about the public's lack of gratitude towards its ever-vigilant public servants. But like so many other ill-conceived efforts made on the "behalf" of the public, it appears to have been done without any consideration of the public's concerns.

UPDATE: No answers to the questions, but city spokesperson Laurence Grotheer informs me the program is now officially dead.

Thank you for reaching out about this…

After unanticipated press coverage sufficiently raised community awareness about this issue, NHPD plans for this initiative have been shelved…

Thanks again…

Laurence…

Yeah, it sucks when the people find out about the things the government plans to do to them for their own safety. The wording of Grotheer's statement is very peculiar. He obviously supported the program during earlier statements to the same press he didn't anticipate would turn it into a "thing," but trots out the phrase "community awareness" as though he's never used it in this context before. "Community awareness" is always a good thing (and should precede implementation of dubious programs rather than follow behind it) but in this bizarre sentence, it's almost portrayed as the unfortunate byproduct of an apparent press ambush.

Filed Under: cars, connecticut, east rock, police, unlocked cars, valuables, warrants

Library Of Congress Releases DMCA Anti-Circumvention Exemptions... And It's A Hot Mess

from the because-of-course dept

Well, the Library of Congress has now released its official exemptions to the DMCA's 1201 anti-circumvention rules, the ridiculous process known as the triennial review, and as was pretty much expected, it's a total mess. We'll have a more thorough look at it later, but after an initial read through of the document, it appears that the Library of Congress tried to please everyone and will likely end up pleasing no one. If you're unfamiliar with the process, under the DMCA, there's a part of the law, section 1201, which says that it's copyright infringement to bypass any kind of "technological protection method" (TPM) to access something, even if the reason you're circumventing the TPM is totally non-infringing. Basically, this says that if you put a digital lock on something, even if the lock is weak or stupid or for something totally unrelated to copyright law (such as blocking competition), you can use copyright law to stop anyone from getting around it. The concept is so stupid and so broad that even Congress realized it would be abused. But rather than fix it, it gave the Library of Congress this weird authorization to declare "exemptions" once every three years. So, basically, every three years people ask for exemptions (and each exemption granted in the past needs to be re-requested, and re-supported every three years). Then the Library of Congress climbs a mountain, thinks on it for a bit, and comes down the mountain declaring what is legal and what is not. It's an insane process.

Three years ago, things went really haywire when the Library of Congress took away the exemption it had previously granted for cell phone unlocking. This resulted in widespread protests, and eventually Congress stepping in with a bill that didn't actually fix the underlying problem, but just reinstated the previous exemption and told the Library of Congress to be more careful next time.

You can see in the latest exemptions that the Library of Congress has taken Congress's mocking a bit to heart -- as it seems totally gun shy on just about everything. It refers repeatedly to Congress's decision to bring back the unlocking exemption and reads more into it than is necessary. But, because of this, it seems to want to tiptoe down the line, allowing exemptions, but putting all sorts of weird restrictions on them. For example, one of the most talked about requests was the one for accessing vehicle diagnostics. You may recall that GM, John Deere and even the EPA said the Library should reject these requests, because people might get access to diagnostic info... and then break emissions controls and pollute the environment or something. Apparently, only the automakers should be allowed to do that by themselves.

Here, the Library of Congress sort of grants that exemption, but with all sorts of caveats:

Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.

Even more bizarre, in the description about this exemption, it appears to say that this exemption can only be used if you are doing the circumvention yourself -- and not for hiring someone to do it for you. Absolutely ridiculously, it points to the language of the bill Congress passed to smack the Library around last time on the phone unlocking exemption:

Moreover, by passing the Unlocking Act—which amended section 1201 to allow unlocking of cellphones and other devices to be carried out by third parties “at the direction of” device owners—Congress indicated its view that extending the reach of an exemption to cover third-party actors requires a legislative amendment.

Wha....? In the fight over the Unlocking Act, there was serious concern that early drafts of the bill would cut out companies that help individuals unlock their phones. And thus to make sure that such things weren't excluded, Congress made it explicit that it covered third parties unlocking phones "at the direction of" device owners. And yet... now the Library of Congress is ridiculously interpreting this to mean that it cannot grant such an exemption without Congress stepping in.

That's... wrong. And ridiculous.

And that's not the only problem with this. The one year delay in implementation is ridiculous as well. The Library of Congress notes that this is to allow other agencies to weigh in, but we just had a whole year for agencies to weigh in and many of them did. Yet, now, they want to delay the implementation of a three year exemption by one whole year in case more of them want to weigh in after the fact? Clearly this is because the Library of Congress is gunshy about what happened with unlocking last year, but to totally upend the process and delay a necessary exemption is no way to do that.

Similarly bizarre: the Library of Congress seemed to think it's perfectly fine to weigh outside factors in determining this issue, even though it's supposed to be judging things entirely based on the copyright issues. So, for example, with this same exemption on car repair and diagnostics, it allows the Copyright Office to review copyright-related factors, but then seemed to indicate that it was just fine for it to also review things that have nothing to do with copyright. It notes that "serious safety and environmental issues... weigh against an exemption." But that's not a copyright issue. We should not be using copyright law to regulate other things. We already have safety and environmental laws, and the Copyright Office explicitly endorsing the use of copyright laws to add some sort of additional environmental law (especially one that gets it so backwards) is patently ridiculous.

There are other problems in the rules as well. Michael Weinberg takes a look at the similarly problematic rules on 3D printing, where the same basic thing happened. The overall rule seems like it's going in the right direction, but is so full of weird and unnecessary and troubling caveats that it mostly erases the good parts of the rule.

