01 Aug 2012 Coming to a Car Near You? The Department of Transportation’s Creepy Black Box
Possibly coming soon to a new car near you – mandatory tracking and recording of your automobile usage. At one point it was part of the effort to reauthorize federal highway transportation programs. It was included in S. 1813 and passed the Senate. Next year it could pass the House and the Senate and become law.
This measure mandates that event data recorders (EDRs) – so called “automobile black boxes” – are to be included in any new automobiles available for sale in the United States after 2015.1
Purportedly the EDRs will monitor speed, driving habits, locations visited and distances traveled, seat belt utilization, number and weight of passengers carried, and perhaps some 15 other different data measurements collected. What’s the rationale for this measure? To make it easier for investigators to determine the cause of or fault for automobile accidents. For good measure, the proposal would make tampering or removal of the device a civil offense.
Essentially supporters argue that being able to download the data from the EDR’s memory will help law enforcement and even federal regulators to better understand what happened in the event of an accident and how the safety systems performed, and particularly in cases where other techniques are inconclusive, help establish culpability.
As part of the “you must pass the bill to find out what’s in it” congressional law-making technique, after enactment the Department of Transportation would be required to initiate a rule-making to determine the relevant data that is to be collected and to establish “an interoperable data access port to facilitate universal accessible and analysis.” In other words, once the law goes into effect, the DOT will then act to tell us exactly what data the EDRs will collect and what devices can be used to access the data.
Supporters of the measure point to its restrictions on data access. However, these restrictions lack any real bite. Supporters of this effort acknowledge that the data collected about your car is your data. However, their proposal offers fairly broad exceptions for others to access this data, so this ownership claim is meaningless.
Two exemptions in particular are troublesome. They include retrieval of EDR data by court order or access pursuant to an automobile accident investigation by law enforcement; both are particularly problematic.2 Sieves offer more protection than these provisions.
Consider that “automobile accident” could include a simple sideswipe totaling less than $300 damage. Nevertheless, solely under the discretion of an accident investigator, the EDR could be accessed and all manner of information about your auto usage would be accessible. Will they simply look at the last minute or so of driving or will they look at your driving history over the last month? Wait and see.
Moreover, don’t think the protection of judicial oversight will protect your privacy. This provision merely means that your private information will be accessible for any legal fishing expeditions in which someone has been able to convince a judge to issue a court order. The language regarding court-ordered access isn’t limited to whether or not there has been an automobile accident, but instead allows access for whatever reason a judge may deem appropriate.
Of course you could always hire an attorney to challenge any court order, but you’ve no guarantee of success and you’d be fully responsible for all costs associated with the challenge. In other words, your driving data could be retrieved via court order pursuant to a billing disagreement with the service department that did a repair on your vehicle, as part of divorce discovery, or even to settle a dispute with the IRS over your mileage deductions on your income tax forms. An enterprising attorney could probably come up with many more reasons to get your data.
Moreover, this data could be a bonanza for the insurance industry. Instead of trusting customers to track how many miles they travel a year and merely tracking ticket or accident data, they could insist that customers make their EDR accessible. The technology already exists so that your overall driving data could be instantly accessed at either mandatory checkpoints or even accessed electronically via the Internet while your car is parked at home.3
Drivers who struggle with stop-and-go gridlock traffic each morning or evening as they make their work day commute might have the added aggravation of finding their insurance rates are higher than those who trips are unimpeded by traffic. Additionally, location records, which show that your vehicle occasionally or frequently enters so-called “red-light” districts, could be used as a basis for a rate increase.
The EDRs, if made mandatory, will provide a wide open door to the comings and goings of every American. Tracking not simply how fast you drive or whether you ride your brakes, EDRs have the ability to collect the location and distances of where you drive every time you get into your car. Want to know how often you eat out? Alternatively, how often you use the dry cleaners or go out for ice cream? Just ask your EDR. EDRs could even prognosticate based on driving style or use of ignition key 1 or 2 exactly who was driving a vehicle on a given day.
