The federal agency is NHTSA. The lawyer there who signed the letter about it being a federal crime is Kerry E. Kolodziej.
Kolodziej also works at Mayer Brown, the same law firm that fought in court against the Massachusetts law on behalf of Alliance for Automotive Innovation.
It is believed the NHTSA letter to automakers was a veiled attempt to circumvent the court battle. It fits squarely into the BS category, subcategory Monumental. Tagged with Regulatory Capture.
There's some interesting context missing from the explanation too, which is that apparently the feds were consulted years ago and they said "it's fine."
The Massachusetts Right to Repair Coalition's response to the NHTSA letter:
On behalf of two million voters and thousands of independent auto repair shops across Massachusetts, we are outraged by the unsolicited, unwarranted, and counterproductive letter from NHTSA that conflicts with the Department of Justice's statement submitted two years ago in federal court stating that there was no federal preemption. NHTSA's letter is irresponsible, having been transmitted without any new evidence and after the conclusion of the federal trial, despite having been asked by the judge to participate in the court proceeding and declining. NHTSA's letter fails to acknowledge the evidence and testimony presented at the trial that demonstrated the viability and security of an open access platform. This is yet another delay tactic the manufacturers are using to thwart the will of their customers, Massachusetts voters who voted 75-25 in favor of their right to get their car repaired where they choose. The FTC, the Biden Administration, and many members of Congress have all come out in support of Right To Repair.
Current cybersecurity standards enforced in the automotive industry will probably completely kill the possibility of after-market car parts and the usage of used parts in cars.
I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
From the article: "federal regulators claim that malevolent third parties could "utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently."
Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the first place.
It's an open secret in the industry that the CAN bus is not authenticated. If you connect, you can read the data on the bus and inject the data on bus.
But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it.
Now they have this security concept where every ECU on the car will have their own private key in their own secure enclave. You need that key to put authenticated data on bus and it can only be updated by the OEM's.
The authenticated bus infra will probably not protect against remote attacks ( since if you own the ECU SW you have the cert and you will still be able to publish signed messages) but will kill ability to change HW.
I really would not like to kill our ability to fix our vehicles but I feel this is the thing that is going to happen.
Since the Industrial Revolution, and only made worse with the Information Revolution, technology has advanced much quicker than the ability for laws and customs to adapt.
It sometimes seems that way, but when you look at how people lived without computers things were worse. Cars in the 1930s were not fuel efficient, polluted a lot, and you have to do things like file the points every couple months. I remember when you called buildings not people - the phone was attached to the wall, and what just a voice device, it didn't hold Wikipedia or current maps to everywhere. However we forget how bad the past really want.
It's not about security by obscurity. A better analogy would be the fight over "tivoization". In safety-critical and highly-regulated systems like automotive and health care, there's a meaningful regulatory interest in ensuring that the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways. That means that the software and firmware running on each of the dozens of ECUs in a vehicle is part of the (regulated) functional safety spec of the system. There are real, meaningful technical challenges to overcome if you want to meet both the goal of ensuring that dangerous and malicious software can't run in safety-critical domains, and the goal of allowing users to modify their vehicles as they see fit.
I'm speaking as one of the authors of the Uptane standard for secure software updates in vehicles, and as a life-long proponent of user freedom and open access to the computers we buy. There are possible solutions here, but they are not easy.
Whenever I dig into this I discover that what people complaining really want to do is modify their cars so it no longer meets emissions standards (you can get more power and/or better fuel mileage by doing this). Nobody is replacing ECUs with one of their own design that otherwise meets emissions. Sensors and parts are easy to replace (sometimes at high cost), and mostly radially available. The OEMs already tell mechanics what all the diagnostics codes mean.
sure most of us reading this have the skills to write new code for their ECU, but realistically almost none of us would do that anyway unless we want to make a trade off that effects emissions.
OEMs only tell authorized mechanics what the codes mean. Most cars have the basic standardized OBD-II codes, and an additional much-more-useful set of codes/diagnostics that are proprietary.
They tell the third party scan tool manufactures as well. (for a "reasonable" price - where reasonable can be 6 figures) I used to work on those scan tools, and so I saw the data (I probably shouldn't talk about it - lets just say were reversed engineered their tools often).
Many mechanics will read and tell you the codes for free. Auto part stores will as well.
It's not just that. For example, BMW has paired the main battery to the ECU in their cars for years. So a dead battery requires a trip to an authorized repair shop (or buying an OBD scan tool) to have a new battery operate correctly. This is relatively easy & safe ~4 bolt job (2 tether the battery, then 1 for each terminal) in many other cars. Technically, it can be self-repaired, but it's extra steps and cost because reasons.
> the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways
What use is preventing dangerous modifications, when unmodified devices contain critical safety bugs, and will continue to contain them. The ongoing effort by automakers is increasing the amount of safety bugs by connecting everything to the internet without proper security practices.
The only reason to require signed firmware/hardware as it stands is to decrease the repairability, harm the second hand market, and increase profits.
dont include dangerous features that have nothing to do with the function of the vehicle. telemetrics, and remote manipulation of software during drive time are not required for safe operation.
> In safety-critical and highly-regulated systems like automotive and health care, there's a meaningful regulatory interest in ensuring that the devices as sold and authorized to be on the road (or in patients' hospital rooms) don't get modified in dangerous ways.
On the other hand, a Minority Report future where "your" car answers to a different master, or you don't have the right or ability to control your own medical implants and prosthetics, is terrifying. Given that we've lived for almost a century in a world where cars can be modified in unlicensed ways, I'll go with the devil we know.
