NHTSA Offers New Right-to-Repair Option

Months after telling automakers not to comply with Massachusetts’ latest right-to-repair law, the National Highway Traffic Safety Administration (NHTSA) has outlined a process it says would allow OEMs to comply.

But the Tire Industry Association notes the approach “significantly narrows down the scope of the original law and might not be put into practice for a number of years.”

Massachusetts’ Data Access Law requires carmakers to provide wireless access to a vehicle’s telematics. In June NHTSA urged automakers not to follow the law due to its concerns that “a malicious actor here or abroad” could utilize the access intended for repair facilities and use it to “remotely command vehicles to operate dangerously.”

In an Aug. 22 letter to the attorney general’s office in Massachusetts NHTSA says independent repair facilities instead could access vehicle data “within close proximity to the vehicle, without providing long-range remote access.” One short-range solution could be to utilize Bluetooth.

“In NHTSA’s view, a solution like this one, if implemented with appropriate care, would significantly reduce the cybersecurity risks — and therefore the safety risks — associated with remote access. Limiting the geographical range of access would significantly reduce the risk that malicious actors could exploit vulnerabilities at scale to access multiple vehicles, including, importantly, when vehicles are driven on a roadway. Such a short-range wireless compliance approach, implemented appropriately, therefore would not be preempted.”

Yet, the letter also notes that NHTSA and the Massachusetts Attorney General “share a common understanding” that this option would not be immediately available, “and that vehicle manufacturers may require a reasonable period of time to securely develop, test and implement this technology.”

Read the full NHTSA letter here.