If your spouse or business partner wants to know where you’ve been going during your lunch break, they can just ask the EDR. Do you sit too close to the steering wheel, too far? Could you stand to lose a few pounds? Are you an early braker? A late braker? Do you drive close to the shoulder or close to the centerline? Do you drive exactly the speed limit at all times? Do you travel the same roads when going to work? Do you have a new girlfriend that you’re visiting frequently? Do you stay overnight? Just ask the EDR and you’ll find that these answers and more are available.
Think these concerns are out of the question? The data aggregated regularly by these devices is like a gold shaft just waiting to be mined. “Essentially, vehicles nowadays are a huge conglomeration of computer chips and modules,” says Mike McCullough, a retired Phoenix police detective who investigated serious crashes for many years. “And the electronic data they collect is going to become more and more common as evidence down the road.”4
According to data recovery specialist Dean Gonsowki, eDiscovery counsel with Clearwell, which is part of the security firm Symantec, an EDR contains a “staggering” amount of information about you and your car. “Now you’re in a situation where, if someone has the time and expertise, they can say you drove from here to there at this speed, you parked at Whole Foods, here’s what you bought, then you got back in your car and drove here and made a call to this number,” he explains. “It’s staggering how much information can be collected.”5
In addition, this type of data retrieval is not an arcane area of activity. This field of data retrieval has a growing network of professional private investigators who specialize in forensic reconstruction of accidents, and they frequently tap in to the contents of the event data recorder.6
Not one to let a good crisis go to waste, NHTSA Deputy Administrator Ronald Medford said requiring EDRs in vehicles “is a result of our investigation with Toyota.”7
After engaging in a nearly year-long examination of Toyota vehicles over potential electronics-based causes for unintended acceleration and finding that the manufacturer was not at fault, policymakers decided that electronic monitors must be placed in every vehicle. In other words, there was no mechanical or electrical malfunction, and yet they conclude the EDR must be mandatory in all vehicles.
But isn’t this about safety? Here are the facts as provided by the National Highway Safety Administration: Based on the latest data, roadway fatalities and injuries have fallen to the lowest rates ever. Highway deaths in 2010 fell to 32,885 for the year, the lowest level since 1949. The record-breaking decline in traffic fatalities occurred even as American drivers traveled nearly 46 billion more miles during the year, an increase of 1.6 percent over the 2009 level.8 Even if we weren’t witnessing an unprecedented drop in automobile deaths, EDRs wouldn’t do anything to change the trend. EDRs don’t help you stop faster or assist you in any way in avoiding an accident.
EDRs aren’t needed to save lives. However, they do expose Americans to yet more intrusion from the government and others who may have either legal claims or commercial reasons for accessing their private data.
The use of EDRs also raises serious constitutional concerns. Earlier this year the U.S. Supreme Court confronted the issue of government tracking automobiles in United States v. Jones. In that case, an FBI task force had attached a GPS tracking device, without first obtaining a valid warrant, to an accused drug dealer’s Jeep Grand Cherokee while it was parked in Maryland.
For four weeks, the government tracked the movements of the Grand Cherokee with accuracy to within 50-100 feet. Remarkably, the federal government sought to claim that it was perfectly legal to gather this data and use it in court without a warrant. In a major blow against the surveillance state and a win for privacy, the Supreme Court ruled that this constituted a form of search protected by the Fourth Amendment.9 Unfortunately the ruling still leaves open the question of whether government mandated EDRs would be treated differently than surreptitiously placed tracking devices. Other remaining questions include what the standard should be for allowing warrants for these devices or how much data should be allowed in and over what period.
Even if the most pressing problem facing America today included resolving disputed claims after an automobile accident, mandating a federal “creeper” box to track your every movement in your car or truck is not the right solution.
Mandating an EDR in every new car takes away the option of Americans not to purchase a vehicle that collects data in a significant, comprehensive and intrusive way.
The ease at which these devices aid spying on owners creates serious privacy concerns. The EDR supporters’ definitions for ownership do little to address these concerns. The overwhelming evidence is that highway fatalities and injuries are at an all-time low. With the rise in the use of EDR data in criminal and court cases it is increasingly clear that the time for the mandatory EDR has not come.
