Despite Recent Court Rulings, Getting Behind The Wheel Is Pretty Much Kissing Your 4th Amendment Protections Goodbye

from the cars-are-for-criminals,-apparently dept

There's been more good news than bad concerning the Fourth Amendment recently. In addition to the Supreme Court's ruling that searches of cellphones incident to arrest now require a warrant, various circuit court decisions on cell site location info and the surreptitious use of GPS tracking devices may see the nation's top court addressing these contentious issues in the near future. (The latter still needs to be addressed more fully than the Supreme Court's 2012 punt on the issue.)

Generally speaking, the Fourth Amendment has been at least partially restored, much of it due to the courts being more willing to address the implications of technological advances and the bearing these have on the expectation of privacy.

But one area -- pertaining to technology dating back over 100 years and used by millions on a daily basis -- remains under-served: vehicles. As we've discussed before, the "motor vehicle exception" allows law enforcement to search an entire vehicle, along with its contents, without a warrant, provided they have probable cause to suspect contraband is hidden in it. An outright refusal to allow a search may result in the securing of a warrant, but the law is riddled with so many law enforcement-friendly exceptions that the use of a warrant is the exception, rather than the rule.

This is a small part of a larger problem. While the Supreme Court did declare that law enforcement officers weren't allowed to artificially prolong routine traffic stops in order to perform further queries/searches, it also wrote them a blank check for abuse with the Heien decision.

Drivers need to be on top of traffic laws, but cops don't.

As the text indicates and we have repeatedly affirmed, “the ultimate touchstone of the Fourth Amendment is ‘reasonableness.’” Riley v. California, 573 U. S. ___, ___ (2014)…To be reasonable is not to be perfect, and so the Fourth Amendment allows for some mistakes on the part of government officials, giving them “fair leeway for enforcing the law in the community’s protection.”

This meshes with the "good faith exception," another out for police officers that ignore the Fourth Amendment. Cops can basically stop your for any reason and use that stop to fish for additional criminal charges. They have to be a bit quicker about it, thanks to the Rodriguez decision. But they won't have to be any better at their jobs and they are not expected to know the laws they're enforcing.

Ken Armstrong at Vice has a long rundown of cases where results of searches related to traffic stops were suppressed due to officers' ignorance of the law but later reinstated to legitimacy by the Heien decision. Here's one of them:

When a police officer in the Village of East Troy (4,281 residents, 18 miles of roadways, 500 manholes, according to its quarterly newsletter) pulled over Richard Houghton's blue Ford Taurus, the officer was ignorant of the law in at least two ways. He thought the car needed a front license plate (in this case, it didn't), and he thought the car's air freshener was illegal, believing any object dangling from a rear-view mirror automatically violated the state's law on obstructing a driver's view (not so). Nonetheless, the Wisconsin Supreme Court decided that the marijuana and drug paraphernalia found in the officer's subsequent search of the car would not be thrown out. Just one year after it had ruled the opposite in another case, the court decided that in light of Heien, mistakes of law by police could now be forgiven, if reasonable.

Notably, automobile air fresheners are one of law enforcement's favorite "reasonable suspicion" indicators. The only reason for anyone to have a prominently-displayed air freshener (or multiple fresheners) is to cover up the smell of illicit drugs. Not every court has bought this theory, but enough have been willing to consider this -- along with other questionable "suspicious" actions like being nervous, talking too fast, talking to slow, making eye contact, not making eye contact, etc. -- as part of the constructed totality of reasonable suspicion.

Once an officer has this, he can quickly convert it to probable cause. With reasonable suspicion, an officer can often bring in a drug-sniffing dog -- the search that isn't a search -- to obtain the probable cause for a complete roadside search.

But drug dogs are no more reliable than the average police officer's command of traffic laws. A recent Seventh Circuit Appeals Court decision affirming the conviction of a man found with 15 kilos of cocaine in his vehicle took a bit of time to question the reliability of Lex, the drug dog that alerted prior to the search of the suspect's vehicle.

In Larry Bentley’s case, a police officer initiated a traffic stop after observing Bentley’s vehicle cross into another lane on an Illinois highway without signaling. After stopping Bentley, the officer decided to call for a drug-detection dog named Lex. Once on the scene, Lex alerted, and the officers found close to 15 kilograms of cocaine in the vehicle.

But what if Lex alerts every time he is called upon? The fact that drugs are (or are not) found would have nothing to do with his behavior. That, in essence, is what Bentley is arguing here. The evidence Bentley was able to gather suggests that Lex is lucky the Canine Training Institute doesn’t calculate class rank. If it did, Lex would have been at the bottom of his class.

The ruling contains some very damning details about Lex, who alerts so often he should just be renamed "Probable Cause."

In pressing his challenge to the dog’s alert, Bentley makes two principal points. First, he contends that Lex’s past performance in the field suggests he is particularly prone to false positives (i.e., signaling to his handler that there are drugs in a vehicle when there are not). He has a point. Lex alerts 93% of the time he is called to do an openair sniff of a vehicle, and Lex’s overall accuracy rate in the field (i.e., the number of times he alerts and his human handler finds drugs) is not much better than a coin flip (59.5%).

