Driving Freedom: Black Boxes Still Lack Consumer Protection
As the working group chair for the IEEE 1616 family of standards, which includes the first universal standard for motor vehicle event data recorders, my goal is to inform the public about an evolving and disruptive technology that will have a direct impact on the current and future generations of vehicle owners, drivers, passengers, and pedestrians.
I advocate for fair usage of event data recorders (EDRs) [right], more popularly known as “black boxes,” which capture information such as the speed of a vehicle and the use of safety features. In the event of a collision, this information can help officials understand what went wrong. However, despite the fact consumers continue to be interested in safety advancements, they remain concerned about issues of privacy, tampering, hacking, and misuse of vehicle crash data.
In the United States, the National Highway Traffic Safety Administration (NHTSA) proposed a new rule in December 2012 that would require automakers to install EDRs in all passenger vehicles starting 1 September 2014. But most car manufacturers already have these devices in new vehicles. In August 2006, NHTSA issued a rule requiring automakers to inform car buyers whether an EDR has been installed, starting with the 2011 model year.
EDR technology was originally built into a sensing diagnostic module (SDM) in each vehicle that controls air bag deployment. The initial motivation for this was to defend manufacturers against claims that the air bag system had malfunctioned and caused injuries. And the safety motivation was to enable improvements to the deployment system. The data evolved to promote a better understanding of vehicle and operator behavior before crashes occurred. EDR-related applications include retrieving, gathering, and storing objective data that may improve highway efficiency, mobility, productivity, and environmental quality by providing compelling evidence of the types of crashes that occur, the role of human error, and issues related to systems engineering and integration.
Today, EDR access has become standard procedure for crash investigations in both criminal and civil cases.
Much of the data to be derived from EDR technology is information that eyewitnesses could not provide from observation alone. The “he said, she said” crash story is no longer valid. Approximately 5.25 million crashes will take place this year in the United States alone and no two accidents will be identical.
However, many privacy experts say that it should be the owners of the vehicles, and not a third party such as the insurance company, that should control access to this device. A coalition of privacy and consumer rights experts, civil rights organizations, and members of the general public submitted comments and recommendations to address the substantial privacy risks posed by the agency’s proposal for all vehicles to have EDRs. These included required security standards to maintain the integrity of data collection, as well as establishing best practices to fully protect the privacy rights of vehicle owners and operators.
Ownership of the data recorded in EDRs remains a legal issue with considerable impact on their use for investigative purposes. Currently, 14 states have EDR statutes. See Selected Provisions in State Statutes.
The IEEE EDR standards seek to provide secure evidence at the time of a crash and establish a chain of custody which is essential to establishing the scientific and probative value of the data.
As it stands today, EDRs are woefully lacking consumer protection regulation and legislation.
I would like for Congress to adhere to the National Technology Transfer Advancement Act, which mandates that all federal agencies use technical standards developed and adopted by voluntary consensus standards bodies, as opposed to using standards put forth by the government. Congress would benefit from incorporating IEEE-1616 standards into pending EDR bills since the NHTSA is admittedly unable to promulgate a safety standard that provides the vehicle owner essential consumer protection under its governing statutes and regulations.
At the end of the day, vehicle owners must “own” the EDR data, become “aware” of EDR existence, as well as function and “control access” to the EDR data in their vehicles.