NASTF Vehicle Security Committee Close to a Solution

INFORMATION ACCESSNASTF Vehicle Security Committee Close to a Solution DETROIT - Sometimes consumers are just ripe to be used.  Especially in situations where their emotions are already on fire, and they can be easily be hijacked by others seeking mileage by stirring public sentiment or political discourse. Neglected in the midst of stoking emotion and the issue-mongering of the moment are other incidents - wherein theft, fraud or illegitimate access to personal information and property can ensue. Take, for example, vehicle security measures.More than first meets the eye There are still car buyers who don't pay enough attention to their car keys to know the difference between a standard one and an anti-theft key, until they lose it or face a locked-out or immobilized situation. At that point, they become distinctly aware of the differences - especially when they realize the costs involved. With today's anti-theft keys, often with an embedded "smart" chip, replacement costs of keys alone can be in the hundreds of dollars, not to mention the cost to reprogramming an immobilizer and the inconvenience of being stranded in a remote location. Facing a call-out or towing bill, in addition to all the above costs can be an emotional eye-opener.  While there is valid frustration in not being able to gain access and restart one's vehicle, some of the responsibility for the solution also lies with the vehicle owner themselves. In the rush of purchasing a new vehicle, owners many times forget they were provided the key codes at purchase - the small tag attached to the original keys - which all too often are misplaced or forgotten. Then, the need wasn't so important; but faced with a locked out situation, it's a different story. Yet, even in the heat of those moments, if not soon thereafter, consumers need more than simple access. They want to be safe and secure from others gaining personal or vehicle-related information - from an automaker, a locksmith, a technician or even from themselves - that may provide the means to steal their vehicles or worse, compromise their safety and other property. They want quality work done by a certified professional who is registered and accountable to both professional associations and legal authorities. In addition to getting the vehicle restarted, they also want the surety that the service provided doesn't in some way cause an operating problem that they may face just a few miles down the road. The need is simple, but the solution is complex Consumer advocacy groups, such as the Center for Auto Safety, and even some industry insiders and lobbyists suggest that the key codes be made available to professionals such as locksmiths or automotive technicians. AAA has reported that locked vehicles are the second