Internet of criminal things

Posted Sep 25, 2015 7:43 UTC (Fri) by pr1268 (guest, #24648)
In reply to: Internet of criminal things by dlang
Parent article: The Internet of criminal things

personally I don't think we know for sure what VW did. The execs agreed to cooperate with the investigation this last weekend, which means that there still needs to be an investigation.

Sure we do. VW intentionally cheated the emissions tests with a so-called "defeat device". This investigation has been going on for almost two years (according to our editor's PDF link). The $**t hit the fan only a few days ago when VW came clean (no pun intended) and admitted their scheme.

In fact, this article from last Friday (Sept. 18) said that 500,000 vehicles were affected. But, VW then later admitted 11 million cars worldwide were rigged. Sounds pretty cut-and-dry, IMO.

The EPA has been under fire for the last month due to the massive pollution that they caused, and so have been looking for something to distract the press, the late friday release of this announcement is suspicious.

I'm sure the EPA is relieved at how the VW scandal has deflected attention away from the polluted Animas River, but from what I can tell, the VW scandal had been brewing for quite some time prior to the mine leak.

There are a lot of accusations going around, with very little actual data.

No one was accusing anyone of anything, other than the EPA threatening to withhold certification of VW's 2016 model year diesel cars until the emissions could be fixed. Only then did VW make a public admission of guilt to using software to cheat the emissions tests.

Internet of criminal things

Posted Sep 27, 2015 11:36 UTC (Sun) by ballombe (subscriber, #9523) [Link] (9 responses)

> In fact, this article from last Friday (Sept. 18) said that 500,000 vehicles were affected. But, VW then later admitted 11 million cars worldwide were rigged. Sounds pretty cut-and-dry, IMO.

> Only then did VW make a public admission of guilt to using software to cheat the emissions test

This is true, but this is still very awkward: US companies never make public admission of guilt under any circumstance, they settle the case with the government without admitting wrongdoing.
Why is VW doing otherwise, when it is so easy to say it is just a software bug?

Internet of criminal things

Posted Sep 27, 2015 12:33 UTC (Sun) by pr1268 (guest, #24648) [Link] (8 responses)

Why is VW doing otherwise, when it is so easy to say it is just a software bug?

I honestly don't know. I was sort of begging the same question with my previous post(s) here on LWN. I suppose it might be a cultural difference between Germany and the USA. Or a legal one.

A slightly whacky analogy I draw VW's actions to is that of a murder trial: Just as the prosecution is about to prove the defendant guilty, the defendant then proclaims that not only did he commit the murder, but he murdered ten others, and here's where the bodies are buried!

:-\

Internet of criminal things

Posted Sep 27, 2015 22:06 UTC (Sun) by raven667 (subscriber, #5198) [Link] (7 responses)

I figure that they aren't completely down the hold of magical optimistic thinking so instead of believing that they can lie their way out, which won't work now that there is heightened scrutiny such that any other scam they have going on will probably be quickly discovered, they get out ahead of it, admit enough themselves that investigators will stop digging, publicly shame the CEO and try to get them to absorb as much blame as possible as they go, so as to deflect attention away from those that remain.

The cynical person would say that maybe it's like Watergate where the actions taken were to hide a much more serious crime than what the public knew about at the time.

Internet of criminal things

Posted Sep 28, 2015 19:21 UTC (Mon) by bronson (subscriber, #4806) [Link] (6 responses)

VW believed for more than a year that they could lie their way out of it: http://www.nytimes.com/reuters/2015/09/24/business/24reut...

It took a lot of work and fact checking by CARB/EPA/etc to wear them down:

"We discovered some very strange anomalies," Young said. "For instance, the car was running more cleanly when it was cold than when it was warm, which is the opposite of what every other car does — because once you warm a car up that's when it begins to deliver its best pollution controls. This was not the case. So clearly something else was going on. Over time we assembled enough proof and questions that they could no longer provide any reasonable explanation for what was going on."

I think VW just ran out of things they could plausibly lie about.

Also, pure speculation: engine computers are pretty standardized and not too hard to analyze (much easier than a locked-down smartphone anyway!) It wouldn't surprise me if CARB found evidence of a defeat device on their own and quietly confronted VW about it.

Internet of criminal things

Posted Sep 28, 2015 19:45 UTC (Mon) by raven667 (subscriber, #5198) [Link]

> I think VW just ran out of things they could plausibly lie about.

True, but that has not stopped many other companies before from continuing to lie, even to try propaganda and lobbyists to change the law and public opinion to support their untruth, so VW is actually different in this case.

Internet of criminal things

Posted Sep 28, 2015 19:46 UTC (Mon) by dlang (guest, #313) [Link] (4 responses)

it's worth repeating that the "defeat device" they are accused of installing in the cars is an "if" statement in the software.

Internet of criminal things

Posted Sep 28, 2015 19:50 UTC (Mon) by bronson (subscriber, #4806) [Link] (3 responses)

It's more than that. It needs to sense whether it's on a dyno, and there are going to be some alternate mapping tables.

But, yes, we're probably talking about a few tens or hundreds of lines of software. It's the EPA that named it a "defeat device", not me. :)

Why is it worth repeating?

Internet of criminal things

Posted Sep 28, 2015 20:15 UTC (Mon) by dlang (guest, #313) [Link] (2 responses)

because "defeat device" is scare words as it's being used in the media, and getting people into the mindset that software is a "defeat device" makes them think that it's a great idea to ban software modifications to eliminate the possibility that people can install such "defeat devices" in things.

Not just cars, but the FCC is currently accepting comments on proposing requiring that access point manufacturers be required to demonstrate how they will prevent people who buy the devices from installing DD-WRT or OpenWRT on the devices based on the fact that such open software is a "defeat device"

we lost the definition of "hacker", don't let if statements (and similar code) start being talked about as if it was a hardware device installed in something that can just be locked out.

Internet of criminal things

Posted Sep 28, 2015 20:46 UTC (Mon) by bronson (subscriber, #4806) [Link] (1 responses)

I totally agree with where you're coming from.

However, "defeat device" is a term coined in the 70s (if not before) when the government was trying to outlaw physical devices designed to defeat emissions testing. Law (as it does) carried that terminology forward into the era of the engine computer: https://www.law.cornell.edu/cfr/text/40/86.1809-10

So, even if you find it to be scare words, that's not the way it was originally intended. I think it can be forgiven in this case.

Just curious, can you suggest a similarly unambiguous term that can be codified into law? Remember, the term needs to cover both software and hardware.

Internet of criminal things

Posted Sep 28, 2015 21:41 UTC (Mon) by dlang (guest, #313) [Link]

I agree that "defeat device" is the current legal term, and I think it's appropriate for a hardware device, even if it's a computer (say something that you plugin between the ECU and the wiring harness to change the signals)

But I've seen people elsewhere start getting up in arms about the conspiracy because this device has been installed in all these cars for years and nobody has spotted it.

When you point out that it's not a physical device, it's just software in the system, the expectations change. There's still plenty of silly, over-the-top reactions even then.

I don't know a good phrase to try and replace it as a "term of art" in legal matters though :-(