This dog is a coin flip for contraband. But he's great at "authorizing" a warrantless search. He's a police officer's best friend -- especially those that hope to turn minor traffic violations into something worth the paperwork. If an officer requested Lex, more than 9 times out of 10, he got to search the vehicle.

Unfortunately for Bentley and countless other citizens, the fallibility of drug-sniffing dogs isn't anything they can use in their defense. From the Supreme Court on down through the various circuits, judges are waking up to the fact that drug dogs are more interested in pleasing their handlers than being an objective investigatory method (as is to be expected from nearly any domesticated animal), but more often than not, will side with law enforcement on drug dog "alerts."

Bentley rightly points out that Lex is smart. Shively testified that he rewards Lex every time the dog alerts in the field. Presumably the dog knows he will get a “giftee” (a rubber hose stuffed with a sock) every time he alerts. If Lex is motivated by the reward (behavior one would expect from any dog), he should alert every time. This giftee policy seems like a terrible way to promote accurate detection on the part of a service animal, lending credence to Bentley’s argument that Lex’s alert is more of a pretext for a search than an objective basis for probable cause.

But despite seeing the conflict here, the court finds that Lex is still a good dog yes he is, and the permission he granted the officers to perform a more intrusive search is probably probable cause -- or close enough to it that the other exceptions (good faith, etc.) swallow up Bentley's protests to the contrary.

Nevertheless, in light of the Supreme Court’s decision in Florida v. Harris, 133 S. Ct. 1050 (2013), which addressed the use of drug-detection dogs, we conclude that the district judge did not err when he decided that Lex’s alert, along with the other evidence relating to the stop, was sufficient to support probable cause. Bentley’s other two challenges based on the traffic stop and his alleged lack of knowledge of the cocaine in the vehicle also fail. We thus affirm his conviction.

Combining drug dogs, Heien, Rodriguez, the "motor vehicle" and "good faith" exceptions, and you have a significant gap in Fourth Amendment coverage. Get in a car and kiss most of it goodbye. A cop can pull you over for nearly any reason and use this pretense to perform a dog-and-officer act that almost guarantees the generation of "probable cause." Once this is achieved, everything in the car is subject to the search. If it isn't (like a cellphone or a GPS system), this won't be worked out until the arrestee is granted the chance to move to suppress evidence. There's no stopping the search. There's only the much smaller chance (at least compared to Lex's magic nose) that the evidence will be tossed, along with the charges.

The only thing standing in the way of this abuse is the vague stopwatch of Rodriguez. Officers can't artificially extend stops past the point that the objective has been achieved (ticket/warning issued). But there's no specific time limit for officers to reach this concluding point, which means this will be adjudicated on a case-by-case basis.

If this is the only limitation, the Fourth Amendment means next to nothing if a citizen is behind the wheel. Not only is the Fourth Amendment supposed to protect against illegal searches, it's also supposed to prevent illegal seizures. And in the definition of this amendment, a seizure includes the sort of detainment a traffic stop is.

A seizure of a person, within the meaning of the Fourth Amendment, occurs when the police's conduct would communicate to a reasonable person, taking into account the circumstances surrounding the encounter, that the person is not free to ignore the police presence and leave at his will.

Heien allows the seizure to take place, completely without justification. Everything else allows this seizure to be refashioned into something far beyond a ticket for a broken taillight or "crossing a lane divider without signalling." Technically, a citizen should be free to leave once a ticket/warning is in their hands. But how many will when the officer is still leaning in the window, asking questions unrelated to the traffic stop? Roughly zero. Any person who starts moving a vehicle before an officer returns to their own risks being nailed with additional charges/bullets/etc.

The legal interpretation is the ideal. The real world interpretation is nothing like it. A court may feel a traffic stop was over at point X, but the person whose vehicle was tossed after a drug dog appeared "alerted," signaled his or her "consent" to the search by not stomping on the gas pedal the moment the officer handed over the citation.

Because of everything tied into the vehicle nexus, people are being subjected to Fourth Amendment-violating searches and seizures every day. Legal precedent puts the odds in law enforcement's favor. And what's the worse that happens to cops who violate the Fourth Amendment? They lose a bust or two. But there's millions of drivers on the road. They can always find more people to arrest. And they can start this chain of events by citing laws that don't exist and further the intrusion by bringing in a four-legged cop to give them the permission to override a citizen's refusal to allow a search.

So, while it is heartening to see more court decisions tackling technology in a more logical fashion, something that's been with us for more than 100 years remains a legal blind spot.

Filed Under: 4th amendment, cars, driving

Newsflash: Car Network Security Is Still A Horrible, Very Dangerous Joke

from the I'm-sorry-I-can't-do-that,-Dave dept

As we've noted for years, the security on most "smart" or "connected" cars is aggressively atrocious. And in fact it's getting worse. As car infotainment systems get more elaborate, and wireless carriers increasingly push users to add their cellular-connected car to shared data plans, the security of these platforms has sometimes been an afterthought. Hackers this week once again made that perfectly clear after they demonstrated to a Wired reporter that they were able to manipulate and disable a new Jeep Cherokee running Fiat Chrysler's UConnect platform. While the reporter was driving it:

As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That’s when they cut the transmission. Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.