Hey, so you don't have any contact on your profile, but I do want to ask you if you see actual usage of Uptane in the industry. I have never heard of it, but it sounds interesting and practical. I have a bunch of experience around SW updates and was contemplating some sort of project in this area, I'm curious what your take is around the current environment.
> Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity?
Yes
(I've reverse engineered the security system on an ABS controller for the top selling vehicle of a major auto manufacturer. It is atrocious. I'm pretty confident the whole reason it exists is so that they can claim they have one to use the DMCA to stop third party tools from interacting with it.)
I also work in the industry and tend to agree. Right now if you get an official replacement ECU on a secured CAN network the device comes from the OEM already set up with the matching SecOC (AES-128) key that the OEM recorded in their backend database at time of manufacturing.
"Authorized parts" and "Authorized repair centers only" would be allow them to extract massive profits while providing no consumer benefit. That then incentivizes them to create even more fragile, unreliable vehicles.
like this; an ECU is an ECU. match unit to make and model.
gap the ECU from remote modifications. an ECU doesnt require keys, they are not part of the required properties of an ECU.
It's an ongoing battle. Giants such as the FTC are able and willing to fight these battles. Other large orgs such as SEMA are also pushing back, for both the right to repair and the right to modify. Additionally, OEMs don't want us to realize how they are putting themselves on top of a slippery slope. If we look at the NACS example, when one or two break away from a 'gentleman's alliance' it quickly creates a domino effect.
There should really be some kind of airgap between internet connected entertainment systems and "mission-critical" aspects such as brake/drive by wire, steering input, etc.
It seems incredibly short sighted to give your radio access to drive the car into a median.
There are quite a few parts on modern cars already that you cannot just replace on your own car with either a new or used replacement because before they will work, they require a "relearning" procedure that only the dealership computers can initiate and those computers have to be online, connected to the automaker's mothership when they do it.
So basically DRM on car repair/parts is already a thing.
If I ever have to choose between security and freedom, I'd pick freedom all the way, every time. But usually this is a false dichotomy and you can in fact have both, despite claims to the contrary.
Exactly. The infotainment bullshit should be in zero way connected to the actual operation of the vehicle. There is zero reason why the laggy, nonsensical software that controls my radio should control my engine. Someone correct me if I am wrong, please.
It's not as simple. For example, look at the distance sensors used for parking and the data coming from them over the CAN bus.
That bus needs to be able to (at least indirectly) reach the brakes so that automatic emergency braking can take their measurements as inputs. And that bus needs to be able to reach the audio system to provide audible feedback to the driver when parking, and also mute the radio. Ergo, you have a bus that reaches both brakes and radio. Now, you might want to prevent the radio firmware from sending data to the brakes over that bus, but physically you have to have a connection between them, as we don't really want to make many separate buses for reasons of complexity, cost and maintenance; moving from a separate end-to-end wire for each specific purpose towards a shared bus was a great improvement.
Current cars usually have gateways that route messages around different busses. This would protect you from having unwanted messages arriving on secured buses, but pass through the wanted messages.
Unfortunately, those gateways are pretty poor when they do exist. There are some thieves in the UK popping off headlights to access the CAN bus, where they then inject a message that tells the system that a valid key has been used so go start the engine.
>According to the National Highway Traffic Safety Administration (NHTSA), approximately 188,000 passenger vehicles were backing in crashes reported to the police in the United States during 2015…The combination of Rear Vision Camera and Rear Parking Assist reduced backing crash involvement rates by 42%. When Rear Automatic Braking was added to the Rear Vision Camera and Rear Parking Assist, vehicles with all three systems had backing crash involvement rates that were 78% lower than vehicles with none of the systems.[1]
I think "Rear Parking Assist" would be better phrased as "Rear Proximity Sensors", as the "Automatic Parking Assist" (which is what I thought we were discussing) only brings a (likely statistically insignificant) marginal risk reduction of 2% and seems to fall under the "bullshit convenience" category. I do agree that the proximity sensors are themselves huge wins but (if I'm understanding correctly) this could be fairly trivially conveyed on the dashboard instead of the infotainment system.
As I see it, the issue here is that it's in automakers interest to tie together the safety improvements (which are great and benefit people) with the cost-reduction mechanisms consolidating controls and monitors into a single screen which seem to conflate operation with infotainment and, I would argue, reduce peoples' safety.
This is only tangentially related but different to the repair question, so I modified what I said a bit to reflect I was going off topic.
You misunderstood my intent, I'm saying that introducing these systems apparently produces a infosec threat significant enough to warrant federal legislation. In response to your post however I think we can dispense with the notion that folks backing into parked cars, light posts, etc, represents anything more than a nuisance to whoever owned the property that got backed into. Yeah it says "crash" in the writeup but we're not talking Michael Bay style 8 lanes of exploding cars here.
I don’t think it needs to be some Michael Bay crash to be significant. Let’s say that all these crashes are minor, as you state. If repairs ranged from $500 to $1,500 evenly, that is about $188 million in property damage a year. That’s not nothing. I agree that systems need to be better designed with infosec in mind.
It's not nothing, it's the consequences of people's general disinterest in operating a motor vehicle effectively. I think it -should- be expensive to be a bad driver. Good decision making is learned through poor decision making.
Removing incentives to actually pay attention to where your two ton death machine is in space isn't how one introduces safety. What you're proposing is a crutch that rewards inattentive behavior. There's no moral to it.
A camera and sensors that give you more information about "where your two ton death machine is in space" and are literally proven to improve safety and reduce accidents means you pay attention less? So cars would be even better if we removed the side and rear view mirrors, since those are nothing but "a crutch that rewards inattentive behavior"? I mean, people have necks so shouldn't they just turn around and look instead of being lazy and relying on mirrors? I'm sorry, but I cannot take your position seriously.
