Posts

Wednesday: Big Wheels Turning

/4 Comments/in , , , , /by

Hard to believe this was made in 1982. Yeah, the production quality doesn’t match today’s digital capabilities, but the story itself seems really prescient. How can an ethically-compromised bloviating bigot manage to fumble his way into office?

Now you know. Bet you can even offer constructive feedback on how director Danny DeVito could update this script for today’s social media-enhanced election cycle.

Self-Driving Vehicles

  • NHTSA issues guidelines for self-driving cars (Detroit Free Press) — FINALLY. But is it a bit too late now that Uber already has a fleet on the streets of Pittsburgh and Tesla has been running beta cars? Let’s face it: the federal government has been very slow to acknowledge the rise of artificial intelligence in any field, let alone the risks inherent in computer programming used in vehicles. We’re literally at the end of a two-term presidency, on the cusp of entirely new policies toward transportation, and NOW the NHTSA steps in? We need to demand better and faster rather than this future-shocked laggy response from government — and that goes for Congress as well as the White House. Congress fails to see the importance of early regulation in spite of adequate warning:

    Legislators warned automakers at the 15 March Senate hearing that the governing body took a dim view of the industry’s ability to self-regulate. “Someone is going to die in this technology,” Duke University roboticist Missy Cummings told the US Senate during a tense hearing where she testified alongside representatives from General Motors and Delphi Automotive, among others.

    Senators Ed Markey and Richard Blumenthal, who questioned car executives at the hearing, had cosponsored a 2015 bill to regulate self-driving automobiles. The bill was referred to committee and never returned to the floor. [source: Guardian]

    In the mean time, we have an initial 15-point guideline the NHTSA wants to address; are they enough? Is a guideline enough? Witness Volkswagen’s years-long fraud, flouting laws; without more serious consequences, would a company with Volkswagen’s ethics pay any heed at all to mere guidelines? Are you ready to drive on the road with nothing but non-binding guidelines to hold makers of autonomous cars accountable?

  • Multiple Tesla car models hackable (Keen Security Lab) — Check this video on YouTube. At first this seems like an innocuous problem, just lights, mirrors, door locks…and then * boom * the brakes while driving. These same functions would also be controlled by AI in a self-driving car, by the way, and they’re already on the road. This is exactly what I mean by the feds being slow to acknowledge AI’s rise.
  • ‘OMG COOL’-like impressions from early self-driving Uber passengers (Pittsburgh Post-Gazette) — Criminy. The naïveté is astonishing. Of course this technology seems so safe and techno-cool when you have an Uber engineer and programmer along for the ride, offering the illusion of safety. Like having a seasoned, licensed taxi driver. Why not just pay for an actual human to drive?
  • Tesla caught in back-and-forth with Mobileye (multiple sources) — After analyzing the May 2016 fatal accident in Florida involving Tesla’s semi-autonomous driving system, Tesla tweaked the system. The gist of the fatal accident appears to have been a false-positive misinterpretation of the semi-trailer as an overhead road sign, for which a vehicle would not slow down. But this particular accident alone didn’t set off a dispute between Tesla and the vendor for its Autopilot system, Mobileye. Another fatal accident in China which occurred in January was blamed on Tesla’s Autopilot — but that, too, was not the point of conflict between Tesla and its vendor. Mobileye apparently took issue with Tesla over “hands on” versus “hands-free” operation; the computer vision manufacturer’s 16-SEP press release claims Tesla said the Autopilot system would be hands on but was rolled out in 2015 as hands-free. Mobileye may also have taken issue with how aggressively Tesla was pursuing its own computer vision technology even before the two companies agreed to end their relationship this past July.  A volley of news stories over the last two weeks suggest there’s more going on than the hands on versus hands-free issue. Interestingly enough, the burst of stories began just after a hacker discovered there’s a previously undisclosed dash cam capturing shots of Tesla vehicle operations — and yet only a very small number of the flurry of stories mentioned this development. Hmm. Unfortunately, the dash cam feature would not have captured snaps for the two known fatal accidents because the nature of the accidents prevented the camera from sending images to Tesla servers.

