![](\"https:\/\/media.threatpost.com\/wp-content\/uploads\/sites\/103\/2019\/02\/25164549\/Automobile-computer.jpg\")
<\/p>\nBy: Zaq Lacy<\/p>\n
<\/p>\n
<\/p>\n
[1]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In 2015, a pair of security researchers (read that as \u2018hackers\u2019), Chris Valasek and Charlie Miller, conducted an experiment in which they remotely \u2018hijacked\u2019 an internet-connected SUV driven by a volunteer.[1]<\/a> Valasek and Miller gained complete control of the vehicle\u2019s transmission, radio, air conditioning, braking functions, and windshield wipers sprayers, as well as being able to track the vehicle\u2019s exact location.[2]<\/a> In previous experiments, they also were able to mess with braking functions, horn, seat belt, and steering.[3]<\/a> However, in these earlier trials, they were directly wired into the vehicle\u2019s onboard diagnostic interface.[4]<\/a> That was already particularly eerie, but what made the 2015 trial particularly disconcerting was their ability to do it remotely.[5]<\/a> They were not the first to do so; in 2011, other researchers were able to use cellular connection to locate vehicles via GPS, turn on the lights, and start the car by simply sending files via a telephone call.[6]<\/a> Valasek and Miller were, however, the first to achieve nearly unlimited control over a vast majority of the systems that modern cars rely upon to function and keep the driver and passengers safe \u2013 all from the comfort of their couch.[7]<\/a> It was this experiment that resulted in 1.4 million vehicles being recalled[8]<\/a> and was the impetus for legislation regarding digital security standards.[9]<\/a><\/p>\n [2]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Scholars estimate that current luxury vehicles have up to seventy Engine Control Units (ECUs), as well as computer control systems that regulate a surprising number of functions we simply take for granted.[10]<\/a> These are all integrated into the Controller Area Network (CAN), which presents hackers with a potential entry point, granting the hacker access to every system in the vehicle, from the air conditioning and the radio to the air bags and mechanical functions of the engine itself.[11]<\/a> Fortunately, less than a handful malicious hacking attack are known to have occurred to date, one of which was a disgruntled dealership employee who activated the vehicle immobilization feature in around 100 vehicles, effectively disabling them all.[12]<\/a> Despite that, deep concerns are being raised about cybersecurity with newer internet-connected cars, particularly where it concerns automated \u2018smart\u2019 cars.[13]<\/a><\/p>\n [3]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 There are certainly varying levels of vehicle autonomy in the market, from features like Lane Keep and Auto Brake that still require a driver, to fully automated self-driving cars.[14]<\/a> Currently, the main focus of the development of such \u2018smart\u2019 cars is ride sharing services, such as Waymo, Uber, and Cruise, rather than the private ownership market.[15]<\/a> Seeking to appeal to these markets, manufacturers have integrated newer vehicles with heightened multi-layered security that is intended to make remote access more difficult.[16]<\/a> Even so, this past April, a hacker known as L&M was still able to hack around 27,000 accounts of commercial fleets in India and the Philippines and shut down the engines of vehicles moving less than 12 miles per hour.