QuestionWill self-driving cars need hacker insurance?
Hopes&Fears answers questions with the help of people who know what they're talking about. Today we consider self-driving cars and who would be held responsible if your car's computer is hacked.
This week it was revealed that four of the 48 self-driving cars that have been on the roads in California since September have gotten into minor accidents, despite advocates touting their pristine safety records. But given that autonomous vehicles will completely depend on computerized sensors and controls, we considered a more sinister problem: hackers.
Will self-driving cars be susceptible to cyber attacks? And if so, who will be held responsible? Is there a need to create a new branch of insurance to cover injuries caused by a hacked vehicle computer? Experts in cyber-security and insurance give their opinions.
Founder & CEO, cyber security at My Digital Shield
The truth is that we’ve had self-driving cars for a while, but instead of being controlled by input from sensors all around the vehicle, they’re being controlled by sensors at the steering wheel and pedals. Take for example the Chevy Volt; there is no physical connection from the steering wheel to the turning of the front tires. It’s all computer controlled. I can call OnStar and they can control the Electronic Control Unit (ECU) remotely to unlock my doors or turn off the vehicle. Since they have remote access to control the ECU, that means it’s not a stretch to assume someone else could access it remotely with malicious intent.
Initially, it’s going to just be people hacking just to see if they can do it. [Charlie Miller and Chris Valasek] hacked a car; while sitting with laptops they got wirelessly connected to the car’s ECU while someone was driving it and were able to disable the breaks.
The self-driving truck was just announced, and I totally understand why it’s such a hot topic. It’s like, “oh cool, the truck drives itself!” But what happens when someone wants to control it differently? Hopefully, the car manufacturers are doing their due diligence and checking it inside out, but this is a new world for them. They’ve never had to deal with this before.
The problem is, people want to get their technology out there really quick, So you don’t have programmers sitting there looking at everything line by line to make sure that everything is secure.
I want to make clear that I’m not a doomsday type of person, I just want to make sure that there’s some sort of awareness about it. We don’t have to be afraid of technology and stop using it, the point is that we should build everything with security at the forefront. Computers have been in cars for a long time, but the fact that computers are getting more intelligent—controlling the brakes, gas and steering—in addition to the fact that they’re now connected wirelessly, meaning you don’t have to physically get to the computer and plug in to manipulate it, well you just created something that has to be highly tested before it’s released.
Most Hackable Cars:
Jeep Cherokee (2014)
Cadillac Escalade (2015)
Infiniti Q50 (2014)
Least Hackable Cars
Dodge Viper (2014)
Audi A8 (2014)
Honda Accord (2014)
Source: Black Hat security conference
Policy Expert in Insurance, Co-Founder of R Street Institute
It’s obviously a very complicated issue. Before you even get to what do you do about insurance for hacking, it’s not at all clear what you do for insurance for self-driving cars. Auto insurance traditionally has covered drivers for their driving ability, with considerations for what it’s like where you live—are there a lot of accidents? Or, is there a lot of traffic, are there a lot of auto thefts?
If you have a fully autonomous car, that changes the equation entirely because we’re no longer looking at the driving record of the person, you’re looking at the vehicle itself alone. Traditionally, that would not be covered under an auto insurance policy, that would be covered under a product liability policy. The big difference there is you as a driver buy an auto insurance policy, but the company that produces the self-driving car would buy a product liability policy.
So how states are going to work in this area and consider these issues is totally unclear at this point. A few states have passed some preliminary laws that theoretically legalize fully-autonomous cars. For the most part they have kept their existing insurance systems in place, but that would be subject to court challenges, because, let’s say you’re driving a self-driving car, and the car causes an accident that you could not theoretically have avoided. Your auto insurer is not going to want to pay that claim because that’s not what they’re insuring. If they’re held responsible for it, they’ll want to sue the maker of your car and say that they are liable for it.
Moving this forward to self-driving cars and hacking, I think that would fall under some sort of product liability system where the manufacturers would be held at some part responsible for the security of their systems. If there were a way to find out who the source of the hacking was and if that person has any money, then the product liability system would look to recover something from them. But if it’s a state that does it—say North Korea does it—then there’s probably no chance that they’re going to get anything back.
Increase of Electronic Control Units in regular cars:
11 in 2006
34 in 2014
41 in 2010
98 in 2014
7 in 2010
17 in 2014
23 in 2006
40 in 2014
Source: Black Hat conference
Consumer Analyst & Insurance Expert at Insure.com
As cars move more towards being autonomous, I do believe insurance companies will have to look at how policies are written and probably change some language. There is the possibility that the car maker will have to take on some responsibility if something goes wrong. I think it will be very interesting to see what happens.
As for a car being hacked, as policies are written now I would see this falling under comprehensive coverage. It is basically someone taking over your vehicle, as a thief would do when stealing your car and going behind the wheel. In the future, comprehensive coverage may have special language saying whether the insurer will cover if your car is remotely hacked or if it will be excluded.
I unfortunately do not know of any existing companies or studies that are looking into the possibility of hacker attacks on self-driving cars, or even cars now, now that they are becoming equipped with more and more software. That doesn’t mean that insurers aren’t looking into it, I just don’t know of anyone sharing information on it yet.
As of May 2015, Google's 23 self-driving cars have been involved in 11 minor traffic accidents on public roads.
ILLUSTRATION: Nikita Treptsov Additional sources: AP