There are similar issues in other parts as well. For example, an exemption is added for MOOCs (Massive Open Online Courses) that want to use small snippets of locked up content (usually movies or news clips) as part of their classes: classic fair use. And the Library of Congress says that's okay... kind of. It only applies to "accredited nonprofit educational institutions." That sounds reasonable at first, until you realize that many MOOCs are actually run through for-profit entities. For example, Coursera is one of the most popular MOOC platforms out there, but is a for-profit venture. So, the exemption here wouldn't be usable by National Geographic, who runs its MOOC via Coursera. And there are lots of others who would be similarly blocked, even if the use is clearly fair use. (Update: Actually, it appears this would be allowed).

It really seems like the Library of Congress has made things increasingly more complex for the sake of trying to "split the baby" on things, and in part because it got slapped down so hard three years ago. But the end result is that you get a split baby that seems to go way beyond what the law was intended to allow and pisses off everyone (especially the baby). Laura Quilter, the Copyright and Information Policy Librarian at UMass Amherst summarized the mess of these rules this way:

The prolixity of this rulemaking puts it into its own special hell of inaccessible, unintelligible, crazy-making meshugaas.

This isn't how law should be made, and it's unclear why this is still allowed.

Filed Under: 1201, 3d printing, anti-circumvention, cars, copyright office, diagnostics, dmca 1201, dmca triennial review, epa, fair use, library of congress, repair, software, triennial review

Auto Industry's Own Study Demolishes Case For Car Safety Harmonization In TAFTA/TTIP

from the putting-lives-in-danger dept

Back in February, we suggested that TAFTA/TTIP should really be called the "Atlantic Car Trade Agreement," or ACTA for short, since nearly 50% of the claimed boost to transatlantic trade that would accrue from TTIP consists of swapping vehicles between the US and EU. The claim was that, since cars made in the US and EU were equally safe, there was no good reason why they could not be sold on both sides of the Atlantic. According to an important article in The Independent, proponents of this view were so confident that US and EU safety standards were broadly similar that they commissioned a report to prove it, with the aim of using it to bolster the case for harmonizing car safety standards in TAFTA/TTIP:

The Washington-based Alliance of Automobile Manufacturers (AAM) sponsored the research, announced in a joint press release last year alongside the European car lobby ACEA and the American Automotive Policy Council.

So that there could be no question about the validity of the results, they asked some of the world's top people in the field to participate:

Independent experts from the University of Michigan Transportation Research Institute and the SAFER transportation research centre at Chalmers University of Technology in Gothenburg, Sweden, carried out the study. They are two of the leading traffic safety research centres in the world. Experts in France and at the UK’s Transport Research Laboratory were also involved.

Here's what the industry's report found:

The research actually established that American models are much less safe when it comes to front-side collisions, a common cause of accidents that often result in serious injuries.

The following is no surprise, then:

The findings were never submitted -- or publicly announced -- by the industry bodies that funded the study.

Putting a brave face on things, a spokesperson for the US Alliance of Automobile Manufacturers told The Independent:

"There is much credit to be given for the historic efforts made in this study, and we fully support the methodology for comparing and analyzing U.S. and EU crash environments and vehicle performance. "

While the European car manufacturers association said:

"ACEA remains confident that regulatory convergence can be achieved in TTIP while maintaining the current high level of safety performance in both the EU and the US"

But the European Transport Safety Council (ETSC), the independent organization that advises the European Commission and the European Parliament on road safety, is not so sure. Its executive director, Antonio Avenoso, is quoted as saying:

"This study shows that EU and US trade negotiators would potentially be putting lives in danger by allowing vehicles approved in the US to be sold today in Europe and vice-versa. … Clearly without much more research and analysis, including vehicle safety standards in the TTIP agreement would be irresponsible."

The trouble is, if car safety standard harmonization is not included in TTIP, there won't be the big boost to trade that is predicted to come from increased transatlantic vehicle sales. And without that big boost, TAFTA/TTIP's benefits, never very big in the first place, become even more negligible. Sounds like it's time to slam the brakes on ACTA….

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: automobiles, cars, eu, international agreements, safety standards, tafta, trade, trade agreements, ttip, us

Malaysia To Introduce RFID Tracking For Every Vehicle

from the what-could-possibly-go-wrong? dept

Here on Techdirt, nationwide tracking schemes tend to raise a red flag. In Malaysia, by contrast, there seem to be no such worries, as ambitious plans to introduce RFID tagging for all vehicles, reported by The Sun Daily, indicate:

A new vehicle security tracking system suitable for all types of vehicles -- the Radio Frequency Identification (RFID) -- will be implemented nationwide by the Road Transport Department (JPJ) by 2018.

According to the article, there are plenty of advantages of doing so:

This new system will enable the police and other authorities to effectively track down criminals

And:

the RFID technology will herald a new era for vehicle security in Malaysia and it could be the answer to combat vehicle theft and cloned vehicle syndicates.

Moreover:

the RFID can also be used to provide real-time monitoring on road traffic situation.

And if you're worried that ne'er-do-wells might seek to avoid being tracked simply by ripping off said RFID tags, fear not, Malaysia has that covered:

theSun understands that the RFID tag is designed to shatter should any one attempt to tamper with it and can transmit a warning to the JPJ and police, should any one try to remove the sticker.

Sounds pretty foolproof. So why aren't other countries rushing to adopt this approach?

Interestingly, RFID technology has been criticised in many countries for its effectiveness to track vehicles movement and citizens. It has been widely accused for invasion of privacy in Belgium, Italy, UK and US.

I just can't imagine why.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cars, driving, malaysia, privacy, rfid, surveillance, tracking