BLOGS AND ARTICLES

LAW AND TECHNOLOGY - CYBER SECURITY IN THE AUTOMOTIVE INDUSTRY

By Barak Kamir - Attorney

INTRODUCTION

In this blog I will examine the technological development in the automotive world and the risks that arise from this in cyberspace. Cyberspace, also called "cyber space", is a metaphorical space of computer systems and computer networks where electronic data is stored online and interactive communication is carried out regardless of the geographical location of its users. This space encompasses the Internet infrastructure, communication networks, telephones, databases, command and control systems and other essential systems. Cyberspace is an integral part of every aspect of our lives, and today almost every public or private service we know is partially or fully dependent on the use of computing, computer communication and computerized information systems.

The development of technology in recent years on the one hand allows us to look into the near future, where the vast majority of the devices we use every day will be independently connected to the Internet or have the ability to communicate with each other.

On the other hand, alongside the same advantages and optimization that the computerized systems make possible, a new threat has arisen - the cyber threat. The cyber threat mainly manifests itself in malicious attacks carried out through cyber space aimed at disrupting, disabling, destroying, unauthorized control, stealing information and damaging information.

Today, cyber threats are already a real threat that every country takes seriously. In Israel, the National Cyber System began operating in 2017, by virtue of Government Resolution 2444 of 2015, whose activity is collecting and handling information for the purpose of detecting and handling cyber-attacks.

Further progress on this issue in the State of Israel is in the bill published( in 2018 - the Cyber Protection Law and the National Cyber System. The memorandum of the law details the cyber threat that is growing in the world and the ways of dealing with it in the State of Israel, preparing to receive regulations on the subject, and also   details the mission and role of the national cyber system and what are its rights of action.

For the most part, the standards applicable in Israel in the field of information security are international standards adopted by the Israeli Standards Institute and are detailed in a government document of the national cyber system. Awareness of this threat exists worldwide, so in 2015 the OECD recommended to the countries of the organization to formulate a cyber protection policy that includes dealing with the risks in cyberspace. In May 2018, European Union legislation came into force requiring EU member states to formulate a cyber defense policy, establish a regulation for critical infrastructures and a national cyber incident handling center. In addition, in 2018, the World Economic Forum determined that cyber is one of the five biggest risks in the world and recommended increasing preparedness for cyber incidents.

Cyber threats indeed touch a variety of fields these days, but here I will focus specifically on the cyber threat in the automotive industry. First, the most prominent technology in the field is the autonomous vehicle expected to hit the road in the coming years. In this blog I will not review the autonomous vehicle technology, but the technological innovations presented in it, which  entail similar legal problems. Today, with the development of technology in cars, there is almost no car that is not managed by an internal computer that monitors information and gives instructions to all the parts of the car.

We have often come across films in which we see a hostile remote takeover of a passenger vehicle that caused the brakes to lock or causes it to accelerate against its will. This threat is no longer just a scene in a movie, it is right here. Thus, in 2015, two researchers managed to break into a Jeep company vehicle and disrupt vital systems in the vehicle. The burglary was carried out from the living room of one of the investigators and aimed at a Jeep Cherokee that was driving on the streets of St. Louis, far away from the investigators. The researchers explain that the control of the vehicle's systems was made possible by hacking into the multimedia system, in which they found a weakness. The same hack into the system allowed them to rewrite the firmware of the main vehicle system and thus plant their code that enables control of the dashboard, the braking system, and the steering system. Today, when more and more car companies and countries realize the magnitude of this threat, the cyber security industry in the car industry is developing rapidly and you can see a large number of start-up companies that are trying to find a solution to this threat and very large sums are invested in research and development.

TECHNOLOGIES IN THE AUTOMOTIVE FIELD:

When we examine the technological innovations in the automotive industry, it seems that the most prominent focus is on the technology of connected vehicles. These vehicles are independently connected to the Internet so that they can transmit and receive information to vehicles and infrastructure in the vicinity. Every connected vehicle produced today has a main computer connected through 60 wired and wireless connections that allow it to receive and transmit the information. The introduction of this technology could create a new revolution on the road and bring with it many advantages. Thus, according to the Ministry of Transportation in the United States, the introduction of connected vehicles to roads will make it possible to prevent up to 80% of traffic accidents and even more than 10% of the time spent traveling on roads. In addition, even in Israel, preparations are already being made for these vehicles to enter the roads and the Ministry of Transportation is conducting experiments with technology and models for the standards and regulations that will come with it.

V2V (Vehicle to Vehicle) technology: a system that uses DSRC (Dedicated Short Range Communications) based communication, which allows vehicles to "talk" to each other automatically and autonomously. This technology is a general name for a new concept of transportation infrastructure based on short-range Wi-Fi communication between cars traveling on the road. The car continuously transmits a series of data to vehicles in its immediate vicinity, and they perform rapid processing of the information to help the driver make decisions. The V2V features allow receiving and sending information about the car's speed, the stability control mode, the speed of the wipers, fuel, air pressure in the tires and ,as a matter of   fact, every operational aspect of the vehicle that the computer processes.

