A mechanic working with a car diagnostic system. Photo: Andrew Matthews/PA Images via Getty Images

Under current regulations, vehicles must allow connection to their diagnostic systems for analysis and repair. This access point is crucial for ensuring that both conventional and future self-driving cars are safe on the road, yet it is vulnerable to hacking by physical and wireless intrusions.

Why it matters: Autonomous vehicles are highly dependent on networked component controllers that enable different parts of the car to communicate. This means that a security breach could open up even more operational controls in an AV, including safety-critical functions. Despite these risks, there are still no rules in place to mitigate this significant security vulnerability.

Details: On-board diagnostic (OBD) technology connects automotive electronic control units (ECUs) — which manage throttle, steering, lights, brakes and more — to the Controller Area Network (CAN) data bus. It also allows service technicians to connect diagnostic equipment to assess the car’s pollution controls, sensors, safety-critical ECUs and other components.

What’s new: In hands-free driver assistance systems and other AV technology, virtually all the components controlled by the CAN bus are needed to assure operational safety. Tesla uses the CAN bus to implement its autopilot system and Waymo uses it in its AV control architecture.

Yes, but: These components are ripe targets for hacking.

  • A $10 Arduino computer that’s the size of a postage stamp could be surreptitiously installed in moments, creating an unpatchable vulnerability.
  • Entertainment systems and other wireless-enabled components, like those Tesla uses for over-the-air software updates, can also be hacked.
  • If compromised, the CAN bus could transmit commands from a malicious party that would take control of the car’s speed, steering or braking.

What to watch: While AVs may be new, the idea of addressing the broad scope of cyber vulnerabilities is not. The aviation sector has taken on these risks through both government and industry standards, and has employed countermeasures that could serve as models for AVs:

  • Network isolation
  • Multi-factor authentication of software updates or network traffic
  • Strong encryption
  • Alternative secure internal network architectures

The bottom line: The CAN bus is likely to be integral to AV technology for multiple generations, so it will be essential to devise rules to cyber-secure these inherently vulnerable access points while preserving their original purpose.

Jason Levine is executive director of the Center for Auto Safety.

Go deeper

Updated 10 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 7 p.m. ET: 12,859,834 — Total deaths: 567,123 — Total recoveries — 7,062,085Map.
  2. U.S.: Total confirmed cases as of 7 p.m. ET: 3,297,501— Total deaths: 135,155 — Total recoveries: 1,006,326 — Total tested: 40,282,176Map.
  3. States: Florida smashes single-day record for new coronavirus cases with over 15,000 — NYC reports zero coronavirus deaths for first time since pandemic hit.
  4. Public health: Ex-FDA chief projects "apex" of South's coronavirus curve in 2-3 weeks — Coronavirus testing czar: Lockdowns in hotspots "should be on the table"
  5. Education: Betsy DeVos says schools that don't reopen shouldn't get federal funds — Pelosi accuses Trump of "messing with the health of our children."

Scoop: How the White House is trying to trap leakers

Illustration: Sarah Grillo/Axios

President Trump's chief of staff, Mark Meadows, has told several White House staffers he's fed specific nuggets of information to suspected leakers to see if they pass them on to reporters — a trap that would confirm his suspicions. "Meadows told me he was doing that," said one former White House official. "I don't know if it ever worked."

Why it matters: This hunt for leakers has put some White House staffers on edge, with multiple officials telling Axios that Meadows has been unusually vocal about his tactics. So far, he's caught only one person, for a minor leak.

11 GOP congressional nominees support QAnon conspiracy

Lauren Boebert posing in her restaurant in Rifle, Colorado, on April 24. Photo: Emily Kask/AFP

At least 11 Republican congressional nominees have publicly supported or defended the QAnon conspiracy theory movement or some of its tenets — and more aligned with the movement may still find a way onto ballots this year.

Why it matters: Their progress shows how a fringe online forum built on unsubstantiated claims and flagged as a threat by the FBI is seeking a foothold in the U.S. political mainstream.