Uconnect utilizes Sprint's cellular network, and hacker/researchers Charlie Miller and Chris Valasek were able to pwn manipulate nearly everything about the vehicle with a laptop in a house ten miles away. All thanks to one, unspecified vulnerability:

From that entry point, Miller and Valasek’s attack pivots to an adjacent chip in the car’s head unit—the hardware for its entertainment system—silently rewriting the chip’s firmware to plant their code. That rewritten firmware is capable of sending commands through the car’s internal computer network, known as a CAN bus, to its physical components like the engine and wheels.

The two used to have to physically modify cars to get access to these systems, but as vehicles have gone cellular, it has opened the door to a world of new exploits. And if you've ever experienced the incomprehensibly-clunky in-car GUI of most in-car infotainment platforms, rest assured that the quality of the system's security is usually in the same ballpark. Miller and Valasek will publish a portion of their exploit online during a presentation at the Black Hat security conference in Las Vegas next month.

The exploit appears to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. Chrysler/Fiat posted a notice to its website last week informing users that they need to update their in-car software either via USB stick (you can download the update here) or by taking it in to a dealer. Of course like many patches, most users won't be paying much attention to the warning. And we're only talking about Chrysler's UConnect; there's a bounty of half-assed security measures implemented in infotainment systems from automakers worldwide just waiting to be tinkered with by pranksters (or worse).

Of course cars aren't the only tech sector where security has failed to keep pace with ambition. "Smart" TVs have been shown to have similarly awful security, often sharing unencrypted user info (even conversations) with any hacker with a modicum of talent. In the rush to embrace the gee whizzery of the "Internet of things," there are more than a few companies that apparently forgot to bring security and intelligence along for the ride.

Filed Under: cars, connected cars, hacking, privacy, security

Breaking: Self-Driving Cars Avoid Accident, Do Exactly What They Were Programmed To Do

from the I-can-and-will-do-that,-Dave dept

We just got done talking about how, after logging 1,011,338 autonomous miles since 2009, Google's automated cars have had just thirteen accidents -- none of which were the fault of the Google vehicles. By and large the technology appears to be working incredibly well, with most of the accidents the fault of inattentive human drivers rear-ending Google's specially-equipped Lexus SUVs at stop lights. But apparently, the fact that this technology is working well isn't quite interesting enough for the nation's technology press.

A Reuters report making the rounds earlier today proclaimed that two self-driving cars from Google and Delphi Automotive almost got into an accident this week in California. According to the Reuters report, Google's self-driving Lexus "cut off" Delphi's self-driving Audi, forcing the Audi to take "appropriate action." This apparently got the nation's technology media in a bit of a heated lather, with countless headlines detailing the "almost crash." The Washington Post was even quick to inform readers that the almost-crash "is now raising concerns over the technology."

Except it's not. Because not only did the cars not crash, it apparently wasn't even a close call. Both Delphi and Google spokespeople told Ars Technica that both cars did exactly what they were programmed to do and Reuters apparently made an automated mountain out of a molehill:

"I was there for the discussion with Reuters about automated vehicles," she told Ars by e-mail. "The story was taken completely out of context when describing a type of complex driving scenario that can occur in the real world. Our expert provided an example of a lane change scenario that our car recently experienced which, coincidentally, was with one of the Google cars also on the road at that time. It wasn’t a 'near miss' as described in the Reuters story."

Instead, she explained how this was a normal scenario, and the Delphi car performed admirably.

"Our car did exactly what it was supposed to," she wrote. "Our car saw the Google car move into the same lane as our car was planning to move into, but upon detecting that the lane was no longer open it decided to terminate the move and wait until it was clear again."

In other words, As Twitter's Nu Wexler observed, the two cars did exactly what they were programmed to do, though that's obviously a notably less sexy story than Reuters' apparently hallucinated tale of automated automotive incompetence.

Breaking: Self-driving cars avoid accident, doing exactly what they are programmed to do

— Nu Wexler (@wexler) June 26, 2015

Filed Under: accidents, autonomous vehicles, cars, driving, near miss, self-driving
Companies: delphi, google

FTC Smacks Down Michigan For Trying To Ban Tesla Sales: Didn't We Already Warn You About This?

from the go-go-ftc dept

A little over a year ago, we noted how nice (if somewhat surprising) it was to see the FTC take a stand for Tesla and its direct sales model. Just as states -- generally under pressure from auto dealers who hate competing with Tesla -- were starting to explore laws to ban Tesla from those states, the FTC noted that it felt many of these plans were designed to hold back competition and innovation and it was prepared to step in. A year ago, it said things like this:

Removing these regulatory impediments may be essential to allow consumers access to new ways of shopping that have become available in many other industries.

Shots fired. In response to this (and public outcry), New Jersey and some other states appeared to back down. But not Michigan, home to the big US automakers, who aren't at all happy with this new upstart competitor from California. Last fall, Michigan passed a law that made it even more difficult for direct sales like Tesla. The FTC didn't do anything specifically about that (yet), but there's a new bill under discussion in Michigan that would carve out an exception to the new ban on direct sales of vehicles, but just for a new category called "autocycles," such as those from Elio Motors. The FTC used this opportunity to question why there's a ban on direct sales of vehicles in the first place.