Here's the thing: watching a monitor doesn't actually update one's spacial model of their surroundings and their vehicle's position therein. Under normal operating conditions an attentive driver has and is constantly updating a fairly accurate mental model of their vehicle and the objects near it that they are likely to interact with.
When your attention is drawn to a rear camera system you've now ditched that spacial model entirely and have changed to modeling the video game on the screen in front of you. This context switch is -very- expensive to unwind and at least momentarily costs you your awareness of where everything else except the back bumper is in space, and what's in front or to either side of the vehicle.
As far as mirrors go, they aren't to be relied on solely as they do not provide a full picture of the vehicle's surrounds. Checking one's blind spots by turning your head and actually -looking- in your blind spot before merging is a thing. same goes with the rearview.
Luckily for you, you don’t need to. Consider outliers.
The reason they the US mandated backup cameras was due to accidents like this.
They were that common.
from your original point.
> In response to your post however I think we can dispense with the notion that folks backing into parked cars, light posts, etc, represents anything more than a nuisance to whoever owned the property that got backed into. Yeah it says "crash" in the writeup but we're not talking Michael Bay style 8 lanes of exploding cars here.
Given the complete lack of any empathy at all you've shown, I don't expect you to change your mind on this, but please try to consider if we have a way to prevent deaths, then maybe we should try and not just consider a parent backing over their child to "represents anything more than a nuisance to whoever owned the property that got backed into."
We're getting pretty far afield from the original point of decoupling control systems from network connected infotainment systems, which doesn't necessarily eliminate backup sensors or cameras. The current everything-in-one-bucket implementation is a matter of convenience and cost savings for the manufacturers, not a hard technical requirement.
I could go on at length about the consequences of trying to play whack-a-mole with human stupidity and how that just breeds stronger idiots. There have been no significant changes to vehicle-related death statistics since the 90s when airbags were mandated, despite significant improvements to crash protection and countless here-let-me-help-you-with-that safety features that have been introduced in the last 30 years. So what do you call it when improving safety doesn't actually improve safety?
> And that bus needs to be able to reach the audio system to provide audible feedback to the driver when parking, and also mute the radio. Ergo, you have a bus that reaches both brakes and radio
A $2 speaker would work just fine. You would still hear it over the radio. If your radio is so loud you couldn't hear it while parking you have bigger problems. A shared bus might be more efficient, but it is not more redundant. I would rather spend $2 on redundancy here.
Seems like that would be trivially managed with a firewall (canbus security gateway). Is it purely cost that they don't lock down or segment off the canbus? Being able to steal a car by talking to the immobilizer through the headlights comes to mind.
Without all that being connected how else would they use the built-in lte to send back all of the data about you from the car? Car companies cant be missing out on selling customer data too.
Do they though? I mean if it's there sure people will mess with it but I don't recall any public outcry for either center dash ADHD factories or keyless anything.
I do, yes. It'd also be nice to know things like state of charge/how much gas I got, whats the car temperature now - tell me when it reaches X, look at my car's cameras. There are plenty of compelling use-cases.
There was a time when vehicles had dedicated gauges for vital info like operating temp, oil pressure, rpms, etc. so it's not like solutions don't already exist that don't involve a fucking tablet in the middle of the dash. Backup cameras I'll give you though.
There really isn't any reason why your infotainment system can't be separate from core functioning control. It's just cheaper for the manufacturer to slap it all in one platform with the added advantage of huge profit margins on getting it fixed when something simple fails.
Nice in theory but almost impossible in practice, unless you start installing two copies of many things, one for safety-critical purposes and one for infotainment purposes.
I fail to see the problem. Ditch the bullshit or at least corral it into a corner where it can't fuck with anything vital to vehicle operation and safety. ABS systems (for example) worked swimmingly decades before the first net-connected infotainment system was theorized.
Tesla already does this. You can reboot the user screen while driving the car. Everything works but the only negative thing I've noticed is that you get no indication of turn signals working (they're flashing).
Insurance companies should get behind Right to Repair. We've so far waited three months and have an $11,0000 price tag to the insurance company on a minor collision that bent our car's front fascia and broke a sensor -- no frame or metal damage. I would have happily repaired on my own if possible just to avoid being without the car for so long. If only I could get those parts and have a decent service manual.
Insurance companies (of any kind) are not incentivized to find the cheapest service. Anything they pay out is passed on via premiums. Indeed, the more expensive service is better because a 2% profit on $1000 makes them 10x more profit than 2% profit on $100.
There’s some competition here in that a marketplace of insurance companies can compete on the premiums so there can be downward pressure, sometimes. But for things that impact all insurance companies like this equally, then insurance companies would also be opposed because more expensive repairs = more money in their pocket.
That’s why you see things like medical insurance not being aligned with lowering medical costs.
The facts in your post are wrong. Insurance companies establish rigorous processes to steer repairs to the low cost provider and push that provider to make only necessary repairs. Policy holders might go along with it and might not, same as other insurance scenarios.
> steer repairs to the low cost provider and push that provider to make only necessary repairs.
That's not my experience in the UK and Norway. At least with the good insurance companies. I creased the rear passenger door of my Tesla S in the UK three years ago. It was purely cosmetic damage confined to a 10 cm diameter area at the front bottom corner. My Norwegian insurance paid 4 kUSD for a new door skin and a repaint of almost the whole side of the car at the Tesla recommended body shop and ten days of car rental.
It's interesting to see how such things differ from country to country and insurer to insurer.
