Internet of criminal things

Posted Sep 28, 2015 19:21 UTC (Mon) by bronson (subscriber, #4806)
In reply to: Internet of criminal things by raven667
Parent article: The Internet of criminal things

VW believed for more than a year that they could lie their way out of it: http://www.nytimes.com/reuters/2015/09/24/business/24reut...

It took a lot of work and fact checking by CARB/EPA/etc to wear them down:

"We discovered some very strange anomalies," Young said. "For instance, the car was running more cleanly when it was cold than when it was warm, which is the opposite of what every other car does — because once you warm a car up that's when it begins to deliver its best pollution controls. This was not the case. So clearly something else was going on. Over time we assembled enough proof and questions that they could no longer provide any reasonable explanation for what was going on."

I think VW just ran out of things they could plausibly lie about.

Also, pure speculation: engine computers are pretty standardized and not too hard to analyze (much easier than a locked-down smartphone anyway!) It wouldn't surprise me if CARB found evidence of a defeat device on their own and quietly confronted VW about it.

Internet of criminal things

Posted Sep 28, 2015 19:45 UTC (Mon) by raven667 (subscriber, #5198) [Link]

> I think VW just ran out of things they could plausibly lie about.

True, but that has not stopped many other companies before from continuing to lie, even to try propaganda and lobbyists to change the law and public opinion to support their untruth, so VW is actually different in this case.

Internet of criminal things

Posted Sep 28, 2015 19:46 UTC (Mon) by dlang (guest, #313) [Link] (4 responses)

it's worth repeating that the "defeat device" they are accused of installing in the cars is an "if" statement in the software.

Internet of criminal things

Posted Sep 28, 2015 19:50 UTC (Mon) by bronson (subscriber, #4806) [Link] (3 responses)

It's more than that. It needs to sense whether it's on a dyno, and there are going to be some alternate mapping tables.

But, yes, we're probably talking about a few tens or hundreds of lines of software. It's the EPA that named it a "defeat device", not me. :)

Why is it worth repeating?

Internet of criminal things

Posted Sep 28, 2015 20:15 UTC (Mon) by dlang (guest, #313) [Link] (2 responses)

because "defeat device" is scare words as it's being used in the media, and getting people into the mindset that software is a "defeat device" makes them think that it's a great idea to ban software modifications to eliminate the possibility that people can install such "defeat devices" in things.

Not just cars, but the FCC is currently accepting comments on proposing requiring that access point manufacturers be required to demonstrate how they will prevent people who buy the devices from installing DD-WRT or OpenWRT on the devices based on the fact that such open software is a "defeat device"

we lost the definition of "hacker", don't let if statements (and similar code) start being talked about as if it was a hardware device installed in something that can just be locked out.

Internet of criminal things

Posted Sep 28, 2015 20:46 UTC (Mon) by bronson (subscriber, #4806) [Link] (1 responses)

I totally agree with where you're coming from.

However, "defeat device" is a term coined in the 70s (if not before) when the government was trying to outlaw physical devices designed to defeat emissions testing. Law (as it does) carried that terminology forward into the era of the engine computer: https://www.law.cornell.edu/cfr/text/40/86.1809-10

So, even if you find it to be scare words, that's not the way it was originally intended. I think it can be forgiven in this case.

Just curious, can you suggest a similarly unambiguous term that can be codified into law? Remember, the term needs to cover both software and hardware.

Internet of criminal things

Posted Sep 28, 2015 21:41 UTC (Mon) by dlang (guest, #313) [Link]

I agree that "defeat device" is the current legal term, and I think it's appropriate for a hardware device, even if it's a computer (say something that you plugin between the ECU and the wiring harness to change the signals)

But I've seen people elsewhere start getting up in arms about the conspiracy because this device has been installed in all these cars for years and nobody has spotted it.

When you point out that it's not a physical device, it's just software in the system, the expectations change. There's still plenty of silly, over-the-top reactions even then.

I don't know a good phrase to try and replace it as a "term of art" in legal matters though :-(