The US government’s auto safety watchdog dealt a potentially fatal blow on Tuesday to Massachusetts’ controversial automotive right-to-repair law.
In a letter to 22 carmakers, the National Highway Traffic Safety Administration said that complying with the Massachusetts Data Access Law would violate federal car safety legislation, because the state law could make it easier for cybercriminals to interfere with sensitive data stored in cars or even take control of vehicles remotely.
The state law, enacted after a 2020 voter referendum, has been tied up in federal court challenges by automakers. The Massachusetts Attorney General’s office has refrained from enforcing the law as litigation has dragged on. Frustrated by the slow pace of the lawsuit, Attorney General Andrea Joy Campbell announced that enforcement of the law would commence on June 1.
Advertisement
But the NHTSA letter, submitted to the court by the US Justice Department, says that only the federal government, not the states, can enact laws that affect vehicle safety. This would seem to increase the likelihood that US District Court Judge Douglas Woodlock will strike down the statute.
The Massachusetts law requires automakers who sell cars in Massachusetts to provide consumers and independent repair shops with wireless access to the car’s “telematics” — digital information needed to diagnose the vehicle’s performance. With access to the telematics, independent mechanics can repair these vehicles as readily as authorized dealers.
Critics of the law say that it would force carmakers to make vehicles less secure, in order to give repair shops easier access to critical vehicle systems, including steering, acceleration, and braking. They also say that the law would require that access to these systems must be provided by an independent company — not controlled by the automakers and capable of providing data from all makes and models of cars. In effect, a single organization would have access to automotive data from millions of vehicles.
Advertisement
Even before the referendum, the NHTSA sent a letter to Massachusetts lawmakers warning about the security risks such a system would pose. “The ballot initiative requires vehicle manufacturers to redesign their vehicles in a manner that necessarily introduces cybersecurity risks,” the letter said, “and to do so in a timeframe that makes design, proof, and implementation of any meaningful countermeasure effectively impossible.”
Two and a half years later, the NHTSA’s letter to automakers goes even further. It claims that because of inadequate cybersecurity safeguards in the Massachusetts law, companies that comply with the law will be putting unsafe vehicles on the road, in violation of the National Highway Traffic Safety Act.
“A malicious actor here or abroad could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently,” the letter said. “Vehicle crashes, injuries, or deaths are foreseeable outcomes of such a situation.”
The letter also says that in matters of auto safety, the National Highway Traffic Safety Act overrules the laws of any state. In effect, it calls for car companies to ignore the Massachusetts law.
No carmaker is currently providing telematic data as required by the law; two carmakers, Kia and Subaru, have stopped activating telematic services on their cars sold in Massachusetts to avoid violating the law. But as of Wednesday, there were no reports that the state has taken action against carmakers.
Advertisement
Bryan Reimer, a research scientist in the Center for Transportation and Logistics at the Massachusetts Institute of Technology, said the NHTSA letter vindicated his opposition to the Massachusetts law. Reimer argued in 2020 that the legislation was poorly drafted. “The law was written and put on the ballot by people who didn’t even know what they were asking for,” he said.
Robert O’Koniewski, executive vice president of the Massachusetts State Automobile Dealers Association, said the letter was good news for car manufacturers. He said there is no need for such legislation in the first place, because car companies already make available to independent repair shops all the data they need to fix any car.
“This is totally unnecessary,” O’Koniewski said. “This has nothing to do with diagnosing and repairing motor vehicles.” Instead, he said independent shops want telematic data to help them market their services to consumers.
With access to telematics, an independent shop could get early warning that a car needs new tires or an oil change, then try to sell these services to consumers. Without such access, only the manufacturers and car dealerships would be able to do this, putting independent shops at a major disadvantage.
But news of the letter infuriated Tommy Hickey, director of the Right to Repair Coalition, which led the expensive and protracted fight to get the Massachusetts law enacted.
“On behalf of two million voters and thousands of independent auto repair shops across Massachusetts, we are outraged by the unsolicited, unwarranted, and counter productive letter from NHTSA,” Hickey wrote in an e-mailed statement. “This is yet another delay tactic the manufacturers are using to thwart the will of their customers, Massachusetts voters who voted 75-25 in favor of their right to get their car repaired where they choose.”
Advertisement
Massachusetts First Assistant Attorney General Pat Moore was also sharply critical of the letter.
“The National Highway Traffic Safety Administration declined the opportunity to express, and prove, its concerns at trial, choosing to weigh in only by letter two years later,” Moore said in an e-mail. “We look forward to NHTSA’s explanation of precisely what has changed, and we will then evaluate our next steps.”
Hiawatha Bray can be reached at hiawatha.bray@globe.com. Follow him on Twitter @GlobeTechLab.