> That’s why you see things like medical insurance not being aligned with lowering medical costs
Health insurance companies are lambasted all the time for denying coverage for certain procedures or medicines or requiring prior authorizations to prove it is medically necessary or evidence based treatment.
They do both to carefully approach the 20% overhead allowed by the ACA. Denying claims wholesale, and allowing the claims they do approve to increase in cost year over year greater than inflation so that they can make the total pie that they take 20% of greater each year.
Then why do some of them exceed the minimum medical loss ratio by quite a bit? Why did Elevance simply not deny more claims so it could get closer to 80% rather than 90% and book more net income?
>Reported loss ratios are 89.4% for Elevance (fka Anthem), 86.0% for CVS Health (Aetna), 83.8% for Cigna, and 82.8% for UnitedHealthcare. Loss ratios have been impacted by seasonal patterns and the return to more stable utilization than seen in 2020.
Insurance companies will just follow the money like they do in (USA) healthcare. Expensive repairs create a world where there are two kind of people, those who are insured, and those who aren't. A high cost of repair guarantees you _really_ don't want to be in the latter group, so you'll pay whatever is asked to be in the first part. On their end, the insurance companies will use their weight to negotiate much lower prices on parts and service, increasing their margins.
Having liability insurance is mandatory. Having collision insurance is optional (unless your car is financed, in which case it is likely required by the terms of your financing, but not by law).
I don't carry collision insurance on my daily drivers (the newest of which is 9 years old), because it's too expensive for the coverage offered.
Only liability insurance is mandatory in many (all?) states. And even if you believe that your car can only be damaged by insured drivers and you will always be able to make a claim against their insurance, the sufficient coverage on the property damage liability is just $5K in California, for example.
I think insurance companies are also salivating at having access to detailed driving data so they have more reasons to deny claims and raise rates. I'm not sure they want to jeopardize that by getting on automakers' bad side.
How will right to repair speed up your particular repair, though? If a part is back-ordered, it's still going to be back-ordered even with right to repair.
Said differently, what is blocking you from doing the repair today? Is it just that the sensor needs coding to the car or calibration?
Back in 2013/2014, my Jeep was rear-ended. Some of the body panels were back-ordered, so the repair took 2 months longer than expected. Even if I was could have done the body repair, I couldn't have purchased the parts.
Likewise, a co-worker had his airbags stolen last year and it was many months until Acura had replacements available.
> Likewise, a co-worker had his airbags stolen last year and it was many months until Acura had replacements available.
A mystery that resolves itself by the end of the sentence: who the hell would steal airbags? Clearly, there's demand from people who don't want to wait months for a replacement... talk about making a market.
I would have assumed that someone who would go out of their way to steal somebody else's airbags would also not bother with safety inspections or whatever that might have kept their broken car from being on the road.
ALPRs with a live querying capability to the registry of motor vehicles will now flag cars with expired safety inspections around here. It's an easy ticket for the police to grab their town some cash and several local towns are fairly aggressive about ticketing for expired inspections. (You could get away without fixing airbags on a pre-OBD2 car by taking it to an inspection shop that will look the other way, but even those have to connect to OBD2 on equipped cars.)
I suspect that most people who need airbags are still buying them; they're just buying them at the end of a chain of fencing stolen bags.
I guess it depends on the state. A friend recently was hit and had their car only slightly damaged. They went to insurance car shops that insurance recommended, but they all declined to fix the car. They ended up getting paid out and fixed it themselves since they're already skilled with maintaining vehicles, and they pocketed the rest.
In the US, firstly it is considered unfashionable by many to buy a used car altogether ("you're just buying someone else's problems!") and secondly, the only thing that can reliably affect resale value is if it condemned with a "salvage title." Which can mean a few things but usually means the car suffered more damage than it is economical to fix. But just the fact that a car was in a collision or had a claim against it does not automatically affect the car's future insurance rates or resale value.
We have a company called CarFax that produces vehicle history reports for used cars, but there are many problems with it. Starting with the fact that all reports are voluntary. I have looked at cars that were clearly in floods when you know what to look for and yet the CarFax was squeaky clean.
The majority of cars sold are used cars. Yes there are some who won't consider a used car, but they are a minority (a large minority, but still a minority). The average car last 12 years, the typical new car is replaced every 3 years with a newer one.
A salvage title is only used when someone intends to restore the car, and then it goes back to a normal title once restored (or at least that is how my state did it 15 years ago - each state is different). You get the salvage title only to justify paying taxes on the actual value of the car (sales tax on a car is for actual value not the price you paid, so a salvage title is useful to prove it isn't worth what the book says) It will show up on CarFax as restored then. (though as you note most such issues never get a salvage title as they are not sold)
Don’t know what state or country you are in, but that isn’t the way a salvage title works in any US state that I am aware of.
A car with a salvage title stays branded with “rebuilt” or “restored” in all common scenarios. There are ways to wash them to unbranded, but most are unethical and involve retitling in different states and such, rather than simply restoring the car.
Regardless, unless dealing directly with the DMV, most people call a branded title a salvage title, or at least say something like, “the title isn’t clean”.
Salvage titles are restored wrecks. Back in the day when it was easy to get clean titles, people would steal cars and “restore” wrecks… or move parts from wrecks into stolen cars to launder them.
> But just the fact that a car was in a collision or had a claim against it does not automatically affect the car's ... resale value.
What? Accidents, even after repair, decrease the resale value of a car, significantly in the case of a young or exotic car, less so for an older, more pedestrian car.
Having been in an accident removes some possible buyers from the pool. (Some buyers will not knowingly buy a car with damage history.) That necessarily changes the balance of supply and demand for that car.
