China stops networked vehicle data going offshore under new infosec rules

China has drafted new rules required of its autonomous and networked vehicle builders. Data security is front and centre in the rules, with manufacturers required to store data generated by cars – and describing their drivers – within China. Data is allowed to go offshore, but only after government scrutiny. Manufacturers are …

[Pascal Monett]

Chief of network security

That is one job I would be very wary of taking in China. Over here, if a car gets hacked, it's "Oh well, we'll try better next time".

Over there, it's "Here's the invoice for the bullet".

Aside from that, and aside from sending data back to China, I rather like those rules. Ensuring vehicle data security is something I've been waiting for my European car makers to declare themselves on, but all they seem to want to do is ensure that every car's entertainment system is firmly embedded in the CAN bus.

Booo.

[ThatOne]

Re: Chief of network security

> aside from sending data back to China

I read it more like "our data isn't allowed to leave China", something akin to what Europe demands.

Anyway, whatever it might be, never forget it doesn't mean much. It's not like unscrupulous people only live abroad, and while we love to scare little children voters with the threat of those nasty evil Soviets Chinese, I'm pretty sure local unscrupulous businesscritters won't be any kinder to my privacy than those "evil" Chinese ones...

My point is, I don't buy into the old "Soviets Chinese = evil, thus we = good" rhetoric. Everybody is similarly crappy, but at least in this case somebody is emitting the right sound bites, while over here nobody would dare question our big corporations. Election funds don't grow on trees, do they.

I especially like the "chief of network security" part, which means somebody is accountable, and clients won't get the usual "We take your privacy/security/life very seriously, now leave us alone" line.

[Alan Brown]

Re: Chief of network security

The trap is falling into the "good guys" and "bad guys" paradigm. That only applies in movies

The reality is that the "bad guys" are on BOTH sides and everyone believes they're the "good guys"

It's worth understanding the motivations behind "noble cause" corruption ("the ends justify the means") plus why this is far more dangerous and corrosive than most other kinds of corrupt behaviour

It's also worth noting that "noble cause" corruption is the most commonly encountered kind in law enforcement and the people who are corrupt usually don't believe that they are (eg: 'Gene Hunt' policing), which is why it spreads more easily and is harder to root out

[gandalfcn]

Re: Chief of network security

"everyone believes they're the "good guys"" I suggest only the rabid, gullible nationalistic types believe that. As evidenced in these comment sections.

[gandalfcn]

Re: Chief of network security

"Over there, it's "Here's the invoice for the bullet"." That comment is so 1970s

[Anonymous Coward]

I long for the days of yore...

Back when we had to manually crank-start our automobiles, manually adjusting the choke and fuel rate and all the other bits to make the engine run, and there wasn't so much as an electronic butterfly to render the vehicle dead. Those were the days when automobiles were real automobiles, men were real men, and little green aliens were REAL little green aliens...

[Anonymous Coward]

Re: I long for the days of yore...

Back when you paid your money and owned a product for life, and loved and maintained it for life, and no-one could remotely fiddle with, modify, update, downgrade, monitor, slurp, brick, upsell, downsell, or generally feck around with it.

[vtcodger]

Re: I long for the days of yore...

I long for ... I don't.

I have clear memories of a lot of reasonably adept American males trying to start engines on a collection of those computerless cars that had been sitting at a campground above 8000ft for a few days. The procedure was to try to start normally Then when that failed -- which it almost always did -- open the hood, remove the aircleaner, wedge the automatic choke open with a screwdriver (In the 1960s, you didn't go out into the wilds without a few basic tools). Then you trickled a small amount of gasoline into the carburator from the gallon can of gasoline you had stashed in your trunk next to your tent, sleeping bag and beer. Then you crossed your fingers, hit the starter and, if the battery held out, the engine would eventually catch and, if you were lucky, continue to run. If it didn't, you tried again until it did start or the battery died. A similar procedure sometimes worked in sub-freezing weather.

Today is better. It has taken a few decades, but the modern electronics have things right, and cars usually just start in any sane environmental conditions.

But you're right. Tomorrow may be worse if we don't somehow restrain corporate bad behavior.

[ThatOne]

Re: I long for the days of yore...

> sitting at a campground above 8000ft for a few days

I think you chose the wrong example here. Electronics are definitely less robust and likely to suffer more under extreme/unusual weather conditions.

Also, if your old mechanical car didn't start on a remote mountain, you could always try to fix it with your tools. If your electronics-filled car breaks down in the same locale, you can as well abandon it there. There is no possibility you might fix it (or even know what the problem might be), and towing it would cost you a fortune...