Artificial Intelligence

  • The fall of humans is upon us with our help (Forbes) — this article asks what happens when white collar jobs are replaced by artificial intelligence. Oh, how nice, Forbes, that you worry about the white collar dudes like yourselves but not the blue collar workers already being replaced.How about discussing alternative employment for 3.5 million truck drivers?
    Or the approximately 230,000 taxi drivers?
    How about subway, streetcar, and tram operators (number of which I don’t currently have a number)?
    How about the administrative jobs supporting these workers?This is just a portion of transportation alone which will be affected by the introduction of AI in self-driving/autonomous vehicles. What about other blue collar jobs at risk — like fast food workers, of which there are 3.5 million? And we wonder why Trump appeals to a certain portion of the working class. He won’t be informed at all about this, will not have a solution except to remove persons of color as competition for employment. But the left must develop a cogent response to this risk immediately. It’s already here, the rise of machines as AI and algorithmic replacements for humans. Let’s not wait for the next Luddite rebellion V.2.0 — or is Trump’s current support the rebellion’s inception?
  • But every business needs AI! (Forbes) — Uh…no conflict here at all with the previous article. Nope. Just playing the refs. Save America, people, just keep buying!(By the way, note how this contributor touts Hello Barbie chatbot as a positive sign, though Mattel’s internet-enabled Barbie products have had some serious problems with security.)
  • The meta-threat of artificial intelligence (MIT Technology Review) — Doubt my opinion? Don’t take it from me, then, take it from experts including one who plans to make a fortune from AI — like Elon Musk.

Longread: Academia becomes the new white collar underclass
You may have noted Long Island University-Brooklyn’s 12-day lockout which was not really resolved last week but deferred by a contract extension. The dispute originated over a pay gap between Brooklyn and two other better paid LIU campuses. Ridiculous sticking point, given the small distance between these campuses LIU barred instructors from campus and halted their benefits during the lockout. Students walked out, infuriated by the temps who subbed in for the locked-out instructors — a cafeteria worker in one case filled in for an English instructor. LIU’s walkout won’t be the only such conflict over academic wages. To understand the scale of the problem, you’ll want to read this piece at Guernica, which explains how academia is being shaken down across the U.S., not just in Brooklyn. I remember asking an academic administrator back in 2006 what would happen when secondary education was commodified; they couldn’t imagine it ever happening. And now the future has arrived. What are we going to do about this while retaining U.S. standard in education?

Hope you’re liking the site revamp! Do leave a comment if you find anything isn’t working up to snuff.

Wednesday: Mend

/11 Comments/in , , , /by

Repair Day here, can’t spend much time reading or writing as I’ll be tied up mending things. Enjoy a little mellow Foo Fighters’ tune — can’t handle metal rock today or I’ll end up HULK SMASHing things I’m supposed to fix.

Here’s a range of topics which deserve more attention:

• UK’s Chilcot report released today (Guardian-UK) — [Insert lengthy string of epithets here, circa 2003] I’m sure one of the other team members here at emptywheel will elaborate more effectively on the ugliness in the report and on former Prime Minister Tony Blair‘s continued lies rationalizations for military intervention in Iraq over alleged 9/11 terrorists and non-existent nuclear weapons. His self-flagellation and tepid mea culpa are pathetic, like watching a wee gnat flailing on an elephant’s ass. Thirteen years later, Iraq has become a training ground for terrorists. Self-fulfilling prophecy, much?

The full Chilcot report can be found here. The Guardian is working on a collaborative evaluation of the same.

