You Can Legally Hack Your Own Car, Pacemaker, or Smartphone Now (wired.com) 106
Earlier this year, we ran a story about how even possessions as personal as one's car or tractor, or insulin pump could not be legally hacked by the owner, but those constraints are things of the past now. From a report on Wired: Last Friday, a new exemption to the decades-old law known as the Digital Millennium Copyright Act quietly kicked in, carving out protections for Americans to hack their own devices without fear that the DMCA's ban on circumventing protections on copyrighted systems would allow manufacturers to sue themt (Editor's note: the website may block users who use adblocking tools. Here's an alternate source). One exemption, crucially, will allow new forms of security research on those consumer devices. Another allows for the digital repair of vehicles. Together, the security community and DIYers are hoping those protections, which were enacted by the Library of Congress's Copyright Office in October of 2015 but delayed a full year, will spark a new era of benevolent hacking for both research and repair. "This is a tremendously important improvement for consumer protection," says Andrea Matwyshyn, a professor of law and computer science at Northeastern University. "The Copyright Office has demonstrated that it understands our changed technological reality, that in every aspect of consumers' lives, we rely on code," says Matwyshyn, who argued for the exemptions last year. For now, the exemptions are limited to a two-year trial period. And the security research exemption in particular only applies to what the Copyright Office calls "good-faith" testing, "in a controlled environment designed to avoid any harm to individuals or to the public." As Matwyshyn puts it, "We're not talking about testing your neighbor's pacemaker while it's implanted. We're talking about a controlled lab and a device owned by the researcher."
About damn time! (Score:5, Insightful)
Re: (Score:3)
Nor does it mean you won't be held liable. If you hack your Tesla auto-pilot and it drives you into a market full of screaming people. You're liable not Tesla.
Re:About damn time! (Score:5, Informative)
you are liable even if you don't hack it.
Re: (Score:2)
AFAIK that has not been tested...
but if you had hacked the Tesla it is a much more obvious conclusion.
Re: (Score:3)
according to Tesla, https://www.tesla.com/videos/e... [tesla.com]
"While truly driverless cars are still a few years away, Tesla Autopilot functions like the systems that airplane pilots use when conditions are clear. The driver is still responsible for, and ultimately in control of, the car."
Re: (Score:3)
Well if Tesla says they're not liable for product malfunctions, that's the end of it. /sarc
Re: (Score:2)
just noting their stand, the validity of their liability is what the court system is for, however since the laws have not changed, you the driver (non driver) is still held to be responsible for now.
Re: (Score:1)
not if you can show it to be a manufacturer fault
Re: (Score:2)
since the laws have not changed, you the driver (non driver) is still held to be responsible for now.
What current laws preclude manufacturer liability in the event of an accident due to a manufacturing or design defect?
Ok, ok, that was a rhetorical question. There's actually an entire body of law built around exactly the opposite proposition. It's called, aptly enough, "product liability" law. You can read some commentary by actual product liability lawyers on the allocation of liability for self-driving cars here [law360.com].
Re: (Score:2)
yes this is true, but in this particular case, when the manufacturer is saying its not autopilot in practice, you are still held liable till a jury puts the burden solely on the manufacturer. and if the jury decides that you should have listened to the manufacturer and not believed autopilot to be autopilot then you are still held liable.
Re: (Score:2)
I think you are liable even if they don't scream.
I think you are also liable to scream...
I think you should for appearances sake anyway...
Laughing maniacally is right out...
Re: (Score:3, Funny)
If the people in the market were screaming, they must have seen me and it's their responsibility to get out of the way of my Tesla -- just like bicyclists and ICE powered cars are expected to do.
Re: (Score:1)
There won't be any challenges, they just won't sue you under the DMCA.
They'll still void any warranty you may have and either refuse to work on it, or just fuck you bigtime if anything goes wrong that's even remotely connected to the "hack".
Re:About damn time! (Score:4, Informative)
That's a victory!
No, that's what the Magnuson-Moss Warranty Act is for. In order to void your warranty, the burden of proof is on them to show that your modifications caused the problem.
Re: (Score:2)
While technically correct, they will still win that battle in anything but an actual legal judgement. They have lawyers and plenty of resources and time, while you have a broken car, a job you have to go to, and rent / mortgage to pay. And you probably don't have the retainer for a lawyer's time to fight the kind of asshat company that would have used the DMCA to sue you yesterday, but can't today.
Re: (Score:2)
There won't be any challenges, they just won't sue you under the DMCA.
They'll still void any warranty you may have and either refuse to work on it, or just fuck you bigtime if anything goes wrong that's even remotely connected to the "hack".
Right now, everything I own that this is subject to is out of warranty. Do you replace everything when the warranty expires?
Re: (Score:2)
I certainly don't. In fact, I can't think of anything that I've ever replaced when the warranty has expired, because the warranty has expired.