Yes, old cars were fiddly and required a lot of patience and some skill, but if you had those (and some tools!) you were rarely really stranded.

[ThatOne]

Re: I long for the days of yore...

Wow, 6 downvotes and not one cared to actually put in words what an imbecile braindead cretin I must be. What a polite mob...

[Alan Brown]

Re: I long for the days of yore...

Mechanically controlled cars were setup for "average" conditions and the mechanical bits were notorious for rapidily wearing (eg, vacuum advances and points blocks, altering timing over a surprisingly short period)

Electronically controlled cars dynamically adjust and most of the parts that wear quickly are eliminated, resulting in "as new" performance lasting considerably longer

Chokes existed _because_ mechanical (and carberetted) systems were limited in their range of operations

The single most common cause of vehicle problems is (and always has been) lack of maintenance causing mechanical issues in wear components. People drive their cars "until the wheels fall off" and don't bother with oil changes, let alone anything else.

The single most common cause of electrical problems in modern vehicles is tampering with the cable looms (including plugging/unplugging connectors without due care and attention) that wrecks their waterproofing. the next most common is rotten connectors (something that most manufacturers addressed long ago) and following that, poor vibration resistance in the modules. Actual honest-to-god electronics faults are rare and the reduction of 70-80% in vehicle mechanics/technicians over the last 40 years despite vehicle numbers more than doubling is testament to the reliability/durability of modern machinery

I don't buy "good old reliable machinery" - 90% of everything is crap and the stuff you see NOW is the stuff that survived (this also applies to victorian buildings - all the crap ones are long gone)

[Anonymous Coward]

Re: I long for the days of yore...

You seem to have demonstrated that you and your friends had a good idea how a car worked, what could cause it to malfunction, and how to overcome those malfunctions in a field, 8000 feet up a mountain with a few basic tools.

Now try that when your modern car won't start, or goes into limp mode going up a mountain pass - has it done this before, or has the manufacturer rolled out a software update that morning with some undiscovered bug (that you have just discovered!). We have seen recent examples of iffy "on the fly" software updates manage to brick perfectly functional systems (aka print drivers), or destroy battery life for no reason. Now extrapolate that to something as complex and varied as a car and its usage scenarios.

No thank you. If my car works fine, leave it alone.

[Gordon 10]

Re: I long for the days of yore...

Leaving aside the temp and altitude - the main point was that failure to start was historically ridiculously common. Noone sane wants to go back to the days of a choke.

Failure of electronic starting cars has banished this to virtually non-existent in comparison.

[gandalfcn]

Re: I long for the days of yore...

They must have been seriously dumb as a short roll down a slope would have worked.

[vincent himpe]

Re: I long for the days of yore...

Gell your computer/phone/tv and get off the internet. they all fall in the category you do not want

[ThatOne]

Re: I long for the days of yore...

> Gell your computer/phone/tv and get off the internet. they all fall in the category you do not want

Reductio ad absurdum much?...

For your information, electronic devices are supposed to be electronic (duh), besides if my "computer/phone/TV" craps out on that mountaintop I and my family aren't necessarily in great danger. At worst we would be annoyed.

That been said, the KISS principle also stands for electronic devices. I have several times in the past repaired a broken down computer with a hardware problem. I'm no electronics engineer but, like with a car, I have enough basic know-how to be able to spot what the problem might be. Obviously glued-together devices and proprietary spare parts make this a lot harder nowadays, so there is kind of a parallel to cars.

[Andre Carneiro]

Re: I long for the days of yore...

Had my Tesla Model 3 serviced a few days ago: I drove into the Service Centre and went into the waiting area. No human interaction required.

They remotely unlocked and started my car and did everything they wanted and then returned it to me.

10/10 for convenience but bugger me, it made me feel incredibly uncomfortable. It definitely gave me the feeling that I don’t actually own my car anymore, and whilst I sort of already knew they can do this I am surprised by how uncomfortable it has actually made me to see it in action.

Yeah, I’m not sure I’m liking the direction of travel very much…. AaaS is not something I’d like to embrace.

[NoneSuch]

Re: I long for the days of yore...

Yes and those days are gone, probably forever. Won't be long until you need three forms of ID and a retinal scan before it will let you turn the key.

Don't worry, the government says it's for your protection and they'll keep an eye on you just in case.

[DS999]

You had a crank?

Luxury! We used to have to remove the crankcase and pull on the timing chain with our bare hands!

