Your Car Can Be Hacked, and Two Senators Want to Stop It

07_21_CarHack_01
The Internet-connected nature of newer vehicles also leaves them vulnerable to hackers, which Sens. Markey and Blumenthal hope to safeguard against with the introduction of the SPY Car Act on July 21. Robert Galbraith/Reuters

Imagine driving a car on a busy highway when suddenly and spontaneously: The air conditioning starts blasting cold air, the windshield wipers turn on as a gush of wiper fluid obstructs your view of the road, and the radio station changes to an obscenely loud tune. Then the transmission dies.

This nightmare scenario happened to Wired’s Andy Greenberg, who volunteered to be a digital crash-test dummy—drive a Jeep while a hacker manipulates the vehicle from a laptop across the country. And the piece’s publication is well-timed as two senators introduced legislation on Tuesday calling for federal standards to secure internet-connected cars and protect drivers’ privacy.

The Security and Privacy in Your Car Act, sponsored by Senators Edward J. Markey (D-Mass.) and Richard Blumenthal (D-Conn.), sets up minimum cybersecurity and privacy standards for cars. The standards include hacking protection and mitigation, data security, transparency regarding the use of driving data, and the ability for drivers to opt out of having the data collected or used in marketing and advertising. The bill also establishes a rating system—or “cyber dashboard”—to inform drivers about the security of their vehicle beyond the minimum standards.

Last year, Markey released a report called Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk, which found that only two of the 16 car companies studied had developed the capability to detect and respond to hacking attacks in real time. The report also found that car companies often, unbeknownst to drivers, share customers’ information with third parties.

“Drivers shouldn’t have to choose between being connected and being protected,” Markey said in a statement on Tuesday. “We need clear rules of the road that protect cars from hackers and American families from data trackers. This legislation will set minimum standards and transparency rules to protect the data, security and privacy of drivers in the modern age of increasingly connected vehicles.”

Blumenthal added: “Rushing to roll out the next big thing, automakers have left cars unlocked to hackers and data-trackers. This commonsense legislation protects the public against cybercriminals who exploit exciting advances in technology like self-driving and wireless connected cars.”