I'm not even sure that could be a rational decision. Costs-wise, if it's still working, but the warranty has expired, then you continue to use it until it fails, and then assess the cost of repair. Possibly, if it's a leased or rented bit of equipment and the warranty expires, then it would become rational to say to
Re: (Score:3)
Actually, I've already got one: a pacemaker is a medical device, and altering its code changes it, thus is verboten. This is a good thing: every time a medical device's firmware changes, it needs re-certification, so they can't just load new shit into their devices and sell them as if they were already FDA-approved and tested to perform their function correctly. It's also a bad thing, because device makers don't update code so as to avoid recertification; we really need a strict-audit process to allow u
Re: (Score:2)
Actually, I've already got one: a pacemaker is a medical device, and altering its code changes it, thus is verboten.
The article mentions that the exemption is mainly focused on researchers in laboratory conditions. It's unlikely that anyone's planning to alter the code on their (or anyone's) pacemaker, but this opens up avenues for further research and analysis. If we're lucky, it could feed back into the device maker's coding processes, and speed up testing, meaning more (certified) updates. Public betas for pacemakers, as it were.
But as you pointed out, there's a hell of a lot of paperwork involved with the FDA alre
Re: (Score:2)
It's unlikely that anyone's planning to alter the code on their (or anyone's) pacemaker [...]
At least not without testing it on Dick Cheney first...
Re: About damn time! (Score:2)
He has a heart?
Re: (Score:2, Informative)
Actually, I've already got one: a pacemaker is a medical device, and altering its code changes it, thus is verboten. This is a good thing: every time a medical device's firmware changes, it needs re-certification, so they can't just load new shit into their devices and sell them as if they were already FDA-approved and tested to perform their function correctly.
FDA certification means nothing. I've seen dreadful code approved by the FDA.
Re: (Score:2)
The FDA's interest is in the device being marketed. If you're an idiot and want to play with your own pacemaker, they have no say in it. There is also the more likely case of a security researcher testing an un-implanted pacemaker.
They have no authority over personal use at all. If you want to make your own custom drug in the bathtub, they can't stop you as long as you don't market it.
Re: (Score:2)
So you can hack if you are doing "security research" on it or are "fixing it." Won't the companies just say, "You are not a recognized Security Researcher!" Or even better, "You are not allowed to fix it . . . because it is not broken!"
VW's firmware wasn't broken . . . it did what it was designed to do . . . cheat on emissions tests. Of course, the US EPA sees it differently . . . but is there an EPA law anywhere that you cannot cheat on emission tests . . . ?
Of course, VW has lost the trust of its cus
Re: (Score:3)
Given the security track record of automakers, medical device manufacturers and (to a somewhat lesser degree) smartphone OEM's, I think it'll be a while before we need to worry about that.
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
What about running the software to talk to the car (Score:3)
What about running the software to talk to the car?
Can they make an DMCA clam on it?
Re: (Score:2)
If you develop it all yourself and keep it private, you will be golden, transferring it to somebody else or using it on somebody else's car is not so good.
Re: (Score:2)
ok then what about posting that software / info on the web can they use the DMCA on that?
Can they use the DMCA to stop jiffy lube form using the dealer only reset change oil light code?
Re: (Score:2)
Posting software that works around software protections can still get you in trouble with the DMCA, even if it's 100% your own code. This was tested the very first time someone managed to figure out the DVD encryption scheme and published his software.
Re: (Score:2)
It wasn't the software that got him into trouble, it was the decryption key.
Re: (Score:2)
Will there be pearls in these DMCA clams?
Awesome! I've been waiting to hack my packemaker! (Score:5, Funny)
I hear it is really easy to overclock them.
Just update this regist-aaaaaarrrrghhhhh
Re: (Score:2)
With default passwords of course.
Re: (Score:3)
Re:Awesome! I've been waiting to hack my packemake (Score:5, Insightful)
I'll bite:
Because Pacemakers (and the related implanted defibrillators) are something that independent security research on is a good thing.
Up till now, however, anyone hacking these for research could be sued under DMCA.
Another good effect:
Voting machines! (Assuming you manage to legally acquire one).
Re: (Score:3)
Is there a law preventing one from buying a voting machine?
Say that I run ... let's say, the Student's Union (managing the pub, laundry, band practice room, and cafe) of Smallsville University (dedicated to the memory of Derek Smalls [wikipedia.org]) ... and I approach Diebold (I may remember the name wrongly) to buy a voting machine for conducting our Union's internal democracy, then they'd turn me away citing [law number and section, of year].
Diebold may ch
Re: (Score:2)
Re: (Score:2)
now you have done your daily cardio,
Decades old?! (Score:1)
The DMCA is not decades old yet. It was enacted in 1998, and while it does pull together two sets of treaties from 1996, the DMCA itself is ONLY 18 years old.
Re: Decades old?! (Score:1)
Cue unsavoury sex jokes
Re:Decades old?! (Score:5, Interesting)
I believe it was technically 'passed' in 1998 but was actually 'enacted' (went into effect) a few months into 2000, because of fears that the DMCA (hence the term 'millennium' in the name) would impact the Y2K issues that needed addressed.