In a letter commenting on the Michigan proposal, FTC staff supports the movement to allow for direct sales to consumers—not only Tesla or Elio, but for any company that decides to use that business model to distribute its products. Blanket prohibitions on direct manufacturer sales to consumers are an anomaly within the larger economy. Most manufacturers and suppliers in other industries make decisions about how to design their distribution systems based on their own business considerations, responding to consumer demand. Many manufacturers choose some combination of direct sales and sales through independent retailers. Typically, no government intervention is needed to augment or alter these competitive dynamics—the market polices inefficient, unresponsive, or otherwise inadequate distribution practices on its own. If the government does intervene, it should adopt restrictions that are clearly linked to specific policy objectives that the legislature believes warrant deviation from the beneficial pressures of competition, and should be no broader than necessary to achieve those objectives.

Opening the door by a crack is a step in the right direction, and we urge policymakers in Michigan to take this small step. But beyond company-specific fixes lies a much larger issue: who should decide how consumers shop for products they want to buy? Protecting dealers from abuses by manufacturers does not justify a blanket prohibition like that in the current Michigan law, which extends to all vehicle manufacturers, even those like Tesla and Elio who have no interest in entering into a franchise agreement with any dealer.

The full letter is below -- and it does a nice point-by-point debunking of the laughable arguments by those who insist bans on direct sales to consumers are necessary. Here's just a snippet:

Those who support a blanket prohibition on direct manufacturer sales have made a number of arguments that FTC staff find unpersuasive. Perhaps the central concern reflected in the current laws regulating the manufacturer-dealer relationship is that government intervention is required to protect independent dealers from abusive behavior by their suppliers. But a blanket prohibition of direct manufacturer sales is not a narrowly crafted provision to protect franchised dealers from abuse in their franchise relationships. Such a prohibition is categorical, going well beyond the many other statutory provisions that protect dealers from such abuse. It extends to every entity engaged in manufacturing, assembling, or distributing new motor vehicles, even a manufacturer that has never entered into a franchise agreement.

Advocates for existing dealers also argue that manufacturers that sell directly to consumers will not provide them with adequate service. This argument presupposes that automobile manufacturers in a competitive environment will act contrary to their economic self-interest. If consumers greatly value post-sale service and would be unlikely to purchase or recommend any automobile without a reasonable assurance of quality future service, then any manufacturer will have an incentive to supply such service or else see its sales decline to the benefit of its rivals. This competitive pressure is a strong motivation for manufacturers to either provide good service themselves or continue to contract with an independent service provider, such as a dealer, to do so.

Finally, advocates for a categorical ban on direct sales argue that direct-selling manufacturers would charge higher prices to consumers. In their view, consumers benefit from the “intrabrand” competition between dealers of the same brand of vehicle. In other words, rival dealers in the same area that sell the same make and model of car compete for business and competition between them can lower prices for car buyers. Manufacturers, they maintain, would not be subject to the same competitive pressures.

This view is inconsistent with modern economic learning and with the Supreme Court’s widely accepted observation that strong “interbrand” competition—competition between rival manufacturers—can suffice as a source of downward pressure on price. Manufacturers in a competitive market face acute pressure to keep prices low to keep buyers from shifting their purchases to a competing manufacturer’s product. Thus, forcing firms to use inefficient distribution methods can result in higher prices and other forms of consumer harm. As described above, this is not merely a theoretical possibility. Statistical evidence shows that states that have placed strong limitations on gasoline refiners’ ability to operate their own retail outlets tend to have higher prices than those that allow refiners to use whatever combination of dealer and company-operated stations they prefer.

A continuing ban on direct sales by manufacturers perpetuates the current closed system of motor vehicle sales in Michigan. The system limits competition among existing, well-established manufacturers, all of whom must sell through the established network of independent auto dealers. A direct sales ban deters experimentation with new and different methods of sales by current auto manufacturers, and also by future entrants to the market. Michigan’s consumers are paying the price of such a dictate. The essential mechanism that drives markets—the interaction between the supply by manufacturers and the demands of consumers—is being curbed. The market is less responsive to consumer preferences and less innovative in anticipating their evolving needs.

It's nice to see the FTC continuing to monitor this situation and to speak out against clearly anti-competitive moves.

Filed Under: automobiles, cars, direct sales, ftc, michigan
Companies: elio, tesla

Judge Throws Out Lawsuit From Redditor Who Found An FBI Tracking Device On His Car

from the upvote-for-FBI-visit dept

Back in 2010, Redditor Yasir Afifi found an unusual device on his car while taking it in for an oil change.

Other Redditors surmised it was some sort of tracking device -- something that was confirmed a few days later when two SUVs full of cops and FBI agents showed up to reclaim it. While doing so, the FBI agent also asked the sort of probing questions that make the agency an indispensable part of our nation's counterterrorism efforts. From the ruling by Judge Beryl Howell:

The agents also asked the plaintiff other questions, including “whether he was a national security threat, whether he was having financial difficulties, [and] whether he had been to Yemen . . . .”

