Daft draft anti-car-hack law could put innocent drivers away for life
Rules proposed in Michigan perfect example of tech-illiterate politicians writing tech rules
Two state senators in Michigan, US, have proposed a set of laws that promise life imprisonment for anyone fiddling with a car's software.
Security researchers are crying foul because the rules as they stand effectively outlaw not just hacker hijackers but also legitimate tinkering with engine and dashboard electronics.
The two bills were proposed by Mike Kowall (R-White Lake) and Ken Horn (R-Frankenmuth). The draft rules state that anyone who repeatedly attempts to "intentionally access or cause access to be made to an electronic system of a motor vehicle to willfully destroy, damage, impair, alter or gain unauthorized control of the motor vehicle," faces life in the slammer.
"I hope that we never have to use it," said Kowall. "That's why the penalties are what they are. The potential for severe injury and death are pretty high."
The proposed laws [PDF] spell doom for a promising area of security research into car hacking in the US state. Vehicle security has become a major topic of concern in the infosec community. Last year's Black Hat and DEFCON conventions were packed with interesting ways to hack our four-wheeled friends.
Charlie Miller, one of the duo who pulled off last year's hacking of a Fiat Chrysler Jeep Renegade – which caused the car company to recall 1.4 million vehicles for a software upgrade – immediately pointed out some of the problems the new law would cause. One being that simply driving your car around town may be enough to fall foul of the legalese.
When you turn the steering wheel, you are accessing an electronic system to willfully alter the motor vehicle. Happily IANAL.— Charlie Miller (@0xcharlie) April 29, 2016
Also, kiss goodbye to customizing your ride with extra gadgets and firmware updates.
@0xcharlie So, no aftermarket stereo installations, either, right?— Timothy Graham (@ghostsarespooky) April 29, 2016
Car hacking is a huge area of concern, since the latest cars are basically computer networks with an engine and wheel attached. All car manufacturers are worried about the specter of in-car hacking, but it has taken the home of Motor City to come up with a law that criminalizes even researching the problem.
It's the same kind of thinking that encouraged the US Department of Justice to propose a sneaky rule change that would allow police to get blanket warrants allowing them to hack any computer in the world. Or the Feinstein-Burr bill that bans web browsers and file compression. Politicians and technology seldom mix well, and the suggested Michigan laws are another example of this. ®