Wednesday Morning Rant

In 1986's Maximum Overdrive, Earth's passage through a comet trail results in machinery of all kinds becoming sentient and then going on a global killing spree, bent on destroying all humans. This goes on for a few days, with everything from trucks to vending machines hunting down and killing people to the best of their ability. The movie was a flop, but also became a minor cultural reference. When machinery runs amok, it's "Maximum Overdrive."

There's no comet, but we may be engineering our way into a literal "Maximum Overdrive" scenario. That is, at least, a fear being discussed by the United States Department of Commerce. In a statement published by the White House on Monday, Commerce is planning to pursue a sweeping "rule change" for suppliers of "smart" vehicle technologies. The short version: no "smart" or autonomous vehicle tech from Red Chinese or Russian suppliers by model year 2027 (software) or 2030 (hardware).

The stated reason why is two-fold: espionage and sabotage. The espionage angle is probably the real purpose of the proposed rule changes. From the statement:

... vehicles' increasing connectivity creates opportunities to collect and exploit sensitive information. Certain hardware and software in connected vehicles enable the capture of information about geographic areas or critical infrastructure, and present opportunities for malicious actors to disrupt the operations of infrastructure or the vehicles themselves.

Knowing where those data are going, who is processing them, how access is controlled and the security of the collection and analysis systems is fairly important. It's obviously important. It's been important for years. The thought of, "wait a moment, rival - or even enemy - nations may be deploying a vast sensor network that can map most or all of the infrastructure in the country, not to mention the movement patterns of millions of American citizens" does not require a grand leap of logic. It's been obvious for years.

And that doesn't even touch on the risks of self-driving cars with bidirectional communication which can - by design or by accident, transparently or surreptitiously - permit remote control. The statement doesn't directly state that Commerce fears a doomsday scenario of autonomous cars being hijacked and smashing into citizens and infrastructure, but it does whisper it as implication (emphasis mine):

... Commerce has determined that certain technologies used in connected vehicles from the PRC and Russia present particularly acute threats. These countries of concern could use critical technologies within our supply chains for surveillance and sabotage to undermine national security.
...
Specifically, the rule covers "vehicle connectivity systems" (VCS) -- that is, systems and components connecting the vehicle to the outside world, including via Bluetooth, cellular, satellite, and Wi-Fi modules -- and "automated driving systems" (ADS), which allow highly autonomous vehicles to operate without a driver behind the wheel.

Is that a real risk? I don't know. I could see it, but I suspect the espionage activity - robust mapping, knowledge of population movements in urban areas, supply chain flow analysis, etc. - is probably the greater risk. Either way, the proposed rule to ice Red China and Russia in these markets will be a heavy blow to those technologies if it goes into effect, and likely a boon to alternate suppliers while other enterprises and countries scramble to fill the void.

But will it work? Perhaps in part, but there's the other obvious problem: data and information security in general. Blocking Red Chinese or Russian hardware and software will remove an obvious vector for vulnerabilities and close off various entry points to those state actors, but so long as "smart" and "autonomous" cars are a thing, someone will have access to the data feeds and control mechanisms, and that someone will be responsible for securing them. If Red China or Russia are blocked from selling these technologies and systems in the US market, that will not stop them from trying to steal the data or identify and exploit non-deliberate vulnerabilities through cybercrime. Both countries have decent track records of doing just that, with big events like the OPM data breach in 2015, which was allegedly carried out by Red Chinese state actors.

This proposed rule is something I suspect will help at least somewhat if it's implemented, but "smart" stuff and "internet of things" stuff is also a Pandora's Box, and the box was opened long ago. I doubt it will turn into "Maximum Overdrive," but assessing and attempting to manage the espionage, privacy and security implications of these mushrooming sensor networks is an increasingly important area for both technology and policy.

posted by Joe Mannix at 10:45 AM

| Access Comments