They also said other, more unsettling things:

After returning the GPS device, defendant Kanaan made several comments to the plaintiff that indicated to the plaintiff that the FBI had knowledge of the plaintiff’s movements, including commenting on certain restaurants at which the plaintiff ate, a friend with whom he associated, and a new job at which he worked. Id. at ¶ 46. At the end of the encounter, the plaintiff alleges that defendant Kanaan suggested to him that he was not a national security threat and that he was no longer of use to the FBI.

Apparently, part of the justification for deploying this tracking device was a comment one of Afifi's friends had left at Reddit -- a comment that skewers a lot of unproductive terrorism hysteria (and the agencies that thrive in this atmosphere).

bombing a mall seems so easy to do. i mean all you really need is a bomb, a regular outfit so you arent the crazy guy in a trench coat trying to blow up a mall and a shopping bag. i mean if terrorism were actually a legitimate threat, think about how many fucking malls would have blown up already.. you can put a bag in a million different places, there would be no way to foresee the next target, and really no way to prevent it unless CTU gets some intel at the last minute in which case every city but LA is fucked...so...yea...now i'm surely bugged : /

End result? A tracking device on Afifi's car, and for something he didn't even write. So, he sued the FBI and the DOJ for violating his First, Fourth and Fifth Amendment rights. The suit was stayed by the court while the Supreme Court sorted out US v. Jones -- a case dealing with warrantless GPS tracking. Unfortunately, the Court returned not much in the way of a decision, stating that GPS tracking did constitute a "search," but didn't go so far as to add a warrant requirement, suggesting the longer the tracking lasts, the worse it is constitutionally.

Whether or not this was warrantless surveillance isn't answered in Howell's decision. None of Afifi's claims survive. Qualified immunity nullifies Afifi's First and Fourth Amendment Bivens claims with an assist from the circuit courts' split on warrantless GPS tracking. As the events in question took place nearly two years ahead of the Supreme Court's decision, Howell defers to the rulings in place at that time (2010) as governing the agents' actions.

[T]he warrantless use of a GPS device was lawful under Ninth Circuit precedent at the time of its use in the present case. In other words, the individual defendants’ warrantless use of the GPS device was valid in California, the jurisdiction in which the individual defendants used the GPS device.

Afifi's First Amendment claim also goes down, seeing as there's no judicial precedent for chilling speech with a GPS tracker.

The plaintiff has failed to cite a single case from any Circuit holding that the warrantless use of a GPS device violates an individual’s First Amendment rights. To be sure, the qualified immunity analysis does not require a “case directly on point,” Al-Kidd, 131 S.Ct. at 2083, but a court must take caution in properly defining the scope of the right violated (“We have repeatedly told courts . . . not to define clearly established law at a high level of generality.”). [...] The plaintiff’s inability to cite a single case in support of his contention that the warrantless use of a GPS device violated his First Amendment rights dooms his claim.

Afifi's claim of Privacy Act violations caused by the FBI's continued retention of his case records after closing the investigation doesn't fare any better. There's plenty of precedent out there stating that relevant investigative records are forever even if the investigation isn't.

In addition, the fact that the investigation into the plaintiff is now closed does not render the records invalid under Section (e)(7). The D.C. Circuit has held that an agency may maintain records from an authorized investigation even after that investigation was closed, because “[m]aterials may continue to be relevant to a law enforcement activity long after a particular investigation undertaken pursuant to that activity has been closed...”

The present case is no different. The records now in the FBI’s possession may permit the FBI to verify or evaluate any new intelligence received, assess the reliability of other sources, and ensure accountability regarding how the FBI responded to the information it received.

Howell also points out that challenges to warrantless searches generally result in suppression of evidence, not nullification of entire investigations. Afifi's claims that he is being locked out by potential employers because of his run-in with the FBI are dismissed as "self-inflicted" -- not because Afifi had the misfortune of being acquainted with a person whose Reddit comment drew FBI heat, but because he "reported his confrontation with the FBI agents to local and national media, and the media published numerous stories about the encounter."

The moral of this tale seems to be that if you discover a tracking device on your vehicle, there's no faster way to be rid of it than posting pictures of it on a heavily-trafficked website. (As opposed to, say, throwing it in a lake, as one commenter suggested.) You may not find relief through the courts, but at least you'll be ensured of some form of closure.

Filed Under: beryl howell, cars, doj, fbi, fifth amendment, first amendment, fourth amendment, gps, privacy, surveillance, tracking, tracking device, yasir afifi

Cars Are Delivering Tons Of Driving Data To Manufacturers With Minimal Security And Even Less Transparency

from the introducing-the-2015-Lexus-CI dept

Nothing's driving the acquisition of data faster than, well, driving. As new technology makes its way into vehicles, so does the apparent desire to harvest information about the vehicle itself. Between the outside harvesting (automatic plate readers that gather plate/location data, as well as photos of vehicle occupants) and the "inside" transmissions, there's very little any number of unknown entities won't know about a person's driving habits. And that's not even including what's transmitted and collected by drivers' omnipresent smartphones and their installed apps.

