Connected cars: when security is not only a concern because they can be hacked

Concern about the cybersecurity of connected cars is growing. There is increasing concern about preventing potential hackers from gaining control of the vehicle users’ data, as well as of the vehicle itself. Just last week, for example, in the United Kingdom, the Under-Secretary of State for the Department for Transport, Lord Canallan, announced that new guidelines were being established for manufacturers of internet-connected cars in order to protect motorists from attacks by potential cyber-hackers.

This is a correct preventive approach that deserves praise, but according to the Institute of the Motor Industry (IMI), it is incomplete, because the guidelines established to reduce the risks of piracy of internet-connected cars do not cover the whole problem and overlook something important: the technicians who work on developing these vehicles and, especially, those who in the future will have to maintain and repair them. The IMI urges the authorities to also focus on the qualification and training§h14# that will be required of all of them in the future to guarantee the quality of their work.

Various studies carried out by professional teams commissioned by the automotive industry have already shown that many drivers and passengers are not aware of the security risks that connected vehicles present today.

In a survey carried out by the IMI among 1,000 motorists, 50% of those interviewed said they were not aware that their car is open to cyberattacks, just like any personal computer, and even less aware that it could be controlled and stolen using Wi-Fi technology by anyone who accesses the on-board computer systems.

61 percent of respondents said they use their car’s connectivity to smartphone make online purchases or carry out financial transactions with their bank. 51 percent of respondents expressed concern that their car could be accessed or controlled by a hacker, and 47 percent were concerned that the car or its data could be remotely stolen via Wi-Fi technology. These are certainly high figures considering that only 43 percent of respondents had satellite navigation and integrated telephony in their vehicles.

But for the IMI, the problem is not only technological. All these systems must be controlled, but it is also necessary to control the people who control them, both during development and in the subsequent maintenance and repair work that will be required, since all of them will be able to freely access and manipulate the vehicle’s data and, consequently, that of its users.

“Vehicle technicians have access to all the operating systems of cars and their data communication portals. Under current regulations, there is no register of technicians, no security checks, and no competence tests to guarantee the quality of their work or the safeguarding of data,” says Jim Saker, professor at Loughborough University, who led the study commissioned by the IMI.

For the British institution, one of the key factors that needs to be regulated to guarantee the security of car data is knowing that the technicians working on a vehicle are properly trained and that their knowledge adheres to a proven professional qualification standard. In the survey, 86% of those interviewed by the IMI said that vehicle technicians responsible for both the development and future maintenance and repair of connected cars must be properly qualified and regulated to carry out repairs.

As Steve Nash, IMI Chief Executive, added: “Computer diagnostics, vehicle programming and software updates are common in the motor industry today. However, with the sector currently unregulated and without specific national standards in place, it is not always possible to trace the people who may have access to our personal information. We are working hard to get the government to address this area, as well as the creation of systems at the manufacturing stage, so that motorists can be confident they are not at risk.”

As can be seen in the United Kingdom, where this matter is being taken very seriously, it would be worth knowing what the situation is in Spain and what specific regulations are being established in this area to guarantee full security in the safeguarding of data.