California Protects Black-Box Data Privacy

Snowgen writes "According to a story at SFGate.com, California has recently passed a law regulating the little black boxes found in many modern automobiles. The new law requires that manufacturers disclose the existence of such boxes in the vehicle's operators' manual. The law also prohibits the use of data from such boxes without a court order or the permission of the vehicle's owner, unless the data is used in such a way that it can not be traced back to the owner."

Phew...

I can finally drive like a nut again!

Another article.....

...can be found here [bayarea.com].

Yeah, well

The new law requires that manufacturers disclose the existence of such boxes in the vehicle's operators' manual

Who reads the manual?

Re:Yeah, well

Drive in?

You guys are like really still in the 90's arn't you? Btw when 2000 comes along for you, dont worry its a bunch of hype.

Not really, but seriously I renember seeing that when I was a kid, but are you sure its car battery paranoia or defrosting their windows and heating the air?

Re:Yeah, well

Reading a manual when you first buy something or start a project is fine. It only makes you less of a man if you start on a project and have to look at the manual halfway through. Then you're admitting defeat.

Yea,

Finally a reason to be proud of california

Removal

I wonder if the cars work without the box? If they do I'll just take mine out

Re:Removal

My understanding is that they are quickly becoming an intrigal part of the on-board computer. If that's true then removal might not be very safe and would definitely void your warranty....

Re:Removal

no, you wouldn't definately void your warranty. The Magnunson Moss warranty act (federal law) makes it illegal for manufacturers to automatically void your warranty based on modifications you make excepting that they can prove the modification you made was the cause of the failure.

see: US Code Title 15, Chapter 60, sections 2301-2312 [cornell.edu]

I've been making modifications to my vehicles for years, and never had warranty claims problems on other ares of the vehicle. I've completely replaced the *entire* computer on my ducati and it's still covered. The new computer is not, but the rest of the bike that the manufacturer provided is.

Re:Removal - Black box is a misnomer

The "Black Box" system that everyone is crying about is part of the OBDII standard, or On Board Diagnostics that all cars produced since the early 90's are required to support. This is a set of standards that includes what data is to be accessible via diagnostics. There are several modes of retrieving data, and they are all intended for aiding in diagnosing the emissions welness of the vehicle as well as other faults your vehilce may encounter. The feature that has everyone up in arms is the "Freeze frame data" feature of OBD-II. What this does is, whenever there is a sensor fault (Ie: front of your car gets blown up in a collision, or something simple like your Oxygen sensor goes bad), the previous 5-30 seconds of data (varies depending on the car) is logged to *aid the technitian* in diagnosing the fault. Unfortunately, someone figured out that when you get in a wreck, there's usually some sort of sensor fault, and the car's computer conviently records a lot of variables relevent to the collision.

It is impossible to remove this "black box" because on any car that supports OBD, *EVERY* computer in the car logs some sort of data. The important stuff is logged in the same computer that controls how your engine runs. It IS possible to clear the data using a diagnostic tool designed to do so. See the SAE J1979 standard if you're interested learning how to do this.

Except for the Tiny Loophole

I'm sure, that says, "except whenever."

Damn...

Getting Rid of Spam, *AND* protecting us from little black boxes. I'm starting to dig this whole recall thing...

It sure is helping us little guys...

Media

(from the article)

The devices, which record information on a continuous loop that rewrites itself every few seconds, lock the information in place only after an accident that deploys an air-bag.

Anyone know what sort of media they're talking about? The phrasing implies tape, but obviously there isn't a Commodore 64 Tape Drive [lofi-gaming.org.uk] hiding under your seat.

Re:Media

The recording is made in a constant 5 second loop to normal RAM. As soon as an airbag deployment event (or "near deployment" - whatever that means) occurs that 5 seconds of RAM data is copied to non-volatile write-once RAM. That is why you need to replace your SDM (Sensing Diagnostic Module) after the air bags have been deployed.

Scary

I didn't even know this data was being collected. I'm not sure anything bad is happening with it, however. In fact, it could be good for impartial descriptions of accidents. But with the potential for misuse, and my natural distrust of people, I'm not sure I would like it either way.

Dang nammit!

Shoot.

How the heck am I going to determine if my kids have been:

1. speeding
2. not wearing seatbelt
3. popping air-bags
4. drifting
5. figure-eighting
6. parking off a secluded roadside

Big brother, I miss ya!

Re:Dang nammit!

