How Bad Copyright Law Makes Us Less Safe... And How Regulators Have It All Backwards

from the fix-1201-now dept

For quite some time we've pointed out how problematic Section 1201 of the DMCA is. That's the part of the law that says it's copyright infringement to simply circumvent any kind of "technological protection measure" even if the reasons for doing so are perfectly legal and have nothing to do with infringement at all. And, of course, we now have the big "1201 Triennial Review" results that are about to come out. That's the system that was put in place because even Congress realized just how stupid Section 1201 was and how much innovation and research it would limit -- so it created a weird sort of safety valve. Every three years, the Copyright Office and the Librarian of Congress would work together to come up with classes of technology that are magically "exempted" from the law. Now, normally, you'd think that if you have to come up with exemptions, there's probably something wrong with the law that needs to be fixed, but that's not the way this worked.

The latest triennial review results are about to come out, and a lot of people are focused on it -- in part because of current events. As you may recall, earlier this year, we wrote about one of the exemption requests in particular: over whether or not you can tinker with the software in your car. GM was fighting against this, and we were shocked to then see the EPA side with GM (!?!?) on this issue, claiming that it's a perfectly reasonable use of copyright law to stop tinkering with cars on the off chance that some of that tinkering might lead to changing emissions to illegal levels.

Of course, just a few weeks later, we discovered that VW had been playing games with its software to avoid emissions tests and pollute the world at a much greater rate than is legal (or healthy). Many people have pointed out that, if the software wasn't all locked up, it seems likely that people would have discovered this problem much earlier. The latest to weigh in on this is Senator Ron Wyden, in a WSJ op-ed, where he explains how the EPA has this whole thing completely backwards:

This year the Environmental Protection Agency submitted comments to the Copyright Office requesting that no exemptions should be granted for car owners or researchers to access and modify the software in their vehicles. The EPA says you shouldn’t be allowed to tinker with your car because it might increase emissions from your tailpipe.

This would block any researcher who would study software in automobiles to make them safer or more environmentally friendly. This summer, security researchers demonstrated that a hacker could take over a Jeep’s systems—GPS, transmission and brakes, among others—over the Internet. This could lead to crashes and even sabotage. In this case at least, Chrysler recalled 1.4 million vehicles to patch that vulnerability, which otherwise could have gone unnoticed.

The obstacle thrown up against access to copyrighted software makes it more difficult for researchers and engineers to find similar problems in the future. Volkswagen’s falsified emissions reports were discovered by independent testing—yet the source of the problem was in the automobile’s software. Independent researchers might have found the problem sooner if not for the threat of lawsuits brought by the company under the DMCA.

In short, while the EPA is worried about individuals potentially violating the Clean Air Act or other regulations, it should be worried about the companies that are actually doing so.

And it's not just the EPA. As Wyden notes, the FDA is doing something similar, which may be even more dangerous:

The Food and Drug Administration also is getting in on the copyright game. It is telling the Copyright Office that modifying software in medical devices, and then providing them to patients without FDA approval, could put people in danger. But the distribution of untested devices is already illegal. Copyright law should not prevent researchers from taking a look at the software and thinking about how to make devices more effective and safer.

Wyden (along with Rep. Jared Polis) introduced a bill earlier this year to try to deal with this on a permanent basis, rather than through this ridiculous triennial review process. Of course, if the TPP is approved, it may be more difficult to actually make such a change.

But, really, the fact that the FDA and the EPA are making these arguments is a real sign of just how broken our copyright law is and how little many regulators understand innovation, technology and intellectual property. The EPA and the FDA come from a world of "permission-only innovation." They are both focused solely on setting up laws that "prevent bad stuff" usually through setting up testing regimes. But those regimes can be gamed -- and they don't seem to recognize that by allowing permissionless innovation to happen, it also opens up worlds of useful research and beneficial innovations, both of which could do a lot more to prevent the kinds of harm that the EPA and the FDA think they're preventing by opposing these exemptions.

There's a fundamental misunderstanding of the nature of innovation in this setup -- where regulators think that the unknown must be "dangerous" and should be prevented until proven okay. But, as history has shown, such a setup only opens up all sorts of games that the big knowledgeable players can use to dance around those regulations, and no real way for outsiders to call them on it (or to create better alternatives). Permissionless innovation is not just a slogan, it's incredibly effective -- and misusing copyright law to prevent it, out of the fear that something bad might possibly happen, without recognizing all the good that is much more likely to come from it, is really dangerous. We're only just learning that now because of what's finally come out in the news about VW, but getting rid of the stupid anti-circumvention clause in the DMCA would go a long way towards actually fixing this mess, rather than relying on bureaucrats whose defacto response is to say "don't do that."