BreachedDataSweetSpot_06JUL2016 • Hookup site Ashley Madison under investigation by FTC (Reuters) — Not clear exactly what FTC’s focus is, whether they are looking primarily at the data breach or if they are looking into the misleading use of “fembot” AI to chat up potential customers. Though the article’s characterization of the business as a “discreet dating site” cracks me up, I’m still concerned about the potential risks involved with a breach, especially since other breached data make Ashley Madison’s data more valuable. Like in this Venn diagram; if you were a foreign agent, which breached data would you mine most carefully?

• French Parliament released its inquiry into November terrorist attacks (20 Minutes) — Six months after the attack at the Bataclan and in the streets of Paris, representatives of the Parliamentary inquiry spoke yesterday about the inquiry’s findings:

  • Poor cooperation between intelligence functions — In spite of consolidation of General Intelligence and Directorate of Territorial Surveillance under the Central Directorate of Internal Intelligence in 2008 and then the Directorate General of Internal Security (ISB) in 2014, there were gaps in hand-offs between functions.
  • Ineffective collection and sharing of prison intelligence — The ISB did not have information from Justice (the prison service) about the relationships between incarcerated radical Islamists nor information about targets’ release from custody.
  • Poor cooperation between EU members and EU system gaps — Fake Syrian passports should have been caught by the EU’s Frontex at external borders to EU, and Frontex has no access to data collected by police and intelligence services internal to the EU.
  • Gaps in jurisdiction — Not all law enforcement was engaged as they should have been during the November attack, and when engaged, not where they should have been.
  • Victims and families treated inadequately — Some families were told they were “ineligible” to be notified of their relatives’ deaths. Forensic Institute was swamped by the volume of work. At least one victim tried to call the police; they hung up on the victim because she whispered on the phone.

It’s not clear what steps the French will take next to fix these problems identified after looking at 2015’s January and November terrorist attacks, though it is reassuring to see a relatively detailed evaluation. Some of the suspects involved in both the November attacks in Paris and in Brussels are still being rounded up and bound over for prosecution; two were handed over by Belgium to France just this week. The full Parliamentary inquiry report will be released next week.

• NHTSA informed by Tesla of self-driving car accident 9 days later (Reuters) — The delay in reporting may have misled investors in advance of Tesla’s offer for SolarCity suggest reports, including one by Fortune magazine. To be fair, I don’t think all the details about the accident were fully known immediately. Look at the condition of the vehicle in the Reuters’ report and the Florida Highway Patrol report; the FHP’s sketch of the accident site doesn’t automatically lead one to think the accident was induced by distracted driving or by auto-pilot. Can’t find the report now, but a DVD player was found much later; it was this device which revealed the driver’s last activities. How did the FHP’s report make its way to Tesla? And as Tesla responded, with one million auto accidents a year, not every accident is reported to the NHTSA. Begs the question: should all self-driving car accidents be automatically reported to the NHTSA and their automakers, and why?

• ‘Zero Days’ documentary on Stuxnet out this Friday (Flavorwire) — If director Alex Gibney can make this subject exciting to the average non-technical schmoe, hats off. It’s a challenge to make the tedium of coding exciting to non-coders, let alone fluff process control equipment. This is a really important story with a very long tail; hope Gibney was able to do it justice.

EIGHT DAYS in session left in U.S. House of Representatives’ July calendar. Hearing about EPA scheduled this morning, but I don’t think it had anything to do whatsoever with Flint Water Crisis.

Okay, that’s enough to get you over the hump, just don’t break anything on the way down. I’m off to go fix stuff.

Friday: Death to All That Jazz

/9 Comments/in , /by

My friend, you would not tell with such high zest
To children ardent for some desperate glory,
The old Lie; Dulce et Decorum est
Pro patria mori.

— excerpt, Dulce et Decorum Est, by Wilfred Owen

This week has been a long death march. Death to optimism, death to pre-existing notions of political parties, death to futures defined by progressive visions.

