This article originally appeared in MassLive by Steph Solis.
For the second time in under a decade, Massachusetts voters face a question on the ballot about who can access their vehicle data.
Massachusetts voters passed a ballot measure in 2012 to require automakers to let independent auto shops access diagnostic information. Those mechanics, bolstered by trade associations and national repair shop chains, say the latest ballot measure would fix a loophole in the first “Right to Repair” law that bars them from accessing wirelessly transmitted data about a car’s performance and other information.
Voting yes on Question 1 would give mechanics access to telematics data, information that’s sent from the car sensors to a remote server that’s only available to automakers. Telematics can tell automakers about the state of a car’s brake pads, a driver’s behavior, crash notifications, location history and other data.
“The automotive industry has been trying to eliminate the auto mechanics hard core since the new millennium,” says Bruno Parrotta, who runs Parrotta’s Auto Repair and Services in Agawam.
Parrotta has worked in that shop since 1975 when his father owned it.
“I love working on Mercedes and BMW and Audi, but I am not a snob,” he said. “I’ll work on anything and everything, as we do.”
He pays the extra money for the tools the dealerships use just so he can repair electric rear brakes or other parts some competitors can’t. At the moment, Parrotta said he doesn’t need telematics to do his job. But it could make his work easier, giving him or his clients a heads up when a part could be wearing down before it breaks.
Automakers use telematics already. Think of the emergency warning systems used to prevent collisions in modern-day models, wireless safety communication systems such as OnStar and GPS.
Car sensors wirelessly send information to a system, which sends the data to a remote server – usually a cloud, overseen and owned by the manufacturers.
Automakers argue mechanics won’t need telematics to do their job as long as the current “right to repair” law is in place.
“A no vote on Question 1 keeps the repair law the same … What Question 1 would do is expand the availability of information from your vehicle that is not necessary to diagnose and repair your car,” said Conor Yunits, spokesman for the Coalition for Safe and Secure Data.
What does the question propose?
The question would not only expand the 2012 law to let independent shops access telematics data, but it would also require car manufacturers to create an open access platform that stores the data, says Tommy Hickey, director of the Right to Repair Coalition. The question specifies the platform would include a mobile app.
The proponents have not created a prototype of the app; they say they’re just creating the framework and its up to the automakers to design and build the app.
According to the question, the car owner will have some kind of access to a mobile app containing the telematics data, even if it’s just to give access to the mechanic of the owner’s choice. It’s hard to say what the app would look like or what exact data would appear because this open access platform hasn’t been created yet.
What happens if I vote yes?
A yes vote means the voter supports making telematics data accessible to any mechanic the car owner chooses, using a mobile app.
If the ballot measure passes, automakers would need to create an open access platform to store the telematics data and equip every 2022 model car with the platform by that year. The attorney general would need to issue guidance on what telematics data is collected, what an owner can do with it and how the owner could give the mechanic access to the data for car diagnostics, repairs or maintenance.
It would be up to the owner to give a mechanic permission to access the data using the mobile app.
Based on the language on the ballot question, a customer could agree to give a mechanic one-time use of the data or, if the app allows it, the customer could agree to give a mechanic use of the data for as long as the customer wants.
According to the ballot question, mechanics could also send commands to the car to test its performance or diagnose certain issues. Brian Herron, president of the OpusIntelligent Vehicle Support division, said a telematics system can be used to test the horn or the windshield wipers or another part of certain cars. Those vehicles, he added, are programmed to only execute those commands in certain cases, such as when the car is still and a foot is on the brake pedal.
What if I vote no?
A no vote means the “right to repair” law stays as is. Opponents say that shouldn’t impact a mechanic’s ability to do their job because they can get the necessary repair data through the diagnostic ports by the driver’s seat.
Contrary to what some proponents claim, it is highly unlikely a no vote will lead to the collapse of the auto repair industry and the lack of telematics data isn’t driving independent car shops out of business right now. Those mechanics can still get diagnostic data through a port, though the software typically costs extra money.
But a no vote would mean telematics data automakers use in the future would remain proprietary, including data that dealerships could use to flag early signs of mechanical problems. That gives the dealerships a competitive edge over independent repair shops.
Does it include GPS data?
Proponents say no. Opponents say yes.
The 2012 law’s restrictions on telematics also states locational data is one of the pieces of information that independent repair shops cannot access.
The ballot question proposes rewriting that section to make telematics data accessible to any mechanic the owner chooses “for the purposes of maintaining, diagnosing and repairing the motor vehicle.” It does not specifically call for locational data, nor does it explicitly carve out locational data like the 2012 law did.
Are there any security concerns?
Opponents of the ballot measure say sexual predators could more easily track their victims, as seen in the coalition’s TV ad.
The commercial shows a woman being followed as she walks alone to her car in a parking garage. A voiceover kicks in with a warning: “Domestic violence advocates say a sexual predator could use the data to stalk their victims, pinpoint exactly where you are, whether you are alone, even take control of your vehicle.”
The ad cites advocates in California, but the 2014 proposal in California specifically called for locational data.
Herron, the OpusIVS president, said a sexual predator would need permission to access the platform and a victim’s data, which the proposal doesn’t allow.
Jen King, a professor at the Stanford Center for Internet and Society, agrees that the chances of a sexual predator getting access to a victim’s telematics information and controlling the car are slim.
“There’s just nothing by definition that would compromise people’s safely unless you design this badly,” King said.
Supporters of the ballot question say it’s up to automakers to create the platform to host their telematics data and make sure it’s secure.
Herron and Yunits, who represent the ballot measure’s opponents, agree at least one scenario is remotely possible. If a car is registered in the name of an abusive partner that the victim drives, the abuser could potentially access the mechanical data through the mobile app.
Still, Herron said it is unlikely a registered owner could access the data without the driver knowing, and that the scenario suggested in the opposition’s ad assumes an owner would be able to see real-time location data through the mobile app. He also said it was highly unlikely that a registered owner could send commands to the vehicle from the app, such as remotely turning the vehicle off.
“He couldn’t stop the car from running,” Herron said.
Jane Doe Inc., which expressed concerns about the ballot question in 2019, sent an email to members saying the group was named in the state’s voter guide as an opponent of the ballot question without consent from the organization’s leaders.
Jane Doe’s stance on the ballot measure has “evolved” since last year, when the group believed it posed the same risks as the California proposal. The organization did raise concerns about the claims made in the opposition’s commercial.
“We do not support the use of survivor fears or needs as pawns in a debate that is not ultimately about the needs of survivors,” Jane Doe said in a statement.“As companies and industries make public claims to support survivors and oppose gender based violence, we are looking for a real commitment and allyship.”
Another claim opponents make is that hosting telematics data on an open access platform could make the data a target for cybersecurity attacks.
In 2017, a white hat hacker – a term for an expert who tests the limits of computer security – identified vulnerabilities in Tesla’s servers and was able to gain access to the automaker’s entire fleet. Once the hacker spoke with the company, it patched the bugs. The company has reportedly made significant security improvements since the hacker shared his findings.
But unlike most vehicles on the road, all Tesla cars have been equipped with self-driving hardware since late 2016.
Yunits, who represents the opposition, said there are inherent risks in sharing the telematics data through an open access platform, especially when the deadline for creating the app and equipping new vehicles with the platform is just over a year away.
“When you have an open platform that is not protected or has no guidelines for protection, it’s going to be a magnet and a target for bad actors who are looking for information specific to vehicles,” Yunitz said.
While cybersecurity vulnerabilities are possible, King said the automakers tasked with building the platform could keep the telematics data safe by installing the proper safeguards.
“Just because the possibility exists that you can give them access doesn’t mean that you’re going to end up with all these nightmare scenarios,” King said.
Who is funding the campaign and the opposition?
Automakers, trade associations and retail chains from across the country have poured millions into the ballot question and the opposition. Much of that money has gone into TV ads in Massachusetts.
The Coalition for Safe and Secure Data – which seeks to defeat the ballot measure – reported more than $25 million in donations through the end of August. Almost all funds were donated by auto manufacturers and dealerships.
The Massachusetts Right to Repair Committee – which supports a yes vote on the measure – raised slightly under $10 million through the end of august. The biggest donations were from auto repair retailers, including Auto Zone and Genuine Parts Company, the parent company of NAPA Auto Parts.
The next financial reporting deadline for the ballot question campaigns is Oct. 5.
