The National Highway Traffic Safety Administration (NHTSA) has dropped its opposition to a motor vehicle right-to-repair law in Massachusetts that unlocks vehicle data after the state explained how manufacturers may comply in a way that lessens the cybersecurity risk.
NHTSA said it has received assurance that access to vehicles’ mechanical data by owners and independent repair shops can be provided through short-range Bluetooth and other wireless connections rather than riskier long range communications.
This summer NHTSA raised concerns about the cybersecurity risks if the state required car manufacturers to grant remote access to owners and independent shops over a large geographical area. The agency feared that the ability to, at scale, remotely access and send commands could affect a vehicle’s critical safety systems. It warned that car makers providing such long range remote access would be violating the federal Motor Vehicle Safety Act and thus it would pre-empt the state’s new law.
The law, known as the Data Access Law, is facing a court challenge by manufacturers, who welcomed the NHTSA’s opposition.
But after consulting with the Massachusetts attorney general, NHTSA said it has learned that manufacturers can satisfy the state law, as well as federal motor vehicle safety rules, by providing independent repair facilities wireless access to a vehicle from within close physical proximity to the vehicle, without having to provide long-range remote access.
“In NHTSA’s view, a solution like this one, if implemented with appropriate care, would significantly reduce the cybersecurity risks— and therefore the safety risks—associated with remote access. Limiting the geographical range of access would significantly reduce the risk that malicious actors could exploit vulnerabilities at scale to access multiple vehicles, including, importantly, when vehicles are driven on a roadway. Such a short-range wireless compliance approach, implemented appropriately, therefore would not be preempted,” Kerry Kolodziej, NHTSA assistant chief counsel, said in an August 22 letter to the attorney general’s office.
In a return letter, Eric A. Haskell, assistant attorney general for Massachusetts, confirmed that short-range solutions would satisfy the law. He said manufacturers may utilize any type of wireless communication technology, “so long as it provides the features, capabilities, and access required by the law—including, but not limited to, the ability to directly access all mechanical data.”
The types of wireless communication technology that might be used include, but are not limited to, cellular, Wi-Fi, and Bluetooth, he wrote.
“[W]e can confirm NHTSA’s understanding that a platform that provides the required features, capabilities, and access using a short-range wireless protocol such as Bluetooth is one approach that a vehicle manufacturer might use to achieve compliance with the Data Access Law. We appreciate the clarification of NHTSA’s position that such a short-range compliance approach, implemented appropriately, therefore would not be preempted by the Motor Vehicle Safety Act,” Haskel added.
“NHTSA strongly supports the right to repair,” wrote NHTSA’s Kolodziej, expressing pleasure at having identified a way that the Massachusetts Data Access Law “may be successfully implemented—promoting consumers’ ability to choose independent or do-it-yourself repairs— without compromising safety.”
The Data Access Law requires auto manufacturers selling cars in Massachusetts to equip them with a standardized open data platform so that vehicle owners can access their telematics data through a mobile device and give consent for independent repair facilities to access that data and to send commands to the system for repair, maintenance and diagnostic testing.
The new law builds on an existing state right-to-repair law requiring manufacturers to provide independent shops with the non-proprietary diagnostics information and instructions needed to repair cars.
The law was passed by voters two years ago but has been challenged in court by manufacturers. NHTSA’s opposition in June had posed a potential roadblock. That NHTSA opinion put it at odds with voters, elected officials, consumer groups, independent auto service and parts businesses, and even the Biden Administration’s own policies aimed at promoting competition.
The NHTSA letters are part of the record in federal court in Boston.
Massachusetts Attorney General Andrea Joy Campbell began enforcing the law on June 1 despite the ongoing litigation after the court denied a restraining order sought by the industry coalition.
The coalition of car and light truck manufacturers — the Alliance for Automotive Innovation— that has sued to block enforcement of the Massachusetts law claims, among other things, that it represents a “data grab” that would expose data that goes beyond what is necessary to diagnose and repair a vehicle.
The coalition agrees with the earlier position of NHTSA. “Far from protecting consumers, the law puts consumer safety at risk by allowing third parties to access, and modify, that data on auto manufacturers’ systems without the manufacturers’ authorization,” the industry’s complaint argues.
The industry also contends that automotive right-to-repair already exists in that 70% of “post-warranty automotive work today is handled by the independent repair community.”
Topics Auto Massachusetts
Was this article valuable?
Here are more articles you may enjoy.
Billion-Dollar Satellite Risks Upending Space Insurance 
Citizens Suspends Binding, Could Be Most Affected as Hurricane Aims for Big Bend 
Burger King Must Face Lawsuit Claiming its Whoppers Are Too Small 
Rate Hikes Not Bringing Profit to US Auto Insurers: Fitch 
