Will hackers be able to stop your car with mandated 'Kill Switch?'

Who controls your car?

Could your car be controlled by someone or something other than yourself? This question is real, not imaginative, and may become more relevant to more drivers in the coming years. As Frontline News reported, infrastructure bill H.R.3684, Section 24220, Drunk and Impaired Driving Prevention Technology, mandates that by 2026 all new cars must include technology to passively monitor drivers for drunk or impaired driving. 

Should a car's software algorithm determine that the driver is impaired, it is required to “prevent or limit motor vehicle operation.” Although the bill does not explicitly use the term “kill switch,” most readers understand it to be just that.

Former Congressman Robert Barr discussed the bill with the Daily Caller in November 2021, shortly after Biden signed it. Among other issues, Barr raised concerns about data being stolen and cars being hacked and controlled by unauthorized parties.

Everything about this mandatory measure should set off red flares.

First, use of the word “passively” suggests the system will always be on and constantly monitoring the vehicle. Secondly, the system must connect to the vehicle’s operational controls, so as to disable the vehicle either before driving or during, when impairment is detected. Thirdly, it will be an “open” system, or at least one with a backdoor, meaning authorized (or unauthorized) third-parties can remotely access the system’s data at any time. (Emphases added.)

Barr questioned who would have access to the data, how it could be accessed, and by whom — police without a warrant . . . private entities . . . hackers?

Ironically, or perhaps intentionally, there also is no detail in the legislation about who would have access to the data collected and stored by the system. Could it be used by police, and could they access this information without a warrant? What about insurance companies, eager to know with what frequency their customers drove after drinking alcohol, even if it was below the legal limit? Such a trove of data presents a lucrative prize to all manner of public and private entities (including hackers), none of which have our best interests at heart.

Auto lenders already use kill switches

Others have also expressed concern about hackers taking control of cars, for good reason.

Kill switches have already been used, by companies providing sub-prime auto loans, to disable the cars of delinquent payers. Borrowers who have their cars disabled, without laws in place to protect drivers, face a variety of problems, some life-threatening.

Is it likely that drivers affected by the 2026 mandate will face situations such as those described below?

Cars permanently disabled

Andy Grimm, writing for the Chicago Sun-Times, told of a 2022 lawsuit being brought against a lender for using a kill-switch to permanently disable the cars of two individuals who lost their jobs in the spring of 2020, fell behind in their car payments, “and found their vehicles had stopped working thanks to a “vehicle starter interrupter switch” installed by their car dealers and lender.” Their cars have been sitting in front of their homes for two years. 

Car stopped while driving on the highway

The HuffPost detailed the dangerous situation one woman faced when her car was turned off while she was driving on a highway:

[Las Vegas resident T. Candice] Smith in 2013 testified to the Nevada legislature that her car’s kill switch activated as she was driving down Interstate 15.

“All of a sudden the steering wheel locked up and the car shut off,” she testified. “I was barely able to make it to the left shoulder. I was scared and shaking and had no idea what just happened.”

Few laws to protect car owners

According to the HuffPost, few states have enacted laws regulating the use of kill switches.

But only half a dozen states have enacted regulations on kill switches, including California, Colorado, Connecticut, Nevada and New Jersey. The laws vary, but all, at the least, require telling the borrower that the devices, which also have GPS tracking, are installed.

The Colorado law specifically prohibits stopping the vehicle if doing so would pose a danger to its occupants, such as when it’s in motion. Most of the other laws call for 24 or 48 hours’ notice before the vehicle is disabled, and many allow grace periods or emergency overrides.

Sophia Romero, staff attorney in the Consumer Rights Project at the Legal Aid Center of Southern Nevada, said it took years and a series of lawsuits for the law in her state to catch up with the practice of installing the devices on cars. (Emphasis added.)

Hackers could stop your car, too

Vintage race car driver Lauren Fix reported on 'kill switches' for Car Coach Reports (in the below video @3:05), noting the potential for hackers to retrieve a driver's data stored by the system and even take control of a vehicle.

. . . tracking that data also makes it possible for bad actors to retrieve that because it's open. 

More pressing than the privacy concerns though are the safety issues included is an automatic kill switch with internet access. Now we all know that hackers have accessed cars before and they can access this system and this represents an obvious scenario that a malicious agent could disable your vehicle remotely with no warning.

Commenters on a FrontPage Magazine article about the law governing kill switches were likewise concerned about cars being stopped/hacked while being driven:

What happens when someone like China hacks the system and shuts all the cars down?

This is a really bad idea. What happens in an emergency? No fleeing from criminals, violent mobs, natural disasters, or dashes to the hospital. These things take more than 15 seconds. [This refers to a California law requiring technology to prevent cars from going10 miles above the speed limit: “New cars will have a special button on the dash. If you suddenly need to speed and manage to find the button when trying to drive out of some bad situation, and it lets you speed for 15 seconds.”] Cars losing power on busy freeways already cause accidents, and just traffic jams, if you’re lucky. I can also foresee people’s cars being shut down just when they’re driving and eating. (Emphasis added,)

________________________________________

I’m a non-driver, but even my non-existent expertise would lead me to question how any manufacturer can guarantee that shut-down would occur in a safe and controlled way. What if the car stops itself suddenly and the driver behind you rams your car? Unless an on-board computer can evaluate all of the external factors, there is no way that this is any safer than relying on human judgement (most people want to survive, which is the sort of consideration that is unlikely to be factored into a computer’s processes)

________________________________________

. . . imagine an interstate highway, where the cars cruise along at 70 mph, and some hacker, or misguided government employee hist this kills switch? There would be a 40 car pileup, with dead and injured all over the place. Terrorists wouldn’t have to use car bombs anymore, just shut off some cars on a busy, fast moving highway, and enjoy the carnage from an overpass. . . . I wonder how long before the aftermarket will start selling a way to kill for the kill switch, along with the surveillance equipment, if they are not already? (Emphases added.)

Congress won't defund mandate implementation

In his article, Barr said that, after the law is implemented we would lose “the freedom of the open road" that individual car ownership brought to the American Dream." 

Representative Thomas Massie attempted to preserve that freedom, this past November, with a proposed amendment to the Congressional bill that would remove funding for enforcing the law:  

Amendment No. 60 – Prohibits funds from being used to implement Sec. 24220 of the IIJA, which mandates new vehicles include a kill switch to monitor diver performance and prevent vehicle operation. 

As Massie explained in the video below, he wants to feel confident that the car will continue operating when he takes his family on trips. 

Allowing the car to disable itself I think is troublesome. We don’t have a lot of time. This is supposed to be implemented in 2026. And I don’t know about you all, but I would like to know when I put my family in the car and I’m taking a trip somewhere, the car is not going to disqualify me. 

Massie's amendment, to defund the ‘kill switch’ mandate, ultimately failed to pass as nineteen House Republicans joined Democrats to defeat the amendment, allowing the law to pass in its original form with provisions for implementing the “kill switch” mandate.

Related articles: 

'Kill Switch' to be mandated in cars by 2026 with software deciding if you're too impaired to drive

Cars to be programmed to limit speed if California bill becomes law