Easy. Ask yourself, "Did I do that at thair age?" If the answer's yes, then odds are they're doing it

How long before....

this thread becomes yet another "what about terrorists" thread.

"Or without a court order"?

So what they mean is, unless you get sued... You crash a car into someone. You say you were going under the limit, the insurance company knows your car has one of these black boxes in it. Insurance company says to court "we don't think he was going the limit due to skid marks/someone saying he looked like he was going pretty fast/previous record", gets court order, information obtained, insurance claim denied. say the person you hit wants a piece of the actio, they say "his insurance company isn't paying out, I think he was going too fast, give me the black box data", gets a court order, sues your ass off.

So basically it's as useful as the constitutional amendments that begin "Congress shall make no law..." and end in "unless it makes a law that says it can"

Re:"Or without a court order"?

So, you're saying, you want to be able to lie to your insurance company, and then the court, about how fast you were going?

Now, I'm not a fan of this black box thing, but I don't think you're going to win much sympathy here.

Why the hoopla?

Driving a vehicle on a public road is an eminently public act, and those who do it shall have no more expectations of privacy than someone picking his nose in front of Sack's Fifth Avenue on the morning rush-hour.

The collection of vehicle control evidence is a crucial step in the investigation of traffic accidents. Sheltering that information from the authorities has only one purpose, to shield delinquent drivers from retribution for their unlawful acts.

Even moreso, vehicular event recorders should hold at least 30 minutes of data, including video data, and be downloadable at distance by law enforcement.

Shall we also say again that driving a car is a mere PRIVILEGE and far from being a right????

Re:Why the hoopla?

The collection of vehicle control evidence is a crucial step in the investigation of traffic accidents. Sheltering that information from the authorities has only one purpose, to shield delinquent drivers from retribution for their unlawful acts.
I think we've already been through the loop about "If you aren't ${someevilthing}, then you have nothing to worry about." Well, haven't you ever been late to a critical meeting and gone 10mph above the limit? Haven't you ever forgotten to buckle your seatbelt? And don't even get me started on video/audio data collection... My conversations within a car are indeed private, and should not be accesible by the police, the SS or DHS, or what ever. Especially not at-a-distance-we-don't-have-to-tell-you-PATRIOT-AC T-style.

Shall we also say again that driving a car is a mere PRIVILEGE and far from being a right????
That very well may be, and probably is, but the possesion of that privilege does not nullify a more fundamental right to privacy.

Re:Why the hoopla?

Well, haven't you ever been late to a critical meeting and gone 10mph above the limit? Haven't you ever forgotten to buckle your seatbelt?

Do not cast the first stone, O sinner, for I am totally sinless in that respect; I do not have a car, nor ever intend to have one. And I cannot stand being in a car without wearing a seat-belt.

And don't even get me started on video/audio data collection... My conversations within a car are indeed private, and should not be accesible by the police, the SS or DHS, or what ever. Especially not at-a-distance-we-don't-have-to-tell-you-PATRIOT-AC T-style.

Oh, I'm not talking about recording what you DO, but recording what you SEE from the windscreen... The idea is to see whether you drive like a fool or you simply avoided the other fool who drives like one.

Shall we also say again that driving a car is a mere PRIVILEGE and far from being a right????

That very well may be, and probably is, but the possesion of that privilege does not nullify a more fundamental right to privacy.

It most definitely **IS**. You can't drive without a license, and you can't have a license without displaying a minimal amount of understanding of the traffic laws and how to handle your vehicle. Abuse that privilege by driving recklessly, and you'll see it pulled from you presto.

Re:Why the hoopla?

Even moreso, vehicular event recorders should hold at least 30 minutes of data, including video data, and be downloadable at distance by law enforcement.

That's fine by me, but only so long as I'm allowed to remotely download the black box of any police car whenever I choose.

Re:Why the hoopla?

Driving a vehicle on a public road is an eminently public act, and those who do it shall have no more expectations of privacy than someone picking his nose in front of Sack's Fifth Avenue on the morning rush-hour.

True, it is an eminently public act. HOWEVER, to abuse your Fifth Ave analogy, picking your nose at 0237 is a more or less private act because you have a reasonable expectation that no one will see you do it.

The collection of vehicle control evidence is a crucial step in the investigation of traffic accidents. Sheltering that information from the authorities has only one purpose, to shield delinquent drivers from retribution for their unlawful acts.