Ironically, the march led to today’s 100th anniversary of the Battle of the Somme — the beginning of World War I and the bloodiest day in British military history. The battle lasted five months and cost a million soldiers’ lives. The British suffered 60,000 casualties on the first day alone as they fought alongside the French against the Germans.

Among the British dead were black soldiers from Britain and British West Indies, and Indian Army Calvary who came from what is now India and Pakistan. The British recruited from South Africa, Egypt, China, and more to replace their losses as the Somme continued.

One hundred years later they have forgotten all of this shared pain and history, along with Winston Churchill’s post-WWII vision of a unified European family, a Pan-European Union which the United Kingdom, United States, and Russia supported.

On that bright and cheery note, have a little Death to Jazz — music which never dies.

Democracy elsewhere
Australians went to the polls on July 2nd for this year’s federal election. They didn’t torture themselves with a year or more of campaign crap, thank goodness. I can’t tell you much of anything about this election except that like the US and UK, there are two major parties running neck-and-neck — the Liberal/National coalition and the Labor party — while the world might hope for Greens to succeed. At least Aussies have more than two major parties to choose from even if they are more colorful than any of ours. Putting aside my flippant attitude, this election has serious consequences for the globe given the need for Australia’s climate change research in spite of its excessive reliance on sales of coal as well as its creeping authoritarian approach toward the internet and surveillance. What policies will the next Aussie government pursue?

Wheels

  • NHTSA launches investigation into fatal autopiloted Tesla crash (Tesla Motors) — OMG if you look at the Florida Highway Patrol report sketch of the accident you’ll immediately grasp what fail this was. This was a really horrific accident. Tesla’s post indicates the sensor read the gap below the semi-truck’s trailer as open space. Jalopnik picks apart the accident; they may be right that the obstruction detection sensor is too low on the vehicle. Besides the fact the driver was completely distracted and watching a movie while on autopilot, something else doesn’t sit right about this crash — like the truck failed to yield, or the car was traveling at too high a rate of speed? Truly a sad situation for the driver’s family and the truck driver.
  • Volkswagen thinks its 3.0L passenger diesel engines can be “fixed” to meet emissions standards (Reuters) — Wait, what? They used “undeclared auxiliary emissions-control devices” on this engine, and not the emissions controls defeat software used in the 2.0L engines, which somehow means they can fix the larger engines. I’ve missed something somewhere along the way because I don’t recall reading about any “auxiliary devices” before now. Color me skeptical.
  • June car sales remain on pace with May, except for Volkswagen (Business Insider) — Dieselgate has really done a number on VW brand here in the U.S.; sales are down 22% for the German automaker over last year. Other brands have picked up the slack, though; the biggest winner is Nissan.

Don’t forget about China
Fourth largest by area, second largest by GDP, and first largest by population, let’s not forget about China!

  • ICYMI: Insurance company to CIA employees bought by Chinese company (Newsweek) — You might want to read Marcy’s piece if you haven’t already. The U.S. really needs to improve the CFIUS review process given this egregious example. It only takes some big iron computing to crunch a match between Wright USA’s business database and other breached databases out there in the cyber-wilds to identify…well, you’re smart. Figure it out.
  • Taiwanese missile mistakenly fired, kills fishing boat captain (IBT) — No words for this, which could have been very ugly. Somebody kept a cool head.
  • Taylor Swift’s love life no longer the subject of Chinese bettors (Billboard) — Chinese government banned the sale of insurance instruments which paid off when celebrity singer/songwriter Swift broke off her romance. Good move, this one, because Swift changes partners like some women change purses and shoes. Don’t waste your money betting on what is surely a PR-driven romance between Swift and the flavor of the month, British film star Tom Hiddleston. (Better off betting on who will be the next James Bond — Hiddleston? Doubtful.)

Party Plans
It’s a long holiday weekend here in the U.S. If you don’t have plans, here’s a few tips.