[Wolfclaw]

Good to see China embracing security, so long as we leave ours open for them to hack.

[gandalfcn]

We have to leave ours open so our own govs. can hack us and each other.

[Anonymous Coward]

I have a friend who has an Elon Musk fetish, and if he didn't have other redeeming qualities I would have unfriended him in real life, but I digress.

One of the things he is an absolute fan of, to the point that "all cars should have it", is over-the-air updates.

My view is that if a car has that I would not want it - ever. I am WAY too aware of the fact that a number of cars can already be hacked remotely, and deliberately leaving the gates open so that someone from his mother's basement wearing nothing but underpants can disable my brakes is not something I will ever feel comfortable with, and not just for the fashion sense on display.

No, no, no. Give me the update on a physical USB stick I can jack in, OK, I'm fine with that. Making my car yet another IoT device with the matching degree of security, no. That can literally kill you.

[Nifty]

"all cars should have it... over-the-air updates"

What if my car runs out of RAM halfway through the journey? Will the AA come out with a bigger SD

card?

[Moonrunner]

Good move

Nice to see the Chinese government standing up to big tech. I wish ours had 1% of their backbone. With that being said, I don't like the idea of cloud-connected self-driving cars. It typically means that either a corporation and or a government (or in our case all of the 5 eyes) know(s) where you are and where you're going, at all times. They can even remotely shut down your vehicle, accelerate, engage steering, etc etc etc In a completely dystopian world, they can literally lock the doors and move the vehicle to where they want you to be. As our society has been turning against basic human rights, individual property and personal agency, we won't have to wait too long until they start with child-molesters, then move onto terrorists, then people engaging in 'hate speech', and then, how about 'microaggressions'?

That's why I prefer for my vehicle to be under my control. Stick shift, no network connectivity. I don't care if I put in as much money into reconditioning a stick shift car as I would into buying the latest shiny new phallus, at least I know my personal transportation is under my control.

[Mark Exclamation]

It's almost impossible to buy something that is not made in China these days. However, cars are not one of them as there are plenty of better manufacturers. Chinese-made cars are the absolute worst cars on the market, and anyone outside of China considering buying one of them, well, just don't. And since they bought Volvo cars and MG, stay away from them, too. We're all giving China too much of our money, so they can build up their armed forces to use against us. At least with cars (automobiles to some) we have a choice, and it's not that difficult since they're all crap anyway.

[MachDiamond]

"Chinese-made cars are the absolute worst cars on the market"

The dirty secret is a whole bunch of your xxxxx-made car is using parts from China/Asia.

After WWII, Japan was known for building junk. Now, they're known for well built products and the garbage is coming from China/India. What should scare people is how fast the Chinese are learning. A big reason they required foreign companies to partner with domestic manufacturers is so the local mob will have access to more modern designs and methods. I recall seeing some early Chinese EV's that were downright scary with big gaps and peeling back some carpet would let you see through to the roadway. That doesn't happen so much anymore.

[gandalfcn]

"Chinese-made cars are the absolute worst cars on the market" ROFL.

"so they can build up their armed forces to use against us. At least with cars (automobiles to some) we have a choice, and it's not that difficult " I suggest you look into the use of armed forces by the USA and the UK and then compare that to that of the PRC. If you had bothered to do that you wouldn't have posted what you did.

"cars ... since they're all crap anyway." Which is why there is no major British car or motorbike firm isn't it. They were nearly all crap. I remember the know-it-alls in the 60s and 70s bleating about crap Japanese cars and bikes, which they weren't, were they. They worked and were cheaper. Just like the PRC today.

[Mark Exclamation]

Yep, you took the bait. And your response was pathetically predictable. Why don't you just leave the society that gave you so much but that you obviously loathe, and go and live in China, which you so obviously love? You are so bitter and twisted.

[ROC]

All Data to The Party

There is a big difference between having a lot of corporate scoundrels accountable to anyone who can bring a lawsuit, as well as a variety of government agencies/jurisdictions, and a scoundrel-in-chief accountable only to The Party.

[gandalfcn]

Re: All Data to The Party

Indeed, I'd prefer the party to the megalomaniacs like Musk and Zuck.

[David Pearce]

We all should follow their lead

A sensible move. Allowing international car data transfer and remote updates is allowing meta-data leaks and risks a software update that installs drive on the right settings in a UK car by accident or just turning it off or crashing you into the nearest pillar for political reasons. For safety critical software, it should be simple, only trust people who risk being personally sent to jail.