Certainly AFTER THERE HAS BEEN AN ACCIDENT. Which is what this California law is intended to protect. Your remote download proposal leads down the slippery slope of downloading your logs and fining you based on infractions that it recorded.

Yes, there are traffic laws. But the fact is nearly everyone pushes them to one extant or another. Whether it's 5 miles an hour over - or 15 over because that's how fast traffic is going. Most traffic laws are in place to guard the public safety. It's been shown in numerous studies (look them up) that it's the DIFFERENCE in speed between vehicles, not the absolute speed that matters.

There's a reason the California Highway Patrol will cruise merrily past a pack of cars travelling at 72 in a 65 zone. They are all technically speeding, but none of them are posing a hazard.

(Of course, CA doesn't use Highway Patrol fines as a major revenue stream as some other states do.)

What this law should do is prevent municipalities and insurance companies et al from abusing the data gathered with the cars onboard systems. Your suggestion reeks of Big Brother.

Regretably, unless more people stand up for their civil liberties, we'll see just the kind of invasive data collection you propose.

Shall we also say again that driving a car is a mere PRIVILEGE and far from being a right????

No argument there. But I won't go into my argument about why it should be considerably more difficult to get a license in the first place. Simple fact is that if drivers were better trained, traffic incidents would drop dramatically.

I would argue driving is a right.

We have the right to travel freely. Driving is a form of transportation. Is it realistic to say that someone does not need to drive in society today in general? For a large percentage of us, driving is something we need to be able to do.

Not being able to drive is a pretty serious limit on ones freedom to travel.

If driving is indeed a right, by nature, why then do we license it? Safety. Those that do drive have a reasonable expectation of safe roads and qualified drivers. Driving is a right that can be lost if exercised irresponsibly just as many other rights can be.

Let me put it this way. If someone demonstrates they are qualified to drive, is there a reason why they should not get a license? Do they have any expectation such denial will occur? Of course not because everyone has a right to drive provided they do not abuse other people rights while exercising theirs. (Hitting someone with your car infringes on their right to live and prosper for example.)

We deny someone their ability to drive as punishment for poor execution, not because we can. Same for other rights. You might lose your right to move freely if you use that right to kill someone for example. 'nuff said about that, either we agree or not, but I wanted to have the other view present on this thread.

I agree with you regarding driving being a public act, however that does not, in itself, support your idea that law enforcement should be able to access this device at a distance. I think it does support the traffic accident reporting particularly when people are killed. The survivors or other interested parties need to know what happened so the correct decisions can be made. Nothing but good there.

The main problem I have with your distance query is the same problem I have with automated speed detectors; namely, that we should be judged by our peers. That is how the law is written and it is one of the founding principles of this country.

Getting a ticket for doing 5 miles over by an automated machine is simply a tax, nothing more. Think about it. What is punishment without explanation. It's cruel and pointless.

Getting that same ticket because a warm body thought you might deserve it (or not) for some reason is being judged by your peers. That peer who chooses, or not, to write you that ticket will, in the case of writing it, let you know why it is being done and what you should do to avoid having it happen again. That action is what justice and law enforcement are all about. Those same actions can be shown to benefit society in a measurable way.

Those tickets from the automated machine, justifed or not, are simply a tax because no justice was done, no peer involvment took place; thus no corrective action and benefit to society will happen as a result.

So, a cop might download the last 20 minutes of driving. Lets say they do it right after people have traveled down an incline. Every last one of them will be speeding somewhat because that is what the vehicle naturally wants to do in that case. Our law enforcement could then write a ticket, or heck mail a bunch of them without having seen or judged the act.

A possible result: Navigating in traffic down an incline gets more dangerous as everyone concentrates on over control of their vehicle fearing an unwarranted ticket instead of the task at hand; namely, getting down that incline along with everyone else in an orderly manner.

This is exactly why I choose older cars. I can know completly the technologies used and how they will affect me. You don't want too old of a car because you lose the benefit of ongoing engineering however.

Good for California, they want people to know they might be judged in an automated fashion. Knowing the device is there makes a difference in how people react to it. This goes to another right we should have:

We all should have the right of full disclosure on any technology we make use of. If it does something without telling us, it is doing s

There's an easy way to evade the regulation

The manufacturer could paint the box blue.

Okay, but...

How exactly was the data going to get used without a court order? I mean I would be concerned if I were in a car accident or something that this data could be used against me, but it sounds like it still can, if the court orders it. Maybe it should be mandatory that you be allowed to deactivate or remove these things, like you can with airbags. I like the idea of at least being able to opt-out of the monitoring of my car's usage in any way.