  • The party moved, dudes; new sandbar this year (Mlive) — Court tossed the monster party held on one of Michigan’s inland lakes because it was monster. This year it’s being held at Wixom Lake instead of Torch Lake. Poor Wixomites; brace yourselves for 1000-plus partiers.
  • Non-Terrible Songs about America (BitchMedia) — This week’s BitchTapes playlist is estrogen driven, a nice even-handed, clear-eyed change of pace for a mellow Fourth of July. Kind of like a hug from your mom or sister who love you in spite of the fact they know only too well you’re a bonehead.
  • Baking cookies for holiday snacking? Don’t eat the raw dough! (Yahoo News) — We’ve always been told raw dough is risky to eat because of uncooked eggs in the batter. But unless you’ve checked yours against the FDA’s recall list, it’s the flour that’s the potential threat. E coli-tainted flour is still in the food system and could be in uncooked dough products. Cook them well, don’t eat them raw.

Holiday mode commences in three, two, one — boom! Because nothing says freedom like incendiary devices at close range!

Friday Morning: F for Free and Favorite

/28 Comments/in , , /by

Congratulations! You made it to another Friday! The end of the week means jazz here, until I run out of genres. This Friday I’m not covering a genre, though. I’m pointing you to one of the most surprising and utterly awesome gifts jazz lovers and historians could get.

1,000 hours of free jazz, ready to download.

Holy mackerel! I almost fainted when @OpenCulture tweeted last week about David W. Niven’s collection shared with the public at Archive.org. Just as amazing is Niven’s commentary, providing context we would never otherwise have about each piece.

I’ll embed some Louis Armstrong at the bottom of this post to get your weekend started. Mark this collection as one of my favorite things ever.

Malware discovered, targeting non-jailbroken Apple iOS devices in China
This is the second China-specific malware that researchers at Palo Alto Networks have found this year. Gee, why China?

UK’s Labour Party wankers want ‘Snoopers’ Charter’ because Snowden
Just the wankers, mind you, though it’s hard to tell which MPs were the wankers as Labour and SNP sat on their hands during the vote for the Investigatory Powers Bill (IPB), not wanting to appear obstructive. Fondly called the ‘Snoopers’ Charter,’ the bill replaces Regulation of Investigatory Powers Act (RIPA) and passed in the House of Commons on its second reading. The bill allows the UK government to amass all Internet Connection Records (ICRs) for a year’s time, including telecommunications connections. Restrictions on which government entities have access to these records and for what purpose is muddy at best, and the cost of collecting and storing these records will be borne by the network service providers who in turn will need to raise their rates. Sane people understand the IPB as passed is atrocious. The bill would not have passed the second reading at all had all of Labour and the SNP voted against it, but a number of wankers argue Edward Snowden is reason enough to dragnet the entire UK’s internet activity — which makes no sense whatsoever, based on the bill’s current formulation. The ‘Snoopers’ Charter’ now enters the Committee Stage, where it’s hoped somebody catches a cluestick and puts the brakes on this current iteration of government panopticon.

U.S. National Highway Traffic Safety Administration and FBI warn about automobile hacking
Hmm. A little late to the party after at least four different vulnerabilities were revealed over the last year, but better late than never. Rather annoying the public needs to be on guard against automakers’ naiveté/stupidity/hubris.

Google’s parent Alphabet selling its robot division Boston Dynamics
Remember the creepy four-legged robot ‘Big Dog’? It and its developer are up for grabs. Google (before it became Alphabet) bought Boston Dynamics in 2013, but now finds the firm doesn’t fit its strategy. Worth noting differences in reaction to the news:

The tone of the MIT Review piece — technology’s coolness is sufficient rationale for its creation and existence — offers interesting insight, explaining how awful technology ends up commercialized in spite of its lack of fitness.

Let’s call it a week and get on with our weekend. Have a good one!

