CybersecurityWho's Responsible When Your Car Gets Hacked?

By Doug Irving

Published 22 November 2019

In the future, when cars can drive themselves, grand theft auto might involve a few keystrokes and a well-placed patch of bad computer code. At that point, who will be liable for the damages caused by a hacker with remote control of a 3,000-pound vehicle?

In the future, when cars can drive themselves, grand theft auto might involve a few keystrokes and a well-placed patch of bad computer code. At that point, who will be liable for the damages caused by a hacker with remote control of a 3,000-pound vehicle?

Cars are becoming “fast, heavy artificial intelligences on wheels,” a recent RAND report cautioned—and that means they’re becoming vulnerable. Potentially billions of dollars ride on that question of who has the legal responsibility to keep hackers from grabbing the wheel or cutting the brakes.

“These are not likely events, and there are lots of engineers working to make them even less likely,” said James Anderson, the director of the RAND Institute for Civil Justice and a coauthor of the study. “But they’re not impossible. They will occur. It’s at least worth some serious thought about what the legal consequences will be.”

Systemwide Vulnerabilities
Reality here is catching up to science fiction. In 2015, hackers showed that they could take control of a Jeep Cherokee through a hidden flaw in the entertainment system. They blasted the air conditioning, cranked up the radio, and switched on the windshield wipers. Then they cut the transmission. Chrysler had to rush software updates to 1.4 million owners, the first cybersecurity-related vehicle recall in U.S. history.

The FBI has since warned that hackers could exploit many of the electronic selling points of modern cars, from their internet radios to their critical control systems. Mercury Insurance even has a tool on its website: “How hackable is your car?”

Anderson has been studying the legal challenges posed by autonomous vehicles for more than a decade. He’s an attorney by training; his last job was as an assistant federal public defender representing death-sentenced prisoners after their convictions. He hadn’t given vehicle technology much thought—until he was standing in line at RAND to get his picture taken for his employee badge. He started chatting with another new hire, an information scientist who was studying the emerging science of driverless cars.