If you had a choice between buying a car that was in a crash and repaired versus the otherwise identically equipped car that had never been crashed, which would you choose? Lots of buyers prefer the latter option, which is why they're worth more than the former option.
I'm saying that accidents (depending on the severity) do not necessarily decrease the resale value of the car. You're saying that a car in an accident has a smaller pool or buyers. These can both be true.
There are two ways to sell a sub-prime car: 1) lower the price, and 2) wait for a less-than-diligent buyer to come along. Many private sellers and dealerships are perfectly fine with #2.
Lots of people do not know how to check for unreported previous damage to a car, and lots of people do not care if the car was in an accident as long as it was repaired, has no obvious damage, drives just fine, and has a green title. These are the people who eventually buy those cars.
I'm curious as to what make/model is damaged -- I self-repair all my cars and have no issues with access to parts and service manuals. Ebay is full of suppliers and mechanics operating a black market on these things.
Wouldn't an insurance company naturally want to avoid the additional liability of personal, unlicensed repairs? What if someone improperly repairs the brakes on their own car and they fail on the road, causing a collision?
I just learned that recently - I was at a quick oil change place and asked them to quickly look at my brakes while down there. After some commotion their manager came over and explained (In a friendly fashion) they are technically a "lube shop" with "lube technicians" and not licensed mechanics and cannot do or say anything but change my oil and maybe fill up the fluids / change wipers. Interesting!
> Trade certification for automotive service technicians is compulsory in Nova Scotia, Prince Edward Island, New Brunswick, Ontario and Alberta and available, but voluntary, in Newfoundland and Labrador, Quebec, Manitoba, Saskatchewan, British Columbia, the Yukon, the Northwest Territories and Nunavut.
> Automotive service technician (transmission) trade certification is compulsory in Ontario.
> Automotive service technician (steering, suspension and brakes) trade certification is compulsory in New Brunswick and Ontario.
I feel you've typed that out of best thoughts and Intentions but no actual knowledge, which is an alluring and common but slippery path for all of us :-)
In Ontario, as parent and I indicated, it's a compulsory trade. It is, in fact, a government regulation directly.
People work on their own cars and have done so for at least a hundred years. Using technical means to prevent people from doing their own repairs, or from hiring someone of their choice to do the repair, is a relatively new thing.
> would have happily repaired on my own if possible
I actually did that once. The claims adjuster was pretty surprised at the request, and she confirmed multiple times that I really wanted them to pay out less money (parts but no labor). Then she was like, "Well, I don't know why you'd want to, but it's your decision, so OK."
The reason: someone stole my stereo and, in the process, they destroyed several pieces of the dashboard. The insurance didn't cover my (aftermarket) stereo, just the dashboard.
I was going to install a replacement stereo myself. I had installed the other one (that was stolen), so I already knew how to do it, and I knew that stereo installation requires removing the same dashboard parts. If I'd let insurance pay a shop to do it, I would have needed to have them install the parts, then take it home and remove the same parts, install the stereo, and then put them back. Buying parts at the dealer is less work and takes less time.
They were probably surprised because the insurance company would have paid the fair market rate for the replacement (parts & labor based on various quotes), regardless of if a professional did the work, if you DIYed it, or even if you never decided to repair it.
You likely talked yourself out of additional money.
Yeah this process caught me off guard during a recent repair. In my mind, the model was "Insurance company will pay what the repairs cost." How it actually works is "Insurance company will give you the cash to cover what they believe the repairs cost. If it costs more, they'll cover the difference. You are free to do anything you want with the money."
Walking away with leftover cash in your pocket is a normal and above-board part of the process if you can do the repair more cheaply/by yourself/don't get it fixed; it's not fraud.
> Walking away with leftover cash in your pocket is a normal and above-board part of the process if you can do the repair more cheaply/by yourself/don't get it fixed; it's not fraud.
A friend had paint damage to his truck caused by a canopy (a large EZ-UP) being blown into it repeatedly during a storm. He filed a claim and the adjuster determined it would be something like $5,000 for a proper repaint.
He asked another friend of ours–who worked in insurance—if it was okay to just keep the money and ignore the paint damage: "Yeah, you suffered a loss, you were compensated for that loss, that's all there is to it. It's up to you if you want to repaint, or if you consider it diminished value compensation, or whatever. It's your money free-and-clear."
It feels wrong somehow, but it really isn't. Just don't try to claim the same damage again in the future.
Did you suffer any increase in premiums? I’ve never been involved in any sort of accident (other than being a passenger), so what happens after an accident re. premiums, etc. is a Scary Thing that I’d love to demystify for myself before I learn by experience.
> For now, Massachusetts’ law is tied up by lobbying and legal fisticuffs.
It’s depressing that the will of the people that passed this ballot measure can get pre-empted like this. Before it passes? Sure. But afterward you’re just disenfranchising the voters.
Direct democracy is a threat to order, the unwashed masses know nothing, they're protecting us.
I think the saddest part is there probably isn't an auto manufacturer that isn't a participant in the lobbying campaign against bills like this. I can't even vote with my wallet in this situation.
At this point I'm hoping I'll be able to buy an electric kit car that can satisfy my minimal needs in the near future so I don't have to deal with modern vehicles and their shithead manufacturers.
Direct democracy is easier to buy than representative democracies for two reasons: first, voters have other things to do with their time than become experts on every bit of law that comes before them. And second, they don’t have the ongoing interest in rule-making, implementation & enforcement an interested legislator does.
Reading the book Street Level Bureaucrats was eye-opening for me on why seemingly “common-sense” solutions like Direct Democracy end up either just not working or having the opposite of the intended effect. Laws are less like writing software for a computer and more like designing processes for a team writing software.