Now if only the government gave the foggiest shit about electronic privacy. People understand "little black box sitting in your car", and they just don't seem to get the other privacy atrocities that go on every day.

Good for them

California is a weird state but sometimes ... they get things right. I'm impressed (and a bit shaken ... I didn't know the OBD modules were being used that way.)

Black Boxes could be used to stop crime.

The automobile is the biggest weapon that criminals use in the expanses of the 50 states. The automobile is used to hide victims in trunks and alows safe getaways for criminals. If there is a way to use black boxes for evidence in murders and major burglaries then it should be used.

AB 213

For those interested, here is a link to the text of Assembly Bill 213, sponsored by Assemblyman Tim Leslie:

CA Assembly Bill 213 [ca.gov]

I'd gladly allow access to my blackbox...

...if my insurance company in exchange would give me a sizable break on my $$$ premiums.

In other words,

In recent years, O'Neill said, data from the the devices has found its way into court -- primarily to defend automakers in cases where consumers claimed a vehicle malfunctioned. In at least one case, the recorded data was used as evidence in a vehicle accident.

If I had an accident, and I try to hold the automobile company responsible, can I be sued by them for being a bad driver?

More Information...

Check:
http://slate.msn.com/id/2087207/
http://w ww.accidentreconstruction.com/research/edr /faq.asp

They use the OBD-II interface (Same interface the DEQ guys use to make sure your car isn't pumping out too many noxious fumes.) 5 seconds of data are stored in an EEPROM.

Sorry this sucks

The place where this would most likely and most often be used would be auto accidents. This is not a question of the state vs an individual, its a question of an individual vs an individual with the state trying to determine the correct state of affairs. As someone who was in an accident, and had the ticket wrongly awarded to him I welcome this. Next time I won't have to worry about someone having their family members lie that they were watching someone pull out from an apt building when they were thireen floors up and on the other side of the building.

Great Idead

The new law requires that manufacturers disclose the existence of such boxes in the vehicle's operators' manual.

Great idea. People should know that there's a balck box in their car. Maybe they'll think twice about that reckeless maneuver their going to pull.

A previous poster mentioned dupe, this is not. The previous article [slashdot.org] mentioned how someone was convicted of killing somone 'cause they decided to do ~100 mph down a 25mph resedential street.

Hypothetical future dialog: "Hey son, I trust you and all, but be aware that fi you do try to show off to your prom date tonight, and maybe, umm I dunno, kill someone while your at it, that blackbox recorder could put you away for a long time. Here are the keys, by the way."

Maybe some of this info could also be used to help prosecute people who stage accidents for insurance fruad. I get so sick of seeing these thigs happening. 6 people all loaded up in 2 cars, they bump at 10mph, cry neck and back pain, but they have no idead who they are sitting next to in the same vehicle!

I agree with the privacy concerns, but

...it could be very useful if manufacturers could get black-box telemetry in an anonymous way. think of how much we've learned from black-boxes about airplane crashes, why they happen, and how to prevent them.

there could perhaps be engineering flaws which would could be revealed a lot sooner by analyzing black-box data, possibly saving lives.

As always, they missed a spot

They should have also protected "the operator" of the vehicle.

This does nothig to protect a person from the abuse of the information when they Rent a car (c.f. the story of the "speeding penalty" enacted by the one rental agency) or when a person has a "company car".

Finally, one wonders whether this separates the purchasers and leasees of cars into two separately and unequally protected classes.

After all, if you lease a car, your leasing company owns it. So the police could end-around and make a request of them to access the black-box.

Then again, section 215 [aclu.org] lets the FBI do any dang thing they want in the search and seizure arena despite the Constitution.

still don't want the boxes

I'll be honest. I do not want any data recording devices in my car because the information gathered by the box could be held against me in any number of ways. Maybe it can improve car safety over time, but with vehicle laws and civil lawsuits being the way they are, I don't want the equivalent of the permanent wire-tap on my driving. If the data is there and any legal situation comes up where it could be useful, it will be used and if these devices are regulated into cars, you won't have any choice about it (obstruction of justice, destroying evidence, anti-tampering laws, etc.).

There might be some number of times where the devices could be used to prove your innocence or lack of liability, but I'd rather take my chances without the devices. I mean, how often does anyone really drive the speed limit on the highway?

