How the DMCA may have let carmakers cheat clean air standards
The West Virginia University researchers drove the vehicles for thousands of miles, testing the emissions as they went along. They weren't expecting to discover what they did: Nitrogen oxide (NOx) emissions rates 20 times the baseline set by the Environment Protection Agency (EPA).
The university researchers reported their findings to the California Air Resources Board, which then further investigated. That ultimately led to the charges by the EPA.
So why is it that independent research agencies and EPA, with its stringent rules and sophisticated testing measures, were unable to detect Volkswagens and Audis bypassing emissions measures
Automakers have been able to apply the 1998 the Digital Millennium Copyright Act (DMCA) to their vehicle software, making it unlawful for independent researchers to look at the code without permission.
"The fact that automakers can assert a DMCA claim against researchers is a deterrent to going in and actually looking at the code to understand what it's doing," said Kit Walsh, a staff attorney at the Electronic Frontier Foundation (EFF).
The EFF, a non-profit digital rights group, has opposed the protections for the auto industry under the DMCA, arguing that vehicle owners and others have the right to inspect the code that runs their vehicles and allow a mechanic of their choice do work on their cars and trucks.
The EFF asked the U.S. Copyright Office to grant an exemption to the DMCA for embedded vehicle code so that independent research can be performed on electronic control modules (ECMs), which run a myriad of systems, including emissions.
The auto industry has traditionally cited DMCA protections over concerns that people may circumvent vehicle safety measures if third parties are allowed access.
Walsh said if independent researchers, such as those from West Virginia University, had been able to access vehicle code, and reverse engineer it, it's likely the "defeat device" would have been discovered faster.
"The legal uncertainly created by the DMCA...makes it easier for manufacturers to conceal intentional wrongdoing," Walsh said. "The researchers at the Univeristy of West Virginia...went through a lot of tests to try to narrow down the possibilities. If they had been able to go in and look the code...then we would have known much sooner about this problem."
The EPA has also expressed concern that use of the DMCA and its copyright protection of "technological protection measures" could "slow or reverse gains made under the Clear Air Act [CAA of 1990]."
In a letter dated July 17, 2005, the EPA wrote the U.S. Copyright Office stating that computer programs in motor vehicles controlling engine operations have been critical to achieving emissions reductions.
A vehicle's electronic control module continuously monitors the vehicle engine and emission control system and dictates the engine's fueling and timing strategies for purposes of complying with the CAA.
"TPMs for electronic control modules make it difficult for anyone other than the vehicle manufacturer to obtain access to the software," the EPA's letter stated.
Ironically, the EPA also noted that copyright protections for vehicle software also keep it from enforcing laws to stop third-party vendors from tampering with code to "bypass, defeat, or render inoperative" software designed to enable vehicles to comply with CAA regulations.
Walsh said he was not surprised that Volkswagen's simple software was able to thwart EPA tests, though it wouldn't likely be effective against independent researchers.
"It's one thing to write software that can fool laboratory conditions under a testing regime that the EPA publishes in advance. It's lot harder to create software that's going to fool independent researchers who are able to work with the code in the wild," Walsh said. "The simple fact of transparency would deter manufacturers from this kind of cheating."
"I'm really curious to see what independent researchers are able to turn up in other vehicles," he added. "In a security context, that's the place where we have the most proven track record. Independent researchers have found in almost every vehicle they've analyzed something the public needs to know about."