Sen. Edward Markey has expressed some alarm at the amount of data being collected (and distributed) by vehicle manufacturers. His office has produced a report [pdf link] showing that while many manufacturers are involved in collecting data, very few of them seem concerned about the attendant risks. Even worse, many respondents to his office's questionnaire seem to show very little understanding of the underlying technology and most have not made an effort to fully inform customers as to how much is being collected or how it's being distributed.

Drivers of today's connected cars aren't going to like the report's findings.

Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.

While some basic security measures have been implemented, the fact remains that transmitting data always poses a risk. Three of the 14 manufacturers that responded to Markey's questions had actually let their security measures stagnate or decrease from 2013 to 2014, even as the amount of data transmitted rose. Worse, many of the respondents deployed security measures in a "haphazard and inconsistent" fashion, and nearly all respondents seemed unable to fully process the questions posed by Markey's office.

Of the 16 automobile manufacturers that responded to the letter, 13 of them addressed these questions in some way. Chrysler, Mercedes-Benz, and Mazda did not respond to the question at all, and five other manufacturers provided general responses that addressed the question as a whole instead of providing specific responses to the questions’ sub-parts.

[...]

Seven of the manufacturers stated that they use third-party testing to verify their security measures, while 5 stated that they do not and 4 did not respond to this part of the question.

[...]

The manufacturers were also asked about how they secure this type of software delivery [updates/patches]. Each manufacturer responded with descriptions of how they provide such software through authorized dealers with the appropriate tools. Automobile security experts consulted by Senator Markey’s staff said that all of the responses are similar in that they presume a malicious actor could not access or acquire the technologies that mechanics have. They state that software updates for systems should be cryptographically verified by the ECU being updated in order to effectively prevent intrusions.

These four-wheeled tracking devices are collecting and transmitting tons of data, including GPS location, sudden accelerations/decelerations, seatbelt usage, destinations entered into navigation systems, last location parked, distance and time traveled and a variety of information on other driving components. Almost all of this is transmitted back to the manufacturer for their own use.

Nearly 100% of 2014 vehicles record and transmit driving history. Most of these manufacturers could not provide a satisfactory answer as to how they secure this data during transmission and more than half store this information "off-board" at their own data centers. Manufacturers seem to consider "on-board" collections as inherently secure.

In the case of on-board storage, no manufacturer described any security system to protect that data, and several of them noted that no security measure is needed since accessing data would require a hardwire connection.

But that doesn't mean they treat wireless transmissions with much more care.

Regarding security measures to protect data that is wirelessly transmitted outside the vehicle, only 6 responses were received. Of those, 5 provided vague responses naming encryption, passwords, or general IT security practices, and only 1 specifically mentioned that they designed their systems to limit the transfer of personally identifiable information.

Part of this is due to the fact that automakers' security measures are purely voluntariy at this point. But the fact that it would likely take a federal mandate to improve security is disappointing. Not only are manufacturers less than forthcoming about how much data they're collecting, but they're apparently uninterested in providing a minimal level of customer service, i.e., proactively assuring these data transmissions are secure.

As for the data harvesting itself, manufacturers can't seem to find a better justification for this than "improving the customer experience" -- a phrase pretty much synonymous with "selling customers more stuff" or "collecting for collecting's sake." Most manufacturers retain this data for one to ten years, with only one manufacturer offering the option for users to delete their data at any time. But that single nod to customer agency is far outweighed by the general indifference shown by the rest.

Markey's report finds that purchasers may be allowed to "opt out" of certain collections, but this often comes at the expense of certain functions. No manufacturer presents this information up front, preferring to hide it in owner's manuals and terms of service agreements. The default should be "opt-in," with upfront explanations of what, how and why data is collected. But that would lead to a dearth of information, and automakers, like many other private companies, prefer to gather data first and deal with the fallout later.

Although it goes unmentioned in Markey's report, there's also the question of how this data is handled when the government comes looking for it. Most of what's collected would presumably fall under the Third Party Doctrine (with drivers "knowingly" turning this information over because of page 173 in the owner's manual, etc.), which means it can be acquired by law enforcement/intelligence agencies with minimal effort/paperwork. There are also other government intrusions that need to be considered as well, like California's desire to tie state-enforced emission standards to driving information already gathered by a number of manufacturers. Not only are manufacturers not guarding against having their collections hijacked by criminals, they seem equally unconcerned about safeguarding this vast amount of data from the government itself.

Filed Under: cars, data, privacy, smart cars, transparency

Why We Should Rename TAFTA/TTIP As The 'Atlantic Car Trade Agreement'

from the we-could-call-it-'ACTA' dept

When TAFTA/TTIP was first announced, David Cameron said it would "have a greater impact than all the other trade deals on the table put together." We were repeatedly assured that it would boost both the US and EU economies significantly. But when people started looking at the European Commission's own projections for TTIP (pdf), they found that the reality wasn't so impressive. Here's the economist Dean Baker, in a post entitled "Why Is It So Acceptable to Lie to Promote Trade Deals?":

The most widely cited projections for the growth impact of the TTIP are from the Centre for Economic Policy Research [CEPR] in London [in a study paid for by the European Commission] which shows the pact leading to an increase in GDP of 0.4 percent in the U.S. when its effects are fully felt in 2027, and 0.5 percent in the European Union. The analysis explicitly says that it will not lead to more jobs since the models are full employment models. It may lead to somewhat higher wages, but it is not a way to employ the unemployed. Furthermore, the discussion notes that in the transition, some workers may end up unemployed as the economies adjust to the new rules.