Filed Under: 1201, anti-circumvention, copyright, copyright office, dmca, dmca 1201, emissions, epa, fda, innovation, library of congress, permissionless innovation, research, ron wyden, security

VW Accused Of Using Software To Fool Emissions Tests: Welcome To The Internet Of Cheating Things

from the is-that-domestic-appliance-lying-to-you? dept

There have been a number of stories on Techdirt recently about the increasing use of software in cars, and the issues that this raises. For example, back in April, Mike wrote about GM asserting that while you may own the car, the company still owns the software that runs it. You might expect GM to come out against allowing you to modify that software, but very recently we reported that it had received support from a surprising quarter: the Environmental Protection Agency (EPA). The EPA had a particular concern that engine control software might be tampered with, causing cars to breach emissions regulations. We've just found out that the EPA was right to worry about this, but not for the reason it mentioned, as the The New York Times explains:

The Environmental Protection Agency issued [the German car manufacturer Volkswagen] a notice of violation and accused the company of breaking the law by installing software known as a "defeat device" in 4-cylinder Volkswagen and Audi vehicles from model years 2009-15. The device is programmed to detect when the car is undergoing official emissions testing, and to only turn on full emissions control systems during that testing. Those controls are turned off during normal driving situations, when the vehicles pollute far more heavily than reported by the manufacturer, the E.P.A. said.

So, just as the EPA feared, software that regulates the emissions control system was indeed tampered with, though not by reckless users, but by the cars' manufacturer, Volkswagen (VW), which must now recall nearly half a million cars, and faces the prospect of some pretty big fines -- Reuters speaks of "up to $18 billion". The EPA's Notice Of Violation (pdf) spells out the details of what it calls the software "switch":

The "switch" senses whether the vehicle is being tested or not based on various inputs including the position of the steering wheel, vehicle speed, the duration of the engine's operation, and barometric pressure. These inputs precisely track the parameters of the federal test procedure used for emission testing for EPA certification purposes. During EPA emission testing, the vehicles' ECM [electronic control module] ran software which produced compliant emission results under an ECM calibration that VW referred to as the "dyno calibration" (referring to the equipment used in emission testing, called a dynamometer). At all other times during normal vehicle operation, the "switch" was activated and the vehicle ECM software ran a separate "road calibration" which reduced the effectiveness of the emission control system (specifically the selective catalytic reduction or the lean NOx [nitrous oxides] trap.) As a result, emission of NOx increased by a factor of 10 to 40 times above the EPA compliant levels, depending on the type of drive cycle (e.g. city, highway).

That trick was discovered by the West Virginia University's Center for Alternative Fuels, Engines & Emissions when studying the VW vehicles. Initially, VW claimed that the increased emissions were due to "technical issues" and "unexpected in-use conditions." But further tests confirmed the problem, and eventually VW admitted "it had designed and installed a defeat device in these vehicles in the form of a sophisticated software algorithm that detected when a vehicle was undergoing emissions testing."

It's significant that the trick was discovered through extensive mechanical testing. Assuming some form of DRM was employed, it would not have been possible to spot the cheating algorithm of the emissions control code because it would have been illegal to circumvent the software protection. This emphasizes once more the folly of allowing the DMCA to apply to such systems, where problems could be found much earlier by inspecting the software, rather than waiting for them to emerge in use, possibly years later.

The revelation about VW's behavior once more concerns code in cars, but there is a much larger issue here. As software starts to appear routinely in an ever-wider range of everyday objects, so the possibility arises for them to exhibit different behaviors in different situations. Thanks to programming, these objects no longer have a single, fixed set of features, but are malleable, which makes checking their conformance to legal standards much more problematic. When the VW story broke last week, Zeynep Tufekci, assistant professor at the University of North Carolina, tweeted that this was an example of "The Internet of cheating things." I'm not sure whether she coined that phrase -- I'd not seen it before – but it encapsulates neatly a key feature of the world we are beginning to enter.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: dmca, emissions, epa, hacking, recall, software
Companies: volkswagen, vw

To Enforce Emissions Standards, State Governments Are Looking To Ride Shotgun In Constituents' Vehicles

from the every-turn-you-make,-every-time-you-brake,-I'll-be-watching-you dept

Californians may find their cars being converted to government informants at some point in the future, thanks to the state's push to curb emissions. As always, a trip to the land of Unintended Consequences begins at the Port of Good Intentions. Cleaner air and vehicles will come at a cost, and that cost may include an extensive collection of driving data. (via Cato)

The On Board Diagnostics computer systems on all of our late-model cars now collect a wide range of information mostly related to a car’s emissions. When something is amiss, your dashboard flashes with a “check engine” light and you head to a repair shop to fix it. The goal is to assure cars aren’t polluting the air.

