When Driverless Cars are Hacked

The United States currently has 50 million vehicles with internet connectivity. The number of wired vehicles in the US is increasing by nearly 40% every year.

All are susceptible to cyberattacks.

Obviously, susceptibility depends on levels of connectivity. At one end, vehicles have internet-enabled features like radio or mapping. On the far end, vehicles are now capable of self-driving and autonomous movements.

Are newer generation vehicles safe from cyber threats? If hackers can cripple Sony or Baltimore, can they take over your connected car, truck, or trolley?

A new paper from the World Bank highlights the complex risks associated with cybersecurity and autonomous vehicles.

There are three plausible scenarios for the near- to medium-term future of autonomous vehicles.

Autonomous mobility with private ownership

Individual households will continue to own and operate autonomous vehicles. In the not-so-distant future, self-driving Teslas will take parents to work and kids to school.

Shared autonomous

In this scenario, autonomous vehicles are owned and operated by fleet operators. Instead of individual ownership, people will rely on the Ubers, Lyfts, and Teslas of the world for self-driving transportation. This would be the most efficient use of autonomous vehicles but would require efficient matching between supply and demand.

Mixed use

At least for the foreseeable future, transportation will be a tangled mix of private owner-operated vehicles; shared owner-operated vehicles; privately-owned self-driving vehicles; and shared autonomous vehicles. If you think driving on the FDR is terrible now, imagine a future where each of these categories incorporate different technologies, human behaviors, cyber vulnerabilities, and regulatory frameworks.

Cisco defines a cyber attack as a “malicious and deliberate attempt by an individual or organization to breach the information system of another individual or organization.”

Let's expand that definition to include each node in a network.

Each autonomous vehicle is a target, but each vehicle can be attacked in more than one way. An individual cyberattack can target a specific vehicle, or it can target the transportation system guiding that vehicle.

This is similar to how most people think about cybersecurity now. Attacks can target individual users (hello John Podesta), or they can target entire systems that connect many accounts. The same idea underpins the cybersecurity risks to autonomous vehicles.

To further complicate the scenario, though, the attacks can be either active or passive.

Active attacks will be immediately disruptive. If targeting an individual vehicle, active attacks would take control of steering functions; deactivate sensors; or modify sensor messaging. Active attacks on the system could include denying node access; disrupting communication between the system and particular vehicles; or generating false data on which the system’s vehicles rely.

Passive attacks will be covert and non-disruptive. Passive attacks on individual vehicles could include eavesdropping or continuous mapping of movements and traffic. At the system level, passive attacks could involve stealing data or monitoring specific actions of fleet providers.

How should we deal with this new and emerging threat?

The authors outline two distinct lines of effort.

The first approach is for federal, state, and local governments to proactively create appropriate standards and policies. In 2017, the US Congress passed the SPY Care Act. This bill tasks the appropriate government agencies with, among other things, the responsibility to:

Issue regulations that require motor vehicles manufactured for sale in the United States to protect against unauthorized access to electronic controls, critical software systems, or driving data

Individual states — including California, Massachusetts, and Texas — have advanced state-specific regulations for cybersecurity threats to autonomous vehicles.

In addition to legislative fixes, how do developers prevent and mitigate (to the greatest degree possible) these attacks?

It requires the vehicles and systems to have “layered” levels of technologies and segmented functionality. By separating, say, the engine control layer from the messaging control layer, vehicle developers can mitigate the contagion risk of cyber penetrations. The same logic holds when designing autonomous systems.

Defenders want to make it hard for attackers to penetrate autonomous technologies and, should they succeed, make it harder still to increase the damage.

Yet each time we let our friendly robots drive us from Point A to Point B, we opt-in to a system that has been or will be compromised.

Is it worth it?

Just like the modern struggle over data and privacy, our ever-growing need for convenience will come at a very high cost. And if past is prologue, once something goes very, very wrong, we will turn on the outrage machine.

The question is not if, but when.