State governments pretty regularly ignore citizen initiatives if they don't like it. Our state voted to decriminalize weed and our republican governor filibustered it for the remaining 4 years he was in office and even the democrat governor who replaced him took her sweet time.
Right now if you look it up, GOP state governments are working hard to kill the ability for citizens to enact initiatives that could allow them to implement things they want that the state representatives do not want.
The car keys should probably contain the master private key , and the mechanic could use that to authorize third-party components and modifications to the car.
There is no simple and secure technical reason car makers can't do this, they just want to fight it because they make tons of money off making fragile cars, charging exorbitant fees at their dealers service department and for parts, and they see MA's Right to Repair bill as a threat to their revenue stream and how much they can extract from customers while providing no value back to them.
Why can't the owner set up their own private key when the car is purchased or transfer ownership? It's the owner that needs it protection from unauthorized use and not the manufacturer.
Right to repair os starting to reach a boil. The car companies have lost. The combat has changed and they're well on their back foot. The sooner they realize this, the less painful it will be for them. Legal loopholes and dirty tactics will only get them so far now.
136 comments
[ 4.2 ms ] story [ 197 ms ] threadThe federal agency is NHTSA. The lawyer there who signed the letter about it being a federal crime is Kerry E. Kolodziej.
Kolodziej also works at Mayer Brown, the same law firm that fought in court against the Massachusetts law on behalf of Alliance for Automotive Innovation.
It is believed the NHTSA letter to automakers was a veiled attempt to circumvent the court battle. It fits squarely into the BS category, subcategory Monumental. Tagged with Regulatory Capture.
There's some interesting context missing from the explanation too, which is that apparently the feds were consulted years ago and they said "it's fine."
The Massachusetts Right to Repair Coalition's response to the NHTSA letter:
On behalf of two million voters and thousands of independent auto repair shops across Massachusetts, we are outraged by the unsolicited, unwarranted, and counterproductive letter from NHTSA that conflicts with the Department of Justice's statement submitted two years ago in federal court stating that there was no federal preemption. NHTSA's letter is irresponsible, having been transmitted without any new evidence and after the conclusion of the federal trial, despite having been asked by the judge to participate in the court proceeding and declining. NHTSA's letter fails to acknowledge the evidence and testimony presented at the trial that demonstrated the viability and security of an open access platform. This is yet another delay tactic the manufacturers are using to thwart the will of their customers, Massachusetts voters who voted 75-25 in favor of their right to get their car repaired where they choose. The FTC, the Biden Administration, and many members of Congress have all come out in support of Right To Repair.
I say this as someone working in this field that has asked a couple of people doing work in this exact direction. I point blank asked them if this will happen, and they just shrugged their shoulders and said... yeah, kinda'.
Which really means auto makers built a terribly insecure system and hope to hide the fact behind security as obscurity? If so, that's the real problem. The vulnerabilities described should not be there in the first place.
But, that does require physical access to the car and hooking to the wires. Nobody complains that if you hook to the buses on a PC you can own it.
Now they have this security concept where every ECU on the car will have their own private key in their own secure enclave. You need that key to put authenticated data on bus and it can only be updated by the OEM's.
The authenticated bus infra will probably not protect against remote attacks ( since if you own the ECU SW you have the cert and you will still be able to publish signed messages) but will kill ability to change HW.
I really would not like to kill our ability to fix our vehicles but I feel this is the thing that is going to happen.
Not just a concept, on vehicles you buy today (from, for example, Ford and VW)
https://cdn.vector.com/cms/content/products/VectorCAST/Event...
In some ways. In other ways, things are worse now.
I'm speaking as one of the authors of the Uptane standard for secure software updates in vehicles, and as a life-long proponent of user freedom and open access to the computers we buy. There are possible solutions here, but they are not easy.
I love "it's a complicated trade off" - it's way more interesting than whatever slogans end up defining "sides" in a debate
sure most of us reading this have the skills to write new code for their ECU, but realistically almost none of us would do that anyway unless we want to make a trade off that effects emissions.
Many mechanics will read and tell you the codes for free. Auto part stores will as well.
What use is preventing dangerous modifications, when unmodified devices contain critical safety bugs, and will continue to contain them. The ongoing effort by automakers is increasing the amount of safety bugs by connecting everything to the internet without proper security practices.
The only reason to require signed firmware/hardware as it stands is to decrease the repairability, harm the second hand market, and increase profits.
On the other hand, a Minority Report future where "your" car answers to a different master, or you don't have the right or ability to control your own medical implants and prosthetics, is terrifying. Given that we've lived for almost a century in a world where cars can be modified in unlicensed ways, I'll go with the devil we know.
Yes
(I've reverse engineered the security system on an ABS controller for the top selling vehicle of a major auto manufacturer. It is atrocious. I'm pretty confident the whole reason it exists is so that they can claim they have one to use the DMCA to stop third party tools from interacting with it.)
But how would this work with a 3rd party ECU?
So far this has eluded public consciousness, but I expect it will hit the users hard at some point in the near future.
https://www.ftc.gov/system/files/documents/reports/nixing-fi...
https://www.sema.org/news-media/enews/2023/28/right-repair-a...
It seems incredibly short sighted to give your radio access to drive the car into a median.
So basically DRM on car repair/parts is already a thing.
That bus needs to be able to (at least indirectly) reach the brakes so that automatic emergency braking can take their measurements as inputs. And that bus needs to be able to reach the audio system to provide audible feedback to the driver when parking, and also mute the radio. Ergo, you have a bus that reaches both brakes and radio. Now, you might want to prevent the radio firmware from sending data to the brakes over that bus, but physically you have to have a connection between them, as we don't really want to make many separate buses for reasons of complexity, cost and maintenance; moving from a separate end-to-end wire for each specific purpose towards a shared bus was a great improvement.