People in the know were afraid that DMCA would block Y2K fixes that were needed. (they were right to worry about this, but not right enough to realize 'wait why are we passing a law that we already know has major issues... ohh wait... thank you for the donation MPAA, RIAA, etc)
Re: (Score:1)
Not in the US, but it is very much old enough to fuck you.
Re: (Score:2)
So is it not accurate to say the DMCA is 1.8 decades old?
Re: (Score:2)
In which Universe would that not be an accurate thing to say?
EPA rules? (Score:2)
I bet if I put the good code back into a diesel VW ECU someone will be butthurt.
Re: (Score:2)
Perhaps, but it won't be VW causing the pain... It will be the big guy EPA we call "tiny" taking advantage of you and your rabbit.
Re: (Score:3)
You realize the old code passes smog checks?
I don't believe OBD2 even has a check version# function. Even if it does that will be easily hacked up to version FFFF.
The truth is: I wouldn't drive a water cooled VW if you paid me. I might make a side business of making diesel VWs run better again, than sell them. The problem would be how do you tell prospective customers you've unfucked the ECU without drawing heat.
There just isn't enough money in it for me, could just Creative commons a project (torren
Re: (Score:2)
You realize the old code passes smog checks?
Right. But only during the smog check.
Re: (Score:1)
You're not disagreeing.
Re: (Score:2)
Not disagreeing. But the point of the law was not just to pass smog tests. It was to reduce emissions below some mandated level during all operating conditions.
Re: (Score:2)
Fucking law abider.
Re: (Score:1)
I don't drive a VW. I drive a THUMPING V8 that takes about 30 hours of work every time I have to smog it.
Keep that sweet butthurt flowing, makes me want to buy a pre-smog diesel truck so I can roll coal on you.
Kickstarter for source code and tools for my car? (Score:3)
Could someone do a kickstarter to open up my car's SW and create dev tools for it? I have a 2015 Subraru Outback with EyeSight and I've already taken into the shop for two SW bug updates (one affected braking). I won't necessarily change anything, but it'd be good to have a look see. I'd also like an assessment of the SW quality level from someone knowledgeable in automotive programming. I could imagine a new kind of car review site that will take car code and run it through non-real time simulations and perform quality assessments just like other parts of the car are reviewed.
Re: (Score:3)
Google 'Subaru ECU tuning'. Not everything you want, but mostly.
The laws against this, haven't been stopping anyone. Thank dog for racers.
Re: (Score:2)
I've got a friend who works for Mitchel1, who has been assisting me in that kind of endeavor for quite a while now. Aftermarket modified chips that allow for some impressive performance upgrades for weekend racers. The only caveat is they won't come close to passing certification and have to be swapped out for smog testing and such. I'd love to find a group capable of creating a board that could hold multiple chips and allow for dynamic switching.
Re: (Score:2)
doesn't APR still allow for this?
Re: (Score:3)
4 program switch out boards were common back in the day when you had to physically change out chips (for Ford Mustangs anyhow).
These days you just reflash the bad code before the smog check, then fix it again after passing.
Not all tunes will necessarily make the car fail smog.
Re: (Score:2)
Heretic. Burn him!
You can pass smog with a cam, but you'll need to adjust the maps. Cams don't trip the visual inspection, being buried pretty deep, neither do oversize injectors.
Do you go around looking at cars and thinking they all need GeoMetro 3 cylinder engines? I think GeoMetros need mice* myself.
* Mouse = small block chevy V8, Rat = Big block chevy V8
Re: (Score:3)
That would be illegal. If you happened to somehow magically have that software, the Librarian of Congress just made it legal for you to use it. Writing ("manufacturing") the software remains illegal, as does trafficking in it, marketing it or offering it to the public.
The problem isn't fixed until DMCA is repealed. LoC can't undo the injustice.
Everyone please remember to vote more Republicrats into Congress next week, in order to prevent freedom from breaking out. Evil depends on you. (just kidding, I know
What about consoles? (Score:1)
I know millions of pissed off playstation owners who would like to turn their systems back into homebrew linux boxes.
John Deere (Score:3)
We're coming after you next!
Calling Doctor Corey... (Score:2)
http://www.salon.com/2002/08/2... [salon.com]
Sorry about the autoplay crap, but that's where he published it.
Here's another link if you prefer
http://will.tip.dhappy.org/blo... [dhappy.org]
Re: (Score:3)
Map Updates for Car Nav Systems! (Score:5, Interesting)
Mostly, I just use my phone these days; Google Maps is always up to date, and I can download maps so I don't need to worry about cell coverage in the middle of nowhere.
Re: (Score:2)
Usually you can get last year's used for about 1/2 the cost. I can't imagine that much changes from year to year. Well, traffic updates do.
Stupid Tom Tom in my Mazda (Score:3)
Now maybe I can finally fix the Voice only option when the car is moving. Stupid Tom Tom is broken enough with out having to figure out what I am saying.
Great news. (Score:2)
... to sue themt (Editor's note: (Score:1)
Why the delay? (Score:2)
those protections, which were enacted by the Library of Congress's Copyright Office in October of 2015 but delayed a full year
What caused this one year delay?
yay for personal property rights ! (Score:1)