[17]<\/a><\/p>\n [4]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 This raises the particularly pointed issue of liability when it concerns driverless vehicles that are hacked when an injury occurs. Traditionally, accident liability falls upon the driver,[18]<\/a> and it is generally understood that criminal and civil liability arises when a hacker takes control of a vehicle that ultimately injures someone.[19]<\/a> But, what about when there is no driver and the hacker cannot be located? The question, then, is whether liability should fall to the car manufacturer on the basis of product liability for failing to adequately protect against the possibility of remote tampering, to the software developer similarly for failing to provide sufficient cybersecurity, or to the insurance of the owner\/company whose vehicle was hacked.[20]<\/a> Unfortunately, as fully autonomous cars have not yet gained a significant foothold in the U.S. (rollouts are not expected until 2020),[21]<\/a> there has not yet been cause to explore the issue, and, to date, we are left with little guidance. With the current framework, however, it seems likely that if\/when the first cases arise, a new area of law will need to develop rapidly in order to keep up.<\/p>\n [1]<\/a> See <\/em>Andy Greenberg, Hackers Remotely Kill a Jeep on the Highway \u2014 With Me in It<\/em>, Wired.com (Jul. 21, 2015, 6:00 AM), https:\/\/www.wired.com\/2015\/07\/hackers-remotely-kill-jeep-highway\/ [https:\/\/perma.cc\/2VLH-73W3].<\/p>\n [2]<\/a> See id.<\/em><\/p>\n [3]<\/a> See id.<\/em><\/p>\n [4]<\/a> See id.<\/em><\/p>\n [5]<\/a> See id.<\/em><\/p>\n [6]<\/a> See <\/em>Scott L. Wenzel, Not Even Remotely Liable: Smart Car Hacking Liability<\/em>, Ill. J.L. Tech. & Pol\u2019y, no. 1, 2017, at 49, 55.<\/p>\n [7]<\/a> See id.<\/em> at 54.<\/p>\n [8]<\/a> See Who Is Liable When Your Car Gets Hacked?<\/em>, Botto Gilbert Lancaster Att\u2019y at Law: Car Accidents Blog (Oct. 20, 2015)[hereinafter Botto], https:\/\/www.bgsllaw.com\/mchenry-county-lawyers\/your-car-gets-hacked [https:\/\/perma.cc\/9AG2-2W26].<\/p>\n [9]<\/a> S. 680, 115th Cong. (2017).<\/p>\n [10]<\/a> See <\/em>Wenzel, supra <\/em>note 5, at 52.<\/p>\n [11]<\/a> See id.<\/em> at 53.<\/p>\n [12]<\/a> See <\/em>Kevin Poulsen, Hacker Disables More than 100 Cars Remotely<\/em>, Wired.com (Mar. 17, 2010, 1:52 PM), https:\/\/www.wired.com\/2010\/03\/hacker-bricks-cars\/ [https:\/\/perma.cc\/6L8X-JBMD].<\/p>\n [13]<\/a> See <\/em>Fredrick Kunkle, Auto Industry Says Cybersecurity Is a Significant Concern as Cars Become More Automated<\/em>, The Washington Post (Apr. 30, 2019), https:\/\/www.washingtonpost.com\/transportation\/2019\/04\/30\/auto-industry-says-cybersecurity-is-significant-concern-cars-become-more-automated\/?noredirect=on&utm_term=.3f2b1d5ca04a [https:\/\/perma.cc\/XD6Y-Q5BL].<\/p>\n [14]<\/a> See <\/em>Lindsey O\u2019Donnell, Chris Valasek and Charlie Miller: How to Secure Autonomous Vehicles<\/em>, ThreatPost.com (Aug. 10, 2018), https:\/\/threatpost.com\/chris-valasek-and-charlie-miller-how-to-secure-autonomous-vehicles\/134937\/ [https:\/\/perma.cc\/HF6H-B4U9].<\/p>\n [15]<\/a> See id.<\/em><\/p>\n [16]<\/a> See <\/em>\u00a0Kunkle, supra<\/em> note 13.<\/p>\n [17]<\/a> See id.<\/em><\/p>\n [18]<\/a> See <\/em>Christopher Coble, If Your Car Gets Hacked, Are You Liable for a Crash?<\/em>, FindLaw.com (Aug. 24, 2015), https:\/\/blogs.findlaw.com\/injured\/2015\/08\/if-your-car-gets-hacked-are-you-liable-for-a-crash.html [https:\/\/perma.cc\/DJ9C-STWU].<\/p>\n [19]<\/a> See <\/em>Bradley Thayer, Car Hacking Legislation and Product Liability<\/em>, Wash. Or. Law. (Sept. 24, 2015), https:\/\/www.washingtonoregonlawyers.com\/news\/car-hacking-legislation [https:\/\/perma.cc\/Z6XE-5W5M]<\/p>\n