MIADA State Legislature
Supporters say the ballot measure would simply level the playing field for independent car shops. Skeptics say it could have unintended consequences.
By Nik DeCosta-Klipa, Boston.com Staff
September 29, 2020
And yet, this election, voters in Massachusetts are being asked to decide a hugely expensive debate over the seemingly labyrinthine subject of vehicle telematics and data access.
“This is a hard topic for federal safety regulators who understand the intricacies of vehicle design development,” much less the average voter, says Bryan Reimer, a research scientist at the MIT Center for Transportation and Logistics.
But supporters of Question 1 say the 2020 ballot measure simply comes down to creating a level playing field for third-party repair and car part shops, who fear they are being boxed out by automakers.
“When you’re on the ‘no’ side of the campaign, your job is to complicate things,” Tommy Hickey, the director of the Yes on 1 coalition, said in an interview.
If passed, Question 1 would update a “right-to-repair” state law signed in 2013, which mandated that owners and independent repair shops had the same access as carmakers to the vehicle computer information used to diagnose problems by plugging a handheld code reader into a physical port in the vehicle.
The 2013 law came after Massachusetts voters overwhelmingly approved a similar 2012 right-to-repair ballot measure, which had to be reconciled with a previous law signed by Gov. Deval Patrick that summer. It also ultimately resulted in automakers agreeing to a deal in 2014 to make the Massachusetts law the national standard.
However, the law specifically excluded access to what is known as “telematics,” the diagnostic and repair information that more and more newer cars can send wirelessly straight to the dealer. Without that access, independent repair shops say they’re at an extreme disadvantage.
Question 1 would require that car owners can access and share telematics data with independent repair shops. And while opponents argue it could result in unintended consequences, repair shops say they’re currently the ones desperately in need of a fix.
“This is a competitive market,” Hickey said. “And I think we all know what happens in competitive markets if you don’t have up-to-date technology, the best equipment, the best ways of fixing cars. You lose. This could be the evisceration of the aftermarket.”
What exactly is telematics?
The ballot question defines telematics as “any system in a motor vehicle that collects information generated by the operation of the vehicle and transmits such information … utilizing wireless communications to a remote receiving point where it is stored.”
In other words, it’s like using wireless headphones instead of plug-in headphones. But instead of music, the car can transmit information detected by vehicle sensors back to the dealer — from worn-out brake pads to tire pressure to a loose piston pin and other vehicle software components.
“Cars are as much software as they are mechanical hardware,” Reimer said.
Last year, car industry researchers estimated that more than half of the new cars sold in 2018 in North America included telematics services. Hickey says that 90 percent of 2021 models will have the capability, though the rates vary by the manufacturer
What would the question do?
If passed, Question 1 would require manufacturers to create a platform that vehicle owners could access through a mobile application to get their car’s “mechanical” telematics data. The ballot question defines “mechanical data” as anything “used for or otherwise related to the diagnosis, repair or maintenance of the vehicle.”
Beginning with the model year 2022, any car smaller than a mini-bus that uses telematics would need to give owners access to that data through the standardized platform.
The ballot question would also allow owners to give independent repair shops direct access to their car’s telematics data — either permanently or for a limited amount of time in order for them to make the repair. However, the thought behind the initiative — which has received millions from independent chains like AutoZone, Advance Auto Parts, and O’Reilly Auto Parts — is that many car owners may choose the first option.
“To this day, I have no idea what’s going on with my car, so if I had an independent repairer or dealer that I trusted, I would like them to have that information,” Hickey said, noting that others might want to limit access to as little as an hour.
That access would also give shops the same ability as dealers to send remote commands for things like downloading software updates or testing certain in-vehicle functions.
Why is it controversial?
Opponents have raised more than $25 million to defeat Question 1, largely in lump-sum multi-million-dollar donations from major carmakers including Ford, General Motors, Toyota, and Honda.
However, some experts say there are valid concerns about Question 1 that go beyond the financial interests and dealers’ desire to maintain exclusive access to data.
“The ballot initiative creates a series of unintended consequences, because of the timeline and the vague wording of several aspects,” Reimer said. “And unintended consequences can lead to low-probability, high-impact events.”