V2I (Vehicle to Infrastructure) technology: similar to V2V, this system is based on short-range Wi-Fi communication (DSRC) and allows communication between vehicles and infrastructure (Road Side Units). The system transmits and receives information in real time about the state of the road, traffic accidents, construction zones, parking availability, etc. Such communication is essential for the operation of autonomous vehicles that are expected to hit the road in the coming years, through sharing and receiving information from the infrastructure about road accidents, traffic conditions and road conditions to prevent accidents. In addition to the energy field, technology will enable the flow of data to autonomous vehicles from traffic lights in their traffic lanes, so that the vehicle system will analyze the optimal speed and the most recommended acceleration intensity in order to save energy (fuel/electricity).

V2X technology (Vehicle to Everything): this technology contains the means of the V2V and V2I systems, but its innovation is the ability to "talk" with any electronic device that has access to the Internet. The system will even be able to communicate through the cloud and will not need the mediation of a mobile device in the car.

THE LEGAL HEARING:

The accelerated progress of cyberspace and the threats accompanying it have created a situation in which the law and legislation are trying to catch up with the pace of these developments and create solutions accordingly. It seems that in other information security issues, the understanding that legal regulation is needed is progressing, and standards and regulations are beginning to take shape. An example of this is the developing regulation in the field of information security of medical devices published by the American Food and Drug Administration.

LEGAL DISCUSSION: PRIVACY

A legal difficulty that manifests itself when it comes to smart vehicles linked via the Internet is the protection of personal information of the vehicle users. Using the technologies presented above in the connected vehicles, the car companies will be able to continuously collect information about the identity of the drivers, geographic location, driving style, driver preferences, etc. These databases have a great financial value and may be a target for many hackers. This problem becomes a legal difficulty when the country does not regulate  or adopt an international regulation, and this is because there is no defined standard that can guide those businesses that hold the information. Let's assume that the market forces alone will not be sufficient to determine the required level of security and without a law on the subject, the right to privacy of many citizens is in danger. An attempt to regulate this issue was made in the State of Israel in 2017 when the Law, Constitution and Justice Committee approved the privacy protection (information security) regulations that attempt to close the gap created in legislation in the face of technological changes. These regulations establish a level of responsibility depending on the size of the database and the type of information stored in it, and even require periodic audits by competent parties in information security. In addition, when it comes to the collection of information through the connected vehicles, in the report of the Transportation Authority from June 2018,there is an understanding that there is a need to develop rules and regulations that regulate the collection, use, storage and transfer of information collected through the technology of the connected vehicles. Another potential violation of the privacy of the information collected is the car companies' use of this information without the knowledge of the drivers and even selling databases to other companies. This issue of selling information hit the public when it became clear that the information of 87 million Facebook users was used for the benefit of President Trump's election campaign. In this case, the database was created from an application that ordered people to fill out a questionnaire, and by the way share personal information from Facebook. The information was sold to the strategic consulting company "Cambridge Analytica" which managed to compile approximately 30 million psychological profiles of private individuals to influence their choices. To prevent cases of this type, the GDPR (General Data Protection Regulation) was developed and entered into force on May 25, 2018. The General Data Protection Regulation is a collection of mandatory provisions regulated by the European Parliament, the Council of the European Union, and the European Commission to protect personal information held by companies or organizations in the European Union. This regulation is not only relevant to the residents of the European Union but extends to any company that provides services to the citizens of the Union (even a free service) or holds the information of the residents of the Union. The sanctions from violating the installation and the deterrence they create for the companies are meant to solve the problem and prevent the collection and use of private information without the knowledge and consent of the users.

LEGAL DISCUSSION: DAMAGES

New technological developments in the automotive field and the entry of many start-up companies have resulted in the fact that many systems that come with the vehicle can be replaced and upgraded, thus adding weak points to its computer systems. For example, upgrading the audio system has become standard and many people are replacing the normal radio system with an advanced multimedia system. The upgraded multimedia system can be found in almost every vehicle and allows an independent connection to the Internet using a SIM card installed in it. This system is usually based on the Android platform or Apple's iOS system, thus allowing access to websites, and downloading applications. Another example of multiple non-original components is the chip of the Israeli start-up Engie. The same chip connects to the vehicle's computer and transmits to the smartphone about various faults in the vehicle, collects information about the voltage in the battery, checks oil pressure, fuel consumption and more. Engie's system connects to the OBD (On Board Diagnostics) connection in the vehicle which enables the same connection to the vehicle computer and fault detection and is even found in most car companies following the application of the OBD 2 standard which requires this. This connection does exist in most vehicles due to the standard, but it is a connection that requires physical access to it, and this is different from the Engie company's application, which allows hackers to take advantage of an additional entry point to the vehicle's computer via the Internet.