Friday Morning: It’s Five Somewhere

/5 Comments/in , , , /by

This week has been really long. Painfully dragged out. Mid-week snowstorm probably didn’t help. But here we are, survivors with another week and yet another Presidential campaign debate under our belts.

I’ll keep it short and snappy given how much ugly we’ve been through.

Your information security is only as good as the stupidest person on staff
“Hello, FBI? I’m new here and I don’t have my code. Can you help a girl out?” No joke, that’s about all it took for one unnamed hacktivist to get inside the FBI. And yet the FBI demands backdoors into all mobile devices. I can’t even…

Meet your new immortal overlord: Your self-driving car
This first graf scares the crap out of me:

The computer algorithms that pilot self-driving cars may soon be considered the functional equivalents of human drivers. That’s the early opinion of the National Highway Traffic Safety Administration—and so begins our slow-burn acquiescence in the battle of man versus machine.

And not even for the reasons that PC World’s editor-in-chief Jon Phillips outlines in his editorial. If a governmental agency recognizes an algorithm as equal to a human, how long before humans are actually subordinate to artificial intelligence?  It’s bad enough corporations — legal constructs — have nearly the same rights as humans and can live forever. This needs to die on the vine right now — especially since Google is ramping up hiring for its line of self-driving cars.

Speaking of Google…

Busy week on Zika front

Media commentator Douglas Rushkoff interviewed on digital society

You left Facebook in 2013. How is that working out for you?

Professionally, I’m thinking it may be good for one’s career and business to be off social media altogether. Chris Anderson was wrong. “Free” doesn’t lead to anything but more free. Working for free isn’t leverage to do a talk for loads of money; now they even want you to talk for free. What am I supposed to do? Join YouTube and get three cents for every 100,000 views of my video? That is crap; that is insane! …

A worthwhile read, give it a whirl when the dust begins to settle.

Here’s hoping the weekend moves as slowly as this week did. Huli pau!

Monday Morning: So Good to Me

/14 Comments/in , , /by

Yeah, Mondays start off well as we emerge from the safe warm cocoon of our beds to begin our day. But Monday evenings are a different kettle of fish.

Like this Monday — we’ve enjoyed a weekend’s cozy glow from soft power exercised through diplomacy now that the IAEA kicked off the new Joint Comprehensive Plan of Action (JCPOA). By mid-morning the flying monkey hoard of dissent will saturate media, making a cesspool out of the evening news.

Can hardly wait. Meanwhile…

Un grupo de 66 accionistas de Volkswagen
I admit my command of Spanish is weak, but even at first glance this article didn’t look good for VW. A group of shareholders—again? Let’s translate:

A group of 66 shareholders of Volkswagen (VW) take legal action against the German automaker after the company distorted evidence of greenhouse gas emissions. The complaint will be presented this week, according to the British newspaper Financial Times.

El Pais reports this is the second class-action lawsuit against VW in relation to the emissions controls defeat technology; plaintiffs for this suit are believed to be investment banks. However there were dozens of class action suits in the U.S. as of last fall, including dealerships stuck with rapidly depreciating but unsalable inventory.

A second article in El Pais also noted VW’s Mueller announced additional investment in its Tennessee-based plant after apologizing to the U.S. for the emissions control ‘trick’ (this last word was ‘trucaje‘ in Spanish). VW has now lost marketshare in the EU for the first time in eight years.

USDOT, NHTSA, Automakers agree on Proactive Safety Principles — including improved cybersecurity
Seems rather feel-good in a non-binding sort of way, but USDOT and NHTSA managed to convince automakers to agree to collaborate on vehicle safety and cybersecurity. The agreement announced last week at Detroit’s auto show coordinates with the Obama administration’s proposed $4 billion budget earmark for automated vehicle research and development.

I still can’t see the benefit in individual autonomous cars over public mass transit. My gut says this White House-driven effort at coordination is really aimed at cybersecurity — and surveillance. And no mention of the Three Laws of Robotics, either.