According to Reimer, automakers are already in the midst of producing 2022 models and requiring them to open up wireless data access at this stage could open up potential cyber-vulnerabilities and possibilities for remote tampering.
“You’re talking about electronic systems that all the manufacturers have been trying for a decade to case harden more,” he said, adding that requiring manufacturers to create an open-access platform on an “accelerated” timeline increases the chances of flaws.
While experts recently told The Boston Globe that TV ads that have flooded local airwaves — raising concerns about stalkers and other predatory actors — are largely sensationalized and based on a differently worded 2014 bill in California. They also said the fears of malicious attacks are not entirely unfounded, even if improbable.
In a July letter to Massachusetts legislators, James Owens, the deputy administrator for the National Highway Traffic Safety Administration, raised concerns about Question 1, given the “incredible amount of danger” posed by cyberattacks on one or more moving vehicles.
“The ballot initiative requires vehicle manufacturers to redesign their vehicles in a manner that necessarily introduces cybersecurity risks, and to do so in a timeframe that makes design, proof, and implementation of any meaningful countermeasure effectively impossible,” Owens wrote.
Owns also said that the wording of Question 1 could render several important techniques — “logical and physical isolation of vehicle control systems from external connections, and controlling access to firmware that executes vehicle functions” — for hardening vehicle systems against such attacks “impossible.”
Still, the Auto Care Association, which represents aftermarket shops, has argued that such cybersecurity concerns are “false and presented to detract from what is at risk for the vehicle manufacturers” in the right-to-repair battle: their ability to make money off vehicle data.
Nearly a dozen cybersecurity experts also denounced the “scare tactics” in a Boston Herald op-ed last week, arguing that Question 1 would “in no way” increase the risk of hacking or other security threats. Additionally, the group, SecuRepairs, said the current model, in which dealers maintain their grip on telematics, presents its own concerns.
“There is one thing the auto industry’s scare-mercials have right: Consumers should be worried about the reams of data that automakers collect from our connected vehicles,” they wrote in the op-ed. “Modern Internet connected cars have access to everything from personal contact data shared from a driver’s mobile phone to video feeds from in-car cameras to the vehicle’s GPS data. Privacy and consumer advocates ranging from the ACLU to Consumer Reports warn that this galaxy of in-vehicle sensors pose acute privacy and civil liberties risks.”
Hickey also stresses that — unlike the failed California bill — Question 1 would only apply to mechanical data, and not personal location data or personal information (though the two sides dispute how broadly mechanical data is defined).
“They’re already collecting this information; all we’re asking is that it goes directly to the owner of the car,” he said.
What happens if Question 1 passes?
One poll last month found that voters sided with the Yes-on-1 side by a nearly 2-to-1 margin, and the 2012 ballot measure also passed by a historically high margin. Hickey says that if the manufacturers’ security concerns were serious, they would have negotiated a compromise with repair shops, like they did in 2012 (though he also noted that the COVID-19 pandemic derailed much of the legislative agenda).
Hickey suggested the Yes on 2 side was still open to legislative tweaks if the question passes.
“There could be something,” he said. “But again, they have not come to the table, so we plan on passing this ballot initiative as is.”
As cars become more and more computerized, Reimer says there needs be a larger policy debate to set ground rules for what types of repairs are reasonable for independent repair shops and what should be left to the manufacturer. To return to the smartphone allegory, he says going to a third-party repair shop to fix a broken screen was reasonable.
“Would you ever consider a third-party application to start messing with what iOS functionality should change?” he said. “If there’s a fundamental problem, we walk into the Apple Store to the authorized dealer.”
Reimer says it’s an issue that needs federal action at some point, if not an updated version of the national agreement among automakers and repair shops in 2014.
“We cannot have 50 states running in 50 different directions,” he said. “We need federal leadership, not state initiatives.”
However, there’s not been much progress on that front — a point on which the two sides agree.
“I don’t know if the federal government can even sign [COVID-19 relief] money for cities and towns, let alone a fix for car manufacturers withholding from owners and independent repair shops,” Hickey said. “But I definitely think there should be a larger conversation.”