Therefore, due to the multitude of different factors and companies that provide technology to vehicles, there is a legal difficulty in determining who is at fault when a vehicle is broken into and damage is caused by non-original components. In the case of the Jeep Cherokee vehicle hacking written above, the hacking was through the vehicle's original multimedia system, an event that caused lawsuits against the Jeep company (Brian Flynn vs Chrysler Group LLC). Since the system was original, there is no question about who is to blame for the information security weakness, but what will happen when the hacks are done through devices of companies that are not original?

In the absence of rulings and laws on the subject, the judges will be forced to deal with a new area that is in the gray area. In my opinion, even if there are regulations on the subject, there will be great difficulty in ruling because these cases include many factors, and the distribution of the burden of each of them in the event of damage will be determined according to the laws of the court that will discuss the matter in the coming years.

Another difficulty in determining tortious liability can happen with the introduction of vehicles equipped with V2V, V2I, V2x technology. It seems that in Israel and in the countries of the world there is preparation and expectation of the governments for the absorption of the technology due to its many advantages, but it hasn’t been done legally. The preparations in Israel and around the world include the examination of the technology, its absorption through infrastructures, regulation for charging the technology in every manufactured vehicle and even examination of the issue of information security.

On the other hand, in my research I did not find any legal preparation for determining tortious liability when a hacked vehicle manages to infect vehicles in its vicinity through V2V communication and cause property damage and even harm the traffic light system. Thus, a situation could arise in which a vehicle from company X hit a vehicle from company Y that caused an accident and damage to vehicle Z.

 Will the burden be on the car companies, the private cyber security companies, or on the drivers whose vehicles were hacked in the first place and used as a tool by hackers? In my opinion, the tort issue in this matter is the most problematic legal one due to the multitude of different factors that may constitute independent weak points. In my opinion, it is difficult to solve this issue through standards and regulations because there is a huge number of scenarios that can happen with a similar damage, so the distribution of the tortious burden in each of them will be different. In my estimation, when this technology is introduced, the legal system will develop on the subject "on the fly" and create laws that will include legal tests that will determine how to distribute the tortious burden on each of the parties.

LEGAL HEARING: CRIMINAL

When it comes to the criminal aspect of hacking into the vehicles' computer systems and causing damage, we can refer to the Computer Law. This law defines what is a "computer" and what is "computer material" and specifies what are the prohibited actions that lead to criminal punishment and what is the criminal wrongdoing in the matter.

The law is from 1995, but, since most of modern vehicle systems are computerized and cyber hacks are done by infiltrating these systems, we can apply the sections of the law to the field of information security for vehicles. According to the computer law, the fact that there was an illegal intrusion into a computer is sufficient to establish a three-year prison sentence, while infiltration of computer material in order to commit another offense is punishable by a five-year prison sentence. When we compare it to the law abroad, it seems that in the UK there is a similar computer law that defines what is a computer system and the prohibition of intrusion into it. The clauses of the British computer law are very similar to the Israeli law and I will assume that in the absence of a specific law concerning the intrusion into the computer of vehicles, the computer law in the United Kingdom will be used. The problem with this issue is that, although there are laws that allow prison sentences for cybercriminals in the automotive world, the fact that cybercrime can be committed from a remote geographical location using software that makes it possible to obscure traces in cyberspace,  results in the fact that many of the criminals are not caught at all.

Recently, there has been a trend of companies that have been severely affected by cybercrime to take the law into their own hands and pursue those hackers and decrease damages. This trend will lead to an increase in the apprehension of criminals and their prosecution, but this is a trend of private companies, and it is difficult to assume that there will be anyone who will protect the interests of the private person in a similar way. This difficulty is best expressed in the data of the British government, in which only 45 persons were convicted of computer crimes in 2014 and about 61 in 2015.

SUMMARY:

Today, there is not as much awareness in  the field of cyber security in the automotive industry  as in other cyber fields. The technologies presented above are expected to exist in every new vehicle that leaves the factory, and, along with the many advantages they will provide, there will also  be  many weaknesses that could endanger us on a daily basis on the road and even as pedestrians. The development of this issue has brought the countries of the world to discuss the expected dangers and to develop models for regulations that will come into force with the introduction of the technology.

When it comes to information security standards, we do not encounter new difficulties because these standards already exist and can be applied to any existing cyber security field, but, in my opinion, a uniform standard on the subject will assure that all vehicles manufactured around the world will be protected at an equal level.

As I presented above, my estimate is that the main legal problem will be in the area of torts and that the judges of the future will be expected to encounter an issue that has never been discussed. The difficulty in discussing such an issue is that it is necessary to know the technology in order to determine what the legal tests will be discussed in court and it is expected that there will be a lot of help from experts in the field. In my opinion, the cases of breaking into a car and causing damage from it will be few in the world and there will be a lot of use of the comparative law. Although this field is not known to the public, many startup companies have started to emerge, and the car companies are investing a lot of money (US$837 million  until 2024) to prevent the next disaster.

In conclusion, the next big technology will be in the automotive world and  will come into effect faster than we expect and than we can prepare for it. New fields of laws, and perhaps even dedicated courses in legal studies will try to provide an adequate response in the future.