High-tech cars vulnerable to hackers, builders tell U.S. senator

Automakers are cramming cars with wireless technology, but they have failed to adequately protect those features against the real possibility that hackers could take control of vehicles or steal personal data, according to an analysis of information that manufacturers provided to a senator.

U.S. Senator Edward Markey asked automakers a series of questions about any safeguards against hackers built into their vehicles. The Massachusetts Democrat also asked how the information vehicle computers gather and often transmit wirelessly is protected.

• Phantom car break-ins in Montreal area baffle authorities
• How practical is Google's driverless car?

Markey posed his questions after researchers showed hackers can get into the controls of some popular cars and SUVs, causing them suddenly to accelerate, turn, sound the horn, turn headlights off or on and modify speedometer and gas-gauge readings.

The responses from 16 manufacturers "reveal there is a clear lack of appropriate security measures to protect drivers against hackers who may be able to take control of a vehicle or against those who may wish to collect and use personal driver information," a report by Markey's staff concludes.

• Carmakers ignore hacking security risk, security expert says

Electronic control units

Today's cars and light trucks typically contain more than 50 electronic control units effectively small computers that are part of a network in the car. At the same time, nearly all new cars on the market today include at least some wireless entry points to these computers, such as tire pressure monitoring systems, Bluetooth, internet access, keyless entry, remote start, navigation systems, WiFi, anti-theft systems and cellular-telematics, the report said.

Only three automakers said they still have some models without wireless entry, but those models are a small and declining share of their fleets.

"Drivers have come to rely on these new technologies, but unfortunately the automakers haven't done their part to protect us from cyberattacks or privacy invasions," Markey said in a statement.

Among the report's findings:

• Most manufacturers said they were unaware of or unable to report on past hacking incidents. Three automakers declined to answer the question.
• Each manufacturer is handling the introduction of new technology in different ways, and for the most part these actions are insufficient to ensure security. Hackers can get around most security protections cited by manufacturers, according to the security experts Markey consulted.
• Only one manufacturer appeared able to detect a hacking attempt while it was happening, and only two described credible means of responding to such intrusions in real time. Information from most automakers indicated they wouldn't know about a hacking attempt unless data from the vehicle's computers was downloaded by a dealer or at a service centre.

Most new cars are also capable of collecting large amounts of data on a vehicle's driving history through an array of pre-installed technologies, including navigation systems, telematics, infotainment, emergency assistance systems and remote disabling devices that allow car dealers to track and disable vehicles whose drivers don't keep up with their payments or that are reported stolen, the report said.

Personal data vulnerable

Half the manufacturers said they wirelessly transfer information on driving history from vehicles to another location, often using third-party companies, and most don't describe "an effective means to secure the data," the report said.

Manufacturers are also using personal vehicle data in various and often vague ways to "improve the customer experience," the report said. Policies on how long they store drivers' information vary considerably. Customers often are not made aware explicitly of the data collection and, when they are, they frequently cannot opt out without disabling valuable features like navigation.

Last November, 19 automakers accounting for most of the passenger cars and light trucks sold in the U.S. agreed on a set of principles to protect motorists' privacy. The voluntary agreement was aimed in part at heading off possible legislation. Markey has said voluntary efforts don't go far enough.