Formic acid fuel cell to power Dutch students’ car
Now this is a great bit of automotive and alternative energy news. Students at Eindhoven University of Technology in the Netherlands are working on automotive fuel cells powered by formic acid instead of hydrogen. Much of the fuel cell technology to date relies on hydrogen, but the problem has been hydrogen generation and storage. This challenge has stymied fuel cell-powered cars for nearly two decades. Formic acid could be handled like gasoline; it is fairly easy to produce from wood pulp and other fibrous plant mass, or by catalysis, and is low in toxicity, though care must still be used in its handling.

Given the potential application beyond vehicles, I’d rather see investment in this line of automotive research.

U.S.-China Economic and Security Review Commission looking into China’s military robots
Since the 1990s there have been a number of organized cyber attacks originating in China which seek out military and industrial content. China’s recently-developed military robots look an awful lot like those developed by QinetiQ. USCESRC is hiring researchers to assess China’s current robotics capabilities, and how much of this capability arose from U.S. sources.

The article in NextGov about USCESRC’s effort characterizes QinetiQ as a “Pentagon contractor.” Funny, that.

Enjoy your peaceful Monday morning while it lasts.

Another Reason GM May Have Come Around to CISA

/15 Comments/in , /by

Last week, Wired had a story about a hack of GM vehicles that the car company took 5 years to fix. As the story explains, while GM tried to fix the vulnerability right away, their efforts didn’t completely fix the problem until GM quietly sent a fix to its vehicles over their Verizon network earlier this year.

GM did, in fact, make real efforts between 2010 and late 2014 to shield its vehicles from that attack method, and patched the flaws it used in later versions of OnStar. But until the surreptitious over-the-air patch it finished rolling out this year, none of its security measures fully prevented the exploit in vehicles using the vulnerable eighth generation OnStar units.

The article uses this is a lesson in how ill-equipped car companies were in 2010 (notably, right after they had been put through bankruptcy) to fix such things, and how much more attentive they’ve gotten in the interim.

GM tells WIRED that it has since developed the ability to push so-called “over-the-air” updates to its vehicles. The company eventually used that technique to patch the software in its OnStar computers via the same cellular Internet connection the UCSD and UW researchers exploited to hack the Impala. Starting in November of 2014, through the first months of 2015, the company says it silently pushed out a software update over its Verizon network to millions of vehicle with the vulnerable Generation 8 OnStar computer.

Aside from the strangely delayed timing of that patch, even the existence of any cellular update feature comes as a surprise to the UCSD and UW researchers. They had believed that the OnStar computers could be patched only by driving them one-by-one to a dealership, a cumbersome and expensive fix that would have likely required a recall.

GM chief product cybersecurity officer Jeff Massimilla hints to WIRED that performing the cellular update on five-year-old OnStar computers required some sort of clever hack, though he refused to share details. “We provided a software update over the air that allowed us to remediate the vulnerability,” Massimilla writes in an email. “We were able to find a way to deliver over-the-air updates on a system that was not necessarily designed to do so.”

What Wired doesn’t note is that GM was in the thick of recall hell by November 2014 because of its delay, during the same period, in fixing ignition problems. It’s not just the network problem GM wasn’t fixing, it was more traditional problems as well. Whatever hack GM pulled off, starting in November 2014 as a kluge to fix a long-running problem, GM did so while under great pressure for having sat on other (more obviously dangerous) problems with their cars. GM also did so knowing their recognizable Impala would be shown on 60 Minutes exhibiting this problem.

In late 2014, they demonstrated it yet again for a 60 Minutes episode that would air in February of 2015. (For both shows they carefully masking-taped the car’s logos to prevent it from being identified, though car blog Jalopnik nonetheless identified the Impala from the 60 Minutes demo.)

So GM had a lot more urgency to find curious hacks in November 2014 than they did in 2010.

Read more →