Of course, my 2002 probably already has something of the sort and I'm probably just ignorant about it. Anyway, I think car safety can be improved over time almost as well without the boxes and the adjoining less of privacy.

mod the box

This is the first I've even heard of the box, but what's to keep someone from modding the input so ANY accident looks like they were sitting still? Heck, mod the box, pull up to the light in front of a guy you hate, slam into him in reverse, then use the box to sue his pants off.

The court shouldn't use a device like this without the appropriate wariness to it's vulnerabilities.

Indroduce Errors?

One way to derive benefits from the statistics while protecting drivers from their own vehicles would be for the boxes to introduce the occasional error into the data - outliers will be filtered out when the stats are processed, but the figures will no longer be able to be trusted for avoiding claims and the like. If the information's recorded accurately, it's there to be abused.

The motivation

Odd how fast consumer protection legislation gets passed when a congresscritter happens to be involved:

Recently, South Dakota police tried to get data to show whether Rep. Bill Janklow had run a stop sign before he struck and killed a motorcyclist.

Define Speeding

Who's to say what is speeding? Without data to confirm the speed of the cars around you, who's to say you were just not keeping up with traffic? On most roads/highways (at least here in Ontario) a slower driver is more likely to cause accidents due to pissed off people trying to pass. Unless there is data regarding the speed of everyone around you, your argument can just be "I was just going as fast as everyone around me". There would be no way to prove either side of this 100% without data from all the cars around you. Eyewitnesses don't count as most people under/over estimate speed by quite a bit..

Just my thoughts

Sometimes.

(IMHO} a very good law - how the black box would know ( how can you read from the box ) what the situation was? It just records, it doesn't know if it was a good thing to accelerate or to speed up, how the traffic was. Just 40 years driving fast cars all around the world and one accident ( arguably not my fault but you know the insurance companies ). Maybe if it would record like 6 months or so, then you can make a pattern ( not always right but better than last xxx minutes ). I hope they don't put those on F1 cars!

Aftermarket ?

How about a little button connected to the battery and the 'box' that destroys the box utterly or erases the NVRAM? The thing is, if you're involved in an accident - nothing short of an EM pulse will take care of the other car's 'box'.

Information can be gleaned from that and the scene of the accident can be reconstructed from that.

Of course, the lawyers (and trolls) will say that those who have nothing to hide shouldn't have to destroy the info.

Drive cars that don't have boxes. Until those are illegal too...

Privacy?

I must be totally missing something. Would someone please explain to me what the whole controversy is behind this 'black box'?

From my limited understanding, the 'black box' stores a record of the car's mechanical stats retroactively five seconds prior to an accident - and even then we're talking about a relatively major accident, not a minor fender bender. This device isn't a GPS unit, it doesn't 'call home', nor does it record conversations (which wouldn't consist of anything more than "Oh shiii... *crunch*" anyway). What privacy are we trying to protect? When we file the police report or an insurance claim don't we voluntarily report much of this information anyway? When the police officer or insurance agent asks "How fast were you traveling?", am I to believe that you all claim "I'm sorry, I won't answer that question as I feel it invades my privacy"? Either I'm missing a key fact, or my definition of privacy is grossly out of sync.

This is good news, but...

I'm still convinced that we're headed toward having these things in all of cars.
We'll probably have our speeds monitored (and our insurance companies notified or even worse, our bank accounts debited) in real time.
Nothing we can do about it. The roads will still have posted speed limits of 55, even though the practical speed of traffic flow is closer to 70. Care to complain? Hey - you were speeding, we have the black box to prove it. Great source of revenue for the states and insurance companies for whom state legislatures have been creating traffic penalties to enrich them.

Hmm

Just a note : if a black box is wiretapping, this would be like having a wiretap on EVERY telephone in the U.S., except that it can "only" be read with a court order. So, the moment the authorities find "reason" (basically anything) to suspect you, they know everything you said BEFORE the court order as well. Is this right? No idea, the argument most people would make is "you have nothing to fear if you're innocent".

Eh?

There's a fuckin xbox hidden in my car?!

Two words....

Demolition Man

You can still get a court order

This law doesn't prohibit using a subpoena to get a court order to read out the event recorder. It's quite reasonable to do so, too.

simple loophole.

The law also prohibits the use of data from such boxes without a court order or the permission of the vehicle's owner,

you crash, insurance company total's out your car... they are NOW the owner of your car and they will gladly give the data to the courts.

End-running most privacy laws is really easy and is a specality of insurance companies.