Self-driving car hackers put on notice

The UK government has established new legislation that requires car-makers to fortify the cyber security of new vehicles, particularly those with autonomous driving capabilities.

The new Autonomous and Electric Vehicles Bill is designed to stop criminals hacking into cars and stealing data or, worse, taking partial or complete control of a vehicle leading to worst-case-scenarios like murder, kidnap or injury of occupants and bystanders.

We wrote a spoof piece for April Fool's Day in 2015 warning of autonomous car hijacking and it's scary to think this is now a reality.

The UK is one of the world's first countries to ratify new automotive cyber security laws, releasing a list of eight "principles" to which car-makers and autonomous vehicle software developers must adhere.

The British government wants UK to become a world leader in self-driving vehicle technology, and recently provided £109 million of funding for 38 cutting-edge automotive research and development projects.

“Our cars are becoming smarter and self-driving technology will revolutionise the way in which we travel,” said UK Transport Minister Lord Callanan.

“Risks of people hacking into the technology might be low, but we must make sure the public is protected. Whether we’re turning vehicles into wi-fi-connected hotspots or equipping them with millions of lines of code to become fully automated, it's important that they are protected against cyber attacks.”

No such laws yet exist in Australia, where autonomous vehicle testing has commenced in NSW, Victoria and SA. The Australian government is debating how to approach the growing complexity and "connectedness" of vehicle fleets and is expected to release its own guidelines in due course.

In May 2016, Australia's Chief Scientist Dr Alan Finkel made a speech on cyber security, highlighting the potential damage hackers could bring to transport systems in Australia.

"Just think – in 30 years from now we are all using automated cars. We've solved the problems of traffic congestion and parking.

"We've eliminated traffic lights and our city fleet of two million cars is cruising, blissfully efficient, around Sydney. Suddenly, at 5:00pm, a successful cyber-attack results in the entire fleet crashing or screeching to a halt."

Although there have been no reports of major incidents resulting from car hacking thus far, Finkel's concern about the threat of vehicular cyber-attacks is far from unfounded.

In 2014 a restricted report from the US Federal Bureau of Investigation (FBI) was leaked, warning that terrorists could use remotely operated vehicles to harm others.

Then in July 2016 two blokes in the USA publicly hacked a Jeep Cherokee through its infotainment system and managed to take complete control of its steering, brakes, and acceleration.

It resulted in a massive recall of around 1.4 million vehicles from Fiat Chrysler Automobiles, Jeep's parent company, and has put the US government on notice.

The US Congress is currently hashing out its own guidelines on the implementation of increased cybersecurity to stop hackers gaining access to cars via zero-day exploits or unforeseen software vulnerabilities.

The National Highway Traffic Safety Administration (NHTSA) is at the forefront of vehicular cyber security in the US and is actively investigating how to stymie potential cyber attacks on modern cars, which are increasingly taking advantage of connected and autonomous systems.

Car companies such as Audi, BMW, Mercedes-Benz and Tesla are racing to be the first to offer a fully-autonomous vehicle, and Audi says its new A8 limousine will be the first vehicle to offer Level 3 autonomy.

That means it will be able to assume complete control on certain roads at speeds of up to 60km/h, but the driver will have to be ready to take back control within a certain amount of time.

BMW says its 2021 ‘iNEXT’ vehicle will offer Level 3.5 autonomy, meaning it will be able to drive itself at all speeds in almost all road scenarios, but a driver will still be required to take control should the need occur, meaning they won’t be able to go to sleep.

Silicon Valley is also investing a huge amount of capital into self-driving cars, with Google also in the race to bring the world's first fully autonomous car to market.

We recently took the updated Mercedes-Benz S-Class limo for a test drive in Europe and its upgraded self-driving systems have improved dramatically, highlighting how rapidly the technology is accelerating.