Implying that a deal that raises GDP by 0.4 or 0.5 percent 13 years out means "job-creating opportunities for workers on both continents" is just dishonest. The increment to annual growth is on the order of 0.03 percentage points. Good luck finding that in the data.

Recognizing that claims of substantial growth don't stand up to scrutiny, boosters of TTIP in Europe have resorted to a fallback technique: anecdote. If you can't prove something is good in general, show that it will be good for someone -- anyone -- and then extrapolate. Of course, that means you need to find an example of an industry that would definitely benefit from a US-EU trade agreement. An EU document on regulatory harmonization (pdf) from September 2013 gave a strong hint of which that might be:

The safety regulations that apply to cars are different in the US and the EU -- even if the end result is comparable levels of safety. In fact, it's already possible to drive some US- approved cars on European roads, under a special European approval system. Through TTIP, the Commission would like regulators to formally recognise that important parts of our two regulatory systems are broadly the same in safety terms.

Later in the same document we read:

Electric cars offer great potential to tackle climate change and pollution while boosting growth. Many companies on both sides of the Atlantic already sell them. Making them practical however will require new infrastructure as well as technologies and standards to ensure they are safe. That is why EU and US regulators and standard setters on both sides of the Atlantic are getting together early in this process to try to find common solutions that would allow for a real transatlantic market.

And then:

One example is the whole area of car safety already mentioned. The political choice in this kind of regulation is that the car has to be safe. For example, doors need to be strong enough to withstand impact and airbags need to function perfectly.

It is striking how the anecdotal stories about the various ways in which the automotive industry would benefit from TAFTA/TTIP have become even more widespread recently. Here's the British MP John Healey, one of the main cheerleaders for TTIP in the UK, writing in October 2014 about the "potential gains" of the agreement. Guess which example he chooses?

Take the car industry -- a British success story; supporting hundreds of thousands of good manufacturing jobs across the country. Eight out of ten cars made in the UK are sold abroad, but we currently sell far fewer than we could to the US because of different regulatory rules. This needn’t mean standards are higher or lower. Just as we drive on the left and they on the right, some regulations are not better or worse, just different.

Here's the EU Commissioner for Trade, Cecilia Malmstrom, speaking to the European Parliament's trade committee in December 2014:

Take cars, we could look at the differences in our car crash tests or the way we check if the seat covers are flame-resistant. Reconciling small differences like these, without compromising on safety, would be a huge step forward.

A recent video from the German industry association BDI extolling the virtues of TTIP for small and medium-sized companies uses two examples -- one of which is cars. And here's a video from BBC News which is all about the fact that TTIP will make it easier to sell European products in the US, using cars as its example. The main CEPR study on the economic impact of TTIP does, indeed, predict that car sales will increase. In fact, as Martin Whitlock has noted, that boost to transatlantic trade in cars contributes half of TAFTA/TTIP's total projected uplift to economies:

Cars form a big part of the E.U.'s case for TTIP. They account for 47% of the increase in exports and 41% of the increase in imports in the best case scenario, with well over three times as many vehicles braving the Atlantic storms in one direction or the other than at present.

Since the gains for this industry are expected to be so large, and those for other industries so small, why not drop all the contentious stuff that threatens to derail the whole deal, and concentrate on cars? In any case, it would be more honest to rename the TTIP proposal as the "Atlantic Car Trade Agreement," since that's what it is really about. We could even call it "ACTA" for short.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: automobiles, cars, regulations, tafta, trade agreements, ttip

New Utah Law Instructs Cops To Seize Uninsured Vehicles

from the good-intentions,-bad-law dept

Does the government really even need excuses to seize the assets of its citizens, especially for relatively minor crimes? Apparently it does, at least according to the state of Utah.

A new law that went into effect on Jan. 1 changes the wording and adds provisions to a law that has been in effect since 2008 allowing officers to impound a vehicle that isn’t insured. The crucial verb that was changed, raising sides between those in favor and those opposed to the revised law, is the shift from the law previously stating that an officer “may” seize a vehicle without warrant if it’s being operated without insurance to the fact that now an officer “shall” seize said vehicle.

The wording change makes it mandatory. What was always an option is now expressly a command. The senator behind the new law feels this is necessary despite uninsured drivers really not being much of a problem in his home state.

Even though the sponsor of SB 72, Sen. Lyle Hillyard, estimates Utah’s current rate of uninsured drivers at 3 percent, much less than the national average of 12.6 percent, he says it's still enough of a problem to address.

