Self-driving cars could bring a new world of hacking
When Governor Jerry Brown signed SB 1298 into law earlier this week, he made California the third state to pave the way for self-driving cars. The new law requires the California DMV to "adopt safety standards and performance requirements to ensure the safe operation and testing of 'autonomous vehicles'" on public roads.
It's no coincidence that Brown signed the bill at the headquarters of Google, which is developing a self-driving car. "Today we're looking at science fiction becoming tomorrow's reality," he declared.
The new law is a coup for Google and the self-driving car, but the advent of this technology raises some crucial questions. Are self-driving cars safe—especially from hackers? Does the world need self-driving cars? Given the stakes, it's important to explore these remarkable new machines further.
Self-driving cars may eliminate human error
Google announced its self-driving car in a 2010 blog post by Sebastian Thrun, who is currently a Google vice president and the leader of the self-driving car project. Thrun wrote: "According to the World Health Organization, more than 1.2 million lives are lost every year in road traffic accidents. We believe our technology has the potential to cut that number, perhaps by as much as half."
Considering that as many as 99 percent of auto accidents are caused by human error, according to one report by the U.S. Department of Transportation, it's easy to see why car makers and tech companies have been pushing more types of technology in an attempt to curb human error and reduce the staggering number of casualties. New cars are loaded with GPS, cellular connections, Bluetooth, proximity sensors, radar, night vision, and anywhere from 50 to 70 ECUs (Electronic Control Units), computers that control various vehicle systems.
Modern cars are rapidly becoming computers with wheels. For example, Volvo's City Safety-equipped cars actively scan and identify other cars and pedestrians, and automatically brake should one suddenly appear before the vehicle, without any intervention from the driver.
Naturally, these kinds of car technology are leading to the self-driving car, which promises to eliminate human error altogether by removing—or at least minimizing—human involvement in the act of driving.
Google leads the way
The self-driving car isn't just a novelty. Its implications are game-changing, and possibly as revolutionary as the leap from the horse and buggy to the internal combustion engine. Google's self-driving vehicles use a combination of GPS, cameras, LIDAR, radar, and the company's mapping technology to navigate accurately. They have logged more than 300,000 miles on public and private roads, with just a single accident—one that the company blames on human error. And although Google may be in the pole position, it's hardly alone in the self-driving race: BMW, Ford, and Audi are all working on their own self-driving systems.
Speaking at the Allen & Company Sun Valley Conference in July, Google executive chairman Eric Schmidt referred to the high rate of traffic deaths as "a terrible tragedy," saying, "the sooner we can get cars to drive for us, the more lives we can save." Schmidt proposed that "self-driving cars should become the predominant mode of transportation in our lifetime."
In addition to saving countless lives, advocates claim, a critical mass of self-driving cars could eradicate traffic gridlock, redefine public transportation, save billions of gallons of fuel, and boost productivity typically wasted on billions of man-hours of driving.
Impressive as the macro-socioeconomics may be, nothing captures the self-driving car's essence better than the personal, life-changing impact on the individual. For instance, Google released a touching video of a man named Steve Mahan being driven by a Prius to pick up lunch. Mahan is blind.
I'm a PC
Despite the potential benefits of the self-driving car, putting such vehicles on the road may have unintended and dangerous consequences. As vehicle systems and functions transition from mechanical and manual to electronic and automatic, and as they become increasingly connected to outside networks, cars will become much more vulnerable to hacking.
Hacking started afflicting PCs on a large scale when the Internet boomed in the mid-1990s and millions of computers became networked online. Cyberattacks grew ever larger in scope. For instance, the Storm Worm infected as many as 50 million PCs worldwide in 2007, creating a massive botnet.
The rampant hacking of PCs is not due to some inherent design flaw, but mainly to the PC's global user base, which Gartner estimates will hit 2 billion by 2014. "One of the things that drives hacking is availability. Windows is everywhere. It raises the stakes from a hacking perspective," says Bruce Snell, technical marketing manager at security firm McAfee.
But even with the best security tools and precautions, everything is hackable at some level. Global cybersecurity spending in 2011 reached $60 billion, yet hackers were still able to launch major attacks against networks and companies, including Google.
Currently more than 1 billion cars occupy the world's roads, according to Wards Auto. If Schmidt's wish comes true, we could soon have hundreds of millions of networked self-driving cars with connected powertrains and ECUs, all potentially open to hacking. A 2-ton computer-driven car, racing at 100 miles per hour on the freeway under the control of a malicious hacker half a world away, certainly would be far worse than a simple computer crash.
And just as Google's self-driving vehicle already exists, car hacking does too. At the Black Hat security conference last year in Las Vegas, iSec Partners security consultants Don Bailey and Matthew Solnik hacked a Subaru Outback using a cellular network. They were able to unlock the car and even start its engine. Bailey said that he and Solnik took about 2 hours to figure out how to intercept wireless messages between the car and the network and then re-create the messages from his laptop.
Heading off car hackers
Companies and other groups are doing extensive work to prevent car hacking. Car security will undoubtedly become big business as vehicles become more technologically akin to computers, and the safety stakes increase. After acquiring antivirus maker McAfee for $7.68 billion in 2010, Intel is now taking advantage of McAfee's expertise to keep cars safe from hackers. McAfee's Snell says one method is "whitelisting," or creating a strict registry of allowable protocols, as a means of shutting out rogue commands. Parent-company Intel is also working to bake security into chips at the physical level.
iSec's Bailey and Solnik have been working with car makers to seal the types of vulnerabilities they exposed. As far Google is concerned, Jay Nancarrow, Google public affairs manager, says that the company is "considering this topic carefully, but we aren't sharing the details just yet."
A one-way street with no U-turns
As Governor Jerry Brown signed California's SB 1298 into being, Google cofounder Sergey Brin said: "You can count on one hand the number of years until ordinary people can experience this." Google clearly believes that the self-driving car is the future of transportation. Despite the specter of hacking, the potential benefits outweigh the negatives. There's no going back.
However, as with any technology this disruptive, everyone needs to better understand the self-driving car's implications. Maybe California's new law can help to elevate the conversation. "We need to be cautious moving forward," says Snell. "I don't foresee a time when somebody pushes a button and every car brakes on the freeway. [But] I want to make sure that people are thinking about it."
Snell says he hopes "we don't end up in 10 years where we were with PC security." He hopes that lessons learned from two decades of massive attacks on PCs will be applied to self-driving cars.
Drive home the message
At the signing of SB 1298, Brin likened overcoming the challenges of the self-driving car to mastering airplane flight. In a way, we can draw another parallel between the two. Though flying is statistically one of the safest ways to travel, it disproportionately elicits fear and anxiety. Falling out of the sky is one big reason, but being a mere passenger in a big machine you can't control is surely another. Although the self-driving car promises to save millions of lives, Google's biggest challenge may be convincing the public of its safety. And that message isn't going to drive itself.