But now the California Air Resources Board (CARB) is proposing regulations(for a May board hearing) requiring manufacturers to significantly expand the kind of information on-board computer software collects about our driving habits.

The software could track miles per gallon, driving distances, how often one stops and starts the car, and how fast one drives. Newer cars already tell us most of this information on those nifty trip computers in the dashboard. The difference, of course, is the regulations would require our cars to also tell government officials the information.

Right now, CARB is only collecting this sort of information in aggregate, and then only after the vehicle has been on the road for at least six years. This data is compiled during state-required emissions checks. So far, so good, and CARB states on its website that it isn't (yet) pursuing the collection of this data singularly and in an ongoing fashion by using transponders.

“(N)o such program has been adopted by ARB nor have any decisions been made by ARB to pursue such an approach in California.”

But other states are pushing for even more stringent emissions standards than California's, and the only way to enforce these appears to be the use of a tracking device. Washington wants a 50% reduction in emissions by 2050. Oregon has mandated a 20% reduction in per capita urban driving. To hit these goals, manufacturers will need to track additional data about vehicle usage and make it accessible to state governments.

The data parameters listed in CARB's proposal are extensive (p. 42). And it starts with this statement:

Track MPG/CO2 in the real-world

Not just enable easier data logging but actually provide historical data

In practical terms, this means logging of miles driven, fuel used, stops and starts, engine run time, and air conditioner usage. Certainly this data will help manufacturers build more efficient vehicles, but it really has no business being in the government's hands.

If it does, the abuse of this data is almost guaranteed. If this was being tracked solely by manufacturers for use in development, it would be one thing. But if it's being used to track down drivers who aren't driving quite as efficiently as the local government believes they should be, that's quite another. Say goodbye for aggregate data about classes of vehicles and hello to onboard surveillance.

Steven Greenhut points out in his article that the government already has plenty of vehicle tracking options at its disposal, including red light cameras and toll roads that require a government-supplied transponder to be accessed. The latter has already been used to "control" driving by denying toll lane access to speeders ratted out by the required transponders.

With the government tracking this information (and requiring manufacturers to collect it and provide access), law enforcement will no longer need to seek warrants for GPS usage. Instead, they'll just be able to ask another government agency for driving records or demand them from manufacturers under the Third Party Doctrine. And on top of everything else, it will be argued that traveling in your vehicle has no expectation of privacy, even if most drivers will be unaware that their vehicle is tracking all sorts of information and handing it over to the government.

This data collection -- when tied to emissions restrictions -- could have another unintended side effect: taking away citizens' freedom to choose where they live.

Of course, for many it really isn’t about greenhouse gas emissions. Mobility allows (or, as anti-auto groups would say, forces) people to living in low-density “sprawl” where they can escape taxation by cities eager to subsidize stadiums, convention centers, and light-rail lines. All they have to do is ramp down people’s monthly driving rations–something like a cap-and-trade system that steadily reduces the caps–and suburbanites will eventually find that they have to move back to the cities.

Certainly no one expects driving to be a "private" activity. But they also don't expect their government to have an active interest in their personal comings and goings, especially for indefinite periods of time. Gathering this info and handing over control to governments is going to encourage a certain amount of misuse. It's inevitable. These governments need to find another way to attack the emissions problem -- one that doesn't involve turning peoples' vehicles into personal diaries government employees can flip through at their discretion.

Filed Under: emissions, privacy, state government, surveillance

Tesla Motors Pays Fine For Lacking Emissions Certificate Of Conformity... Even Though It Lacks Emissions

from the funny-how-that-works dept

A few of you sent over this bizarre story of how famed electric vehicle maker Tesla Motors apparently need to pay a $275,000 fine for lacking a "Certificate of Conformity" from the EPA, needed to comply with the Clean air Act. As is noted in the article, it doesn't seem like Tesla should have to get such documentation in the first place, seeing as it doesn't even have a tailpipe, but such is the nature of regulations being a bit behind the technology times.

Filed Under: emissions, fines, regulations
Companies: tesla