While in theory it all sounds great, the reality is far different; and given that we deal with realities of security driving around the world on a daily basis, I have a differing opinion. One which, as always, is based solely on my experience and thus, those with differing experience may indeed have opinions that differ.
The primary reality is that the security vulnerabilities and implications of the advanced systems in this and other cars are almost immeasurable, and are just now being explored with any vigor. As an example, it was not too long ago – some time over the summer IIRC – that a speaker at a tech conference in India remotely hacked his Tesla which was parked at his house in California, and using a simple brute force program, unlocked the doors and started the car. By inference, the inverse could be accomplished (i.e. shutting the car off).
The secondary reality is that systems such as lane guidance and collision avoidance make cars so equipped extraordinarily susceptible to an attack whereby the car can be brought to a stop quite easily just by strategically placing a vehicle (or, given an undivided highway, two at the most) so that the system, doing what it was designed to do, recognizes a possible collision and brings the car to a halt. In such a scenario, absent a driver who can:
a) recognize the threat,
b) override the system,
c) effectively operate the vehicle at a high level of its performance potential (while under stress),
it is most likely that the principal will rather quickly find him or herself at the mercy of the adversary.
The tertiary reality is based in part on the outcomes of a series of training exercises we recently designed and delivered to a highly skilled, experienced team on the West Coast. By virtue of the principals insistence, this team relies heavily on vehicle tracking as the first layer of protection. The overarching lesson learned clearly was that a moderately determined adversary, given a minimal amount of time (think hours, not days) can readily develop and execute plans to effectively exploit the vulnerabilities inherent in protection which either chooses, or is forced, to rely on vehicle tracking.
As pointed to in our presentation at the 2010 EPIC Conference, and in keeping with the old adage “everyone has a plan until they get punched in the face”, over the years there have been any number of strategies, tactics and/or technologies that, at least in theory, held promise of changing the very nature of protection operations. The reality being that, when challenged by an adversary who was afforded a modicum of time within which to identify the gaps in protection and exploit the vulnerabilities those gaps created, these “game changers” typically fell short – in some cases, far short – of their theoretical potential. A point which was driven home (pun intended) for all who participated in those recent exercises – from the students on the “blue” side to the role players on the “red” side.
Given our ongoing research into this very topic, it appears that technologically advanced vehicles such as the Tesla S P85D and the Google autonomous car have a tremendous potential to fit this exact paradigm.
Vehicle technology has indeed advanced in leaps and bounds over the last decade and I have no doubt that, at some point in the future, there will be driverless cars available in the marketplace. However, there are a number of significant issues that will need to be addressed before they will mass produced and, therefore, available at a price that makes them more than a novelty of the truly affluent.
First among them is the fact that there are currently only three states whose laws allow for driverless cars to be operated on public roads – Florida, Michigan and California, and in each of those states that operation is strictly limited to testing.
Secondly, the question of crash liability must be answered. Particularly given the fact that even the most optimistic proponents of autonomous vehicles admit it will be not years, but decades before the number of such vehicles in operation reaches the point that they have a discernible impact on accident rates. Should it be determined that the liability in crashes involving autonomous vehicles lies with the manufacturers of the driverless vehicles as opposed to the owner/occupant, there is a very real possibility of the entire concept being relegated to gathering dust in the “great idea, well ahead of its time” corner of the major manufacturers engineering centers.
Thirdly, and relating directly to both the first and second, building experimental vehicles is one thing, mass producing reliable, technologically advanced vehicles is a whole different thing altogether.
Ultimately, while the impact of autonomous vehicle technology on the security industry has yet to be defined – and likely won’t be for quite some time – the one thing that can be said with a high degree of certainty, based on both history and human nature, is that right now there is someone out there that is focused on identifying and exploiting the vulnerabilities of those vehicles for nefarious purposes. Thus, the manner in which secure transportation is provided may evolve, while the need for it will not.
Leave a Reply