Horace Cooper is a legal commentator and an adjunct fellow with the National Center for Public Policy Research.
Footnotes:
1 SEC. 31406. VEHICLE EVENT DATA RECORDERS.
(a) Mandatory Event Data Recorders-
(1) IN GENERAL- Not later than 180 days after the date of enactment of this Act, the Secretary shall revise part 563 of title 49, Code of Federal Regulations, to require, beginning with model year 2015, that new passenger motor vehicles sold in the United States be equipped with an event data recorder that meets the requirements under that part.
(2) PENALTY- The violation of any provision under part 563 of title 49, Code of Federal Regulations–
(A) shall be deemed to be a violation of section 30112 of title 49, United States Code;
(B) shall be subject to civil penalties under section 30165(a) of that title; and
(C) shall not subject a manufacturer (as defined in section 30102(a)(5) of that title) to the requirements under section 30120 of that title.
(b) Limitations on Information Retrieval-
(1) OWNERSHIP OF DATA- Any data in an event data recorder required under part 563 of title 49, Code of Federal Regulations, regardless of when the passenger motor vehicle in which it is installed was manufactured, is the property of the owner, or in the case of a leased vehicle, the lessee of the passenger motor vehicle in which the data recorder is installed.
(2) PRIVACY- Data recorded or transmitted by such a data recorder may not be retrieved by a person other than the owner or lessee of the motor vehicle in which the recorder is installed unless–
(A) a court authorizes retrieval of the information in furtherance of a legal proceeding;
(B) the owner or lessee consents to the retrieval of the information for any purpose, including the purpose of diagnosing, servicing, or repairing the motor vehicle;
(C) the information is retrieved pursuant to an investigation or inspection authorized under section 1131(a) or 30166 of title 49, United States Code, and the personally identifiable information of the owner, lessee, or driver of the vehicle and the vehicle identification number is not disclosed in connection with the retrieved information; or
(D) the information is retrieved for the purpose of determining the need for, or facilitating, emergency medical response in response to a motor vehicle crash.
2 Ibid. “Any data in an event data recorder required under part 563 of title 49, Code of Federal Regulations, regardless of when the passenger motor vehicle in which it is installed was manufactured, is the property of the owner, or in the case of a leased vehicle, the lessee of the passenger motor vehicle in which the data recorder is installed.” However the data may be accessed if: “a court authorizes retrieval of the information in furtherance of a legal proceeding; the information is retrieved for the purpose of determining the need for, or facilitating, emergency medical response in response to a motor vehicle crash.”
3 “Event Data Recorders: Balancing the Benefits and Drawbacks,” IRMI.com, August 2008, downloaded from http://www.irmi.com/expert/articles/2008/cooper08-insurance-coverage-law.aspx on August 1, 2012: “EDRs are widely installed and used by vehicle manufacturers, insurance companies, law enforcement agencies, and researchers. Insurance companies adopt the EDRs as a way to gain a better precision to evaluate an individual’s risk. Besides speeds and acceleration, EDRs monitor the duration of the trip, the exact vehicle location, the vehicle route, and the time of the day. This information improves the precision of individual risk but it also reveals information about individual preferences or consumption behavior.”
4 Mike Brunker, “Digital evidence becoming central in criminal cases,” MSNBC, November 11, 2011, downloaded from http://insidedateline.nbcnews.com/_news/2011/11/11/8753776-digital-evidence-becoming-central-in-criminal-cases?lite on August 1, 2012.
5 Ibid.
6 Peter Wayner, “Senate Passes Bill Mandating Vehicle Data Recorders for 2015, House Expected to Do Same,” Car and Driver, May 11, 2012, downloaded from http://blog.caranddriver.com/senate-passes-bill-mandating-vehicle-data-recorders-for-2015-house-expected-to-do-same/ on August 1, 2012.
7 Doug Newcomb, “As Congress Mulls Mandate on Car Black Boxes, Data Ownership Remains Unclear,” Wired, May 16, 2012, downloaded from http://www.wired.com/autopia/2012/05/congress-black-box/#more-45719 on August 1, 2012.
8 National Highway Safety Traffic Administration, January 9, 2012.