The data would seem to contradict that statement.
[1] https://www.sciencedirect.com/science/article/abs/pii/S00224...
As I see it, the issue here is that it's in automakers interest to tie together the safety improvements (which are great and benefit people) with the cost-reduction mechanisms consolidating controls and monitors into a single screen which seem to conflate operation with infotainment and, I would argue, reduce peoples' safety.
This is only tangentially related but different to the repair question, so I modified what I said a bit to reflect I was going off topic.
You want less safety in order to teach some sort of moral lesson to people? Thank god we don't design planes that way, I guess.
When your attention is drawn to a rear camera system you've now ditched that spacial model entirely and have changed to modeling the video game on the screen in front of you. This context switch is -very- expensive to unwind and at least momentarily costs you your awareness of where everything else except the back bumper is in space, and what's in front or to either side of the vehicle.
As far as mirrors go, they aren't to be relied on solely as they do not provide a full picture of the vehicle's surrounds. Checking one's blind spots by turning your head and actually -looking- in your blind spot before merging is a thing. same goes with the rearview.
Hope that clears up your confusion.
I assure you, that was not a nuisance.
The reason they the US mandated backup cameras was due to accidents like this.
They were that common.
from your original point.
> In response to your post however I think we can dispense with the notion that folks backing into parked cars, light posts, etc, represents anything more than a nuisance to whoever owned the property that got backed into. Yeah it says "crash" in the writeup but we're not talking Michael Bay style 8 lanes of exploding cars here.
Given the complete lack of any empathy at all you've shown, I don't expect you to change your mind on this, but please try to consider if we have a way to prevent deaths, then maybe we should try and not just consider a parent backing over their child to "represents anything more than a nuisance to whoever owned the property that got backed into."
I could go on at length about the consequences of trying to play whack-a-mole with human stupidity and how that just breeds stronger idiots. There have been no significant changes to vehicle-related death statistics since the 90s when airbags were mandated, despite significant improvements to crash protection and countless here-let-me-help-you-with-that safety features that have been introduced in the last 30 years. So what do you call it when improving safety doesn't actually improve safety?
USofA exceptionalism?
Road Deaths per 100,000
https://en.wikipedia.org/wiki/Motor_vehicle_fatality_rate_in...https://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_i...
I mean, if you look at the data, you'll very quickly see you're wrong
https://tc.canada.ca/en/road-transportation/statistics-data/...
Fatalities have gone only down over teh past 20 years.
Your assertion that car deaths haven't moved is false
A $2 speaker would work just fine. You would still hear it over the radio. If your radio is so loud you couldn't hear it while parking you have bigger problems. A shared bus might be more efficient, but it is not more redundant. I would rather spend $2 on redundancy here.
But do you? Why not have a plain old audio connection that goes to the audio system? It doesn't have to be on the CAN.
* Where's my car? Press the button, get a honk.
* Lock the doors. If they're powered, close themi first.
* Unlock the doors. If they're powered, open them afterward.
* Warm up the car, it's cold outside.
* Cool down the car, it's hot outside.
So that's five buttons on a remote, maximum. None of them require connection to infotainment systems.
* Lock button. Hold it down to get a honk.
* Unlock button. Hold it to get the car started; if the interior temperature of the cabin is outside a set range, warm or cool it appropriately.
Make one button big and round and smooth and bright, and the other one big and square and textured and dark.
There’s some competition here in that a marketplace of insurance companies can compete on the premiums so there can be downward pressure, sometimes. But for things that impact all insurance companies like this equally, then insurance companies would also be opposed because more expensive repairs = more money in their pocket.
That’s why you see things like medical insurance not being aligned with lowering medical costs.
That's not my experience in the UK and Norway. At least with the good insurance companies. I creased the rear passenger door of my Tesla S in the UK three years ago. It was purely cosmetic damage confined to a 10 cm diameter area at the front bottom corner. My Norwegian insurance paid 4 kUSD for a new door skin and a repaint of almost the whole side of the car at the Tesla recommended body shop and ten days of car rental.
It's interesting to see how such things differ from country to country and insurer to insurer.
Health insurance companies are lambasted all the time for denying coverage for certain procedures or medicines or requiring prior authorizations to prove it is medically necessary or evidence based treatment.
https://www.oliverwyman.com/our-expertise/insights/2023/mar/...
> MEDICAL LOSS RATIO TRENDS
>Reported loss ratios are 89.4% for Elevance (fka Anthem), 86.0% for CVS Health (Aetna), 83.8% for Cigna, and 82.8% for UnitedHealthcare. Loss ratios have been impacted by seasonal patterns and the return to more stable utilization than seen in 2020.
Seems like an unsubstantiated conspiracy theory.
Are there really people out there who wouldn’t otherwise buy insurance, but they choose to do so only because the cost of repairs is too high?
I don't carry collision insurance on my daily drivers (the newest of which is 9 years old), because it's too expensive for the coverage offered.
Said differently, what is blocking you from doing the repair today? Is it just that the sensor needs coding to the car or calibration?
Back in 2013/2014, my Jeep was rear-ended. Some of the body panels were back-ordered, so the repair took 2 months longer than expected. Even if I was could have done the body repair, I couldn't have purchased the parts.
Likewise, a co-worker had his airbags stolen last year and it was many months until Acura had replacements available.
A mystery that resolves itself by the end of the sentence: who the hell would steal airbags? Clearly, there's demand from people who don't want to wait months for a replacement... talk about making a market.