No problem is too small. That's your government at work, Utah citizens. Will this new law lead to the sort of abuse witnessed in other areas of the country? Well, maybe. The low uninsured driver rate is one of the few things preventing this from becoming the full-blown, corrupt mess it is in other jurisdictions. The other factor is the restrictive language in the law, which provides for a surprising amount of protections for the public.

Officers are supposed to make a "reasonable, independent effort" to verify the vehicle is uninsured before seizing it. This means they can't simply seize it because the driver isn't carrying an insurance card. The claimed insurance company will need to be contacted before the vehicle can be seized, along with the owner of the vehicle (if said owner isn't the one driving). The amendment also authorizes an account for funds to be set aside to repay towing and storage charges incurred for vehicles wrongly impounded. (Of course, this requires the affected person to prove that the vehicle was wrongly impounded, but hey, at least there's some sort of due process, even if it occurs after the vehicle has already been seized.)

That's the good news. The bad news is that it gives law enforcement yet another way to take property away from citizens. It encourages trolling for seizures by turning the Uninsured Motorist database into a shopping list.

Then there's this. What if the driver's insurance agent isn't available at the time of the incident?

Another commenter unhappy with the new law said how she had been pulled over previously and had shown up as being uninsured. Because it was Saturday, the officer couldn’t reach her insurance agent but was kind enough to let her go with a warning. By the new wording in the law, unless there is reason to believe the woman’s safety is in question, the officer “shall seize” her vehicle.

There's still no due process involved (pre-seizure) and vehicles are automatically deemed to be "guilty" of being driven without insurance. As far as criminal acts go, driving without insurance is on the low end of the spectrum, but the consequences are on par with drug trafficking or fraud.

Sure, every driver should have insurance, but this isn't a perfect world. There are very few good reasons why someone might drive without insurance, but the real world sometimes gets in the way. Payments might be missed and the reinstatement amount might be too high to pay in a lump sum. Some people are simply uninsurable due to their driving record -- or even solely because of their credit record.

This law seems about as close to abuse-proof as any asset forfeiture law, but it still has several problems, not the least of which is the demand that vehicles be seized (rather than left to officer discretion) and the reliance on law enforcement to carry through on "reasonable, independent verification." The nod to the "safety" of those whose vehicles can be seized ultimately means nothing. Past incidents have shown officers are more than willing to seize vehicles and leave drivers stranded on the side of the road. "Public safety" is generally invoked to assist in civil liberties violations -- like skirting warrant requirements or seizing recording devices -- not to actually ensure the "public" is any "safer."

As with any law that authorizes the seizure of property by the government, there's a potential for abuse. For a state with such a low uninsured driver rate, this law is overkill.

UPDATE: Eric Holder recently announced decision to eliminate states' participation in asset forfeiture programs is a move forward -- one that closes a loophole used by law enforcement agencies to bypass states' restrictions on seizures. However, it will have no effect on this program as this doesn't involve federal participation. So, there's still significant room for abuse in many states' programs, ones that will need to be closed at the local level.

Filed Under: cars, insurance, seizures, uninsured vehicles, utah

Eric Holder Cuts Off Program That Helped Spur Police Asset Seizure 'Shopping Sprees'

from the good-move dept

Well, here's a bit of a surprise. For years we've been highlighting the ridiculousness of police asset seizure and asset forfeiture laws (and, actually, were working on another post on some new such laws that we may now need to revisit...). These laws have basically become a legalized way for local police to steal cars and money without ever charging anyone with a crime. And then... they get to keep the money and sell off the cars. Some have even admitted the process is basically the police going "shopping" for stuff they want. They can seize anything, claiming that it was used in a crime, even if no one is ever charged with a crime. Effectively, they're "charging the thing" which is why you get crazy case names like the (actual case): United States v. Article Consisting of 50,000 Cardboard Boxes More or Less, Each Containing One Pair of Clacker Balls.

However, on Friday, somewhat unexpectedly, outgoing Attorney General Eric Holder announced that he was massively limiting a federal program that helped make these seizures so valuable to police:

“With this new policy, effective immediately, the Justice Department is taking an important step to prohibit federal agency adoptions of state and local seizures, except for public safety reasons,” Holder said in a statement.

Holder’s decision allows some limited exceptions, including illegal firearms, ammunition, explosives and property associated with child pornography, a small fraction of the total. This would eliminate virtually all cash and vehicle seizures made by local and state police from the program.

While police can continue to make seizures under their own state laws, the federal program was easy to use and required most of the proceeds from the seizures to go to local and state police departments. Many states require seized proceeds to go into the general fund.

There's still more to be done to fix bad asset seizure and forfeiture laws, but this is a really big step forward.

Of course, just watch as police departments start to protest that they can no longer go "shopping" for "toys" that they can steal:

The policy will touch policing and local budgets in every state. Since 2001, about 7,600 of the nation’s 18,000 police departments and task forces have participated in Equitable Sharing. For hundreds of police departments and sheriff’s offices the seizure proceeds accounted for 20 percent or more of their annual budgets in recent years.

Either way, kudos to Holder for making this move.

Filed Under: asset forfeiture, asset seizure, cars, doj, equitable sharing, eric holder, feds, money, police