• On The Insider: Sexiest Magazine Covers of All Time
Click Here
Security Watch : Don't get burned by viruses and hackers
Is your car spying on you?
By Robert Vamosi 
Senior editor, CNET Reviews
May 4, 2007

On April 12, 2007, New Jersey Governor Jon S. Corzine was seriously injured in a crash on the Garden State Parkway. In the days following, witnesses, including a state patrol officer assigned to ride with the governor, gave varying accounts, most estimating the governor's SUV traveling at a speed of more than 70mph. Now it seems that the vehicle had been traveling at 91mph in the final seconds before the crash, and, moreover, the governor, seated in the front passenger seat, was not wearing his seatbelt. How do we know this? Because the Chevy Suburban used in his motorcade contained a black box. A lucky fluke? Turns out most domestic cars sold within the last few years all contain them as well. Who knew?

Event Data Recorders
Since 2000, most domestic automobile manufacturers, namely General Motors (GM) and Ford, have been quietly installing what are technically called Motor Vehicle Event Data Recorders (MVEDR). These are devices based on IEEE standards formally adopted in 2002. Since the 1970s, GM has been installing something it called Sensing and Diagnostic modules (SDM) in car models fitted with airbags. SDMs, which captured and recorded data only after a crash, were originally designed to help GM improve the performance of the airbags and its crash defense mechanisms. MVEDR data, in at least one case, prompted GM to make at least one vehicle safety recall.

The newer MVEDRs are wired to the car's electronic sensing features and are constantly receiving input from various features in modern cars, not just the airbag system. Unlike the airplane versions, black boxes in cars do not record conversations inside the car and retain data from only the five seconds before a crash until a few seconds after, triggered by an increase in G-forces on the vehicle. The data is retained for as long as 45 days after an event. Until now, what MVEDRs capture--and even when they retain it--has been left up to the manufacturers.

Standards, slowly
Beginning in 2011, the National Highway Traffic Safety Administration (NHTSA) will require standards for MVEDR data collection, including some 42 points of common data deemed beneficial to crash investigators. Turns out that, with antilock braking systems (ABS) on most cars these days, skid marks left at the scene of an accident are no longer accurate in predicting how fast a vehicle was traveling, if skid marks are even present. The use of traction control and stability systems mean most cars don't even leave skid marks these days.

Unlike the airplane versions, black boxes in cars do not record conversations inside the car and retain data from only the five seconds before a crash until a few seconds after, triggered by an increase in G-forces on the vehicle.

The data specified by the NHSTA include vehicle speed, engine RPM, service brake on/off, lateral acceleration, vehicle roll angle, antilock braking system status, seatbelt status (driver and passenger), steering wheel angle, and a variety of specific airbag-related details. And beginning in 2008 the NHTSA requires a standard statement to be included in the owner manual for each vehicle containing an EDR. But there is no requirement that a vehicle must include an EDR, nor is there a prohibition on what the manufacturer collects beyond the NHSTA standards, or how it is used.

Past examples
There are a few legal precedents using MVEDR data. In 2004, the Christian Science Monitor cited two criminal court cases. In one, Danny Hopkins of New York was convicted and sentenced to 5 to 10 years after a black box in his Cadillac CTS reported he was driving at 106mph in a crash that killed a woman in another car. In the second case, in St. Louis, Missouri, Clifton McIntire pleaded guilty after the black box in his GMC pickup showed him driving at 85mph seconds before slamming into a Toyota. Until the accidents, neither driver knew their actions were being recorded.

But there have been incorrect uses as well. In a case involving Maine Governor John Baldacci, the state trooper reported driving at 55mph. The investigators, using traditional forensics, determined that the vehicle was traveling between 55 and 65mph. But the MVEDR data downloaded from the manufacture recorded a speed of 71mph and was dismissed by all parties as inaccurate. Perhaps the MVEDR evidence in the Corzine case will also be shown to be incorrect as well.

After taking the SUV around a particularly gnarly set of cones, the OnStar button lit up and the speaker system offered a helpful voice to ask if everything was all right.

Getting creepy, however
Currently several states have already gone ahead and made such disclosures law. But why the piecemeal approach? Why did it take NHSTA years to standardize the practice? According to the NHSTA, they're pleased with the progress that manufactures are making on their own.

Indeed, GM has already found novel ways to integrate its MVEDR collection into other aspects of their company, such as OnStar, a roadside service package available in all GM cars. In 2004, while testing a 2005 Chevy Malibu Maxx, the editors at AutoWeek reported that after taking the SUV around a particularly gnarly set of cones, the OnStar button lit up and the speaker system offered a helpful voice to ask if everything was all right. No one in the car had reported a problem. Rather, the vehicle's MVEDR system had kicked in because of the increase in G-force data. AutoWeek reported that OnStar collects data on near-collisions and collisions and retains this data for as long as 18 months.

New laws? Not yet.
If you think government is going to step in and legislate how and when MVEDRs can be used, think again. Individual states are looking into use of this data for themselves. In California, aides to Governor Schwarzenegger have floated an idea in which these same MVEDRs could be enlisted to record mileage and thus impose an additional mileage tax on those drivers who drove greater distances between refuelings. In Oregon, a similar proposal calls for MVEDRs to include GPS transponders in order to tax cars only while driving within the state boundaries.

On the commercial side, at least one auto insurance company has considered using MVEDR data to offer discounts to "safe drivers." Progressive currently has a pilot program in Minnesota, Michigan, and Oregon called TripSense in which insurees voluntarily install a GPS device to record their average travel speeds, with the insurance company offering reduced rate to those who stay below the posted road speeds. It's not hard to imagine a day with MVEDR data on near-collisions might also be considered for insurance purposes.

Are you concerned about the potential uses of your car's black box? TalkBack to me.
Security Bites Podcast
CNET News.com's Joris Evers and CNET.com's Robert Vamosi tell you about the latest security threats, what's coming, and how to protect your system. Listen now


CNET's free newsletters
Rob Vamosi's
award-winning
column on Internet threats and how to counter them 
Delivered Mondays