Someone who didn't want to pay $400-800 per bag to get their banged up car back on the road.
Who the hell buys used tires? Who buys used catalytic converters? Who puts mismatched fenders on their car?
People who need a car to get to work and don't have a lot of money and, in the case of bags and fenders, may (wisely) not have collision coverage...
I suspect that most people who need airbags are still buying them; they're just buying them at the end of a chain of fencing stolen bags.
We have categories of write off, so if insurance has paid out it affects the future value of the car.
This would be a category D [0], which makes a big difference on resell.
0: https://www.rac.co.uk/drive/advice/know-how/what-is-a-catego...
We have a company called CarFax that produces vehicle history reports for used cars, but there are many problems with it. Starting with the fact that all reports are voluntary. I have looked at cars that were clearly in floods when you know what to look for and yet the CarFax was squeaky clean.
A salvage title is only used when someone intends to restore the car, and then it goes back to a normal title once restored (or at least that is how my state did it 15 years ago - each state is different). You get the salvage title only to justify paying taxes on the actual value of the car (sales tax on a car is for actual value not the price you paid, so a salvage title is useful to prove it isn't worth what the book says) It will show up on CarFax as restored then. (though as you note most such issues never get a salvage title as they are not sold)
A car with a salvage title stays branded with “rebuilt” or “restored” in all common scenarios. There are ways to wash them to unbranded, but most are unethical and involve retitling in different states and such, rather than simply restoring the car.
Regardless, unless dealing directly with the DMV, most people call a branded title a salvage title, or at least say something like, “the title isn’t clean”.
https://en.m.wikipedia.org/wiki/Salvage_title
What? Accidents, even after repair, decrease the resale value of a car, significantly in the case of a young or exotic car, less so for an older, more pedestrian car.
Having been in an accident removes some possible buyers from the pool. (Some buyers will not knowingly buy a car with damage history.) That necessarily changes the balance of supply and demand for that car.
If you had a choice between buying a car that was in a crash and repaired versus the otherwise identically equipped car that had never been crashed, which would you choose? Lots of buyers prefer the latter option, which is why they're worth more than the former option.
There are two ways to sell a sub-prime car: 1) lower the price, and 2) wait for a less-than-diligent buyer to come along. Many private sellers and dealerships are perfectly fine with #2.
Lots of people do not know how to check for unreported previous damage to a car, and lots of people do not care if the car was in an accident as long as it was repaired, has no obvious damage, drives just fine, and has a green title. These are the people who eventually buy those cars.
> Trade certification for automotive service technicians is compulsory in Nova Scotia, Prince Edward Island, New Brunswick, Ontario and Alberta and available, but voluntary, in Newfoundland and Labrador, Quebec, Manitoba, Saskatchewan, British Columbia, the Yukon, the Northwest Territories and Nunavut.
> Automotive service technician (transmission) trade certification is compulsory in Ontario.
> Automotive service technician (steering, suspension and brakes) trade certification is compulsory in New Brunswick and Ontario.
https://www.jobbank.gc.ca/marketreport/requirements/14799/ca
In Ontario, as parent and I indicated, it's a compulsory trade. It is, in fact, a government regulation directly.
https://www.skilledtradesontario.ca/about-trades/work-in-the...
I actually did that once. The claims adjuster was pretty surprised at the request, and she confirmed multiple times that I really wanted them to pay out less money (parts but no labor). Then she was like, "Well, I don't know why you'd want to, but it's your decision, so OK."
The reason: someone stole my stereo and, in the process, they destroyed several pieces of the dashboard. The insurance didn't cover my (aftermarket) stereo, just the dashboard.
I was going to install a replacement stereo myself. I had installed the other one (that was stolen), so I already knew how to do it, and I knew that stereo installation requires removing the same dashboard parts. If I'd let insurance pay a shop to do it, I would have needed to have them install the parts, then take it home and remove the same parts, install the stereo, and then put them back. Buying parts at the dealer is less work and takes less time.
You likely talked yourself out of additional money.
Walking away with leftover cash in your pocket is a normal and above-board part of the process if you can do the repair more cheaply/by yourself/don't get it fixed; it's not fraud.
A friend had paint damage to his truck caused by a canopy (a large EZ-UP) being blown into it repeatedly during a storm. He filed a claim and the adjuster determined it would be something like $5,000 for a proper repaint.
He asked another friend of ours–who worked in insurance—if it was okay to just keep the money and ignore the paint damage: "Yeah, you suffered a loss, you were compensated for that loss, that's all there is to it. It's up to you if you want to repaint, or if you consider it diminished value compensation, or whatever. It's your money free-and-clear."
It feels wrong somehow, but it really isn't. Just don't try to claim the same damage again in the future.
I hit a deer a few years ago and made $5000.
It’s depressing that the will of the people that passed this ballot measure can get pre-empted like this. Before it passes? Sure. But afterward you’re just disenfranchising the voters.
I think the saddest part is there probably isn't an auto manufacturer that isn't a participant in the lobbying campaign against bills like this. I can't even vote with my wallet in this situation.
At this point I'm hoping I'll be able to buy an electric kit car that can satisfy my minimal needs in the near future so I don't have to deal with modern vehicles and their shithead manufacturers.
Reading the book Street Level Bureaucrats was eye-opening for me on why seemingly “common-sense” solutions like Direct Democracy end up either just not working or having the opposite of the intended effect. Laws are less like writing software for a computer and more like designing processes for a team writing software.
Right now if you look it up, GOP state governments are working hard to kill the ability for citizens to enact initiatives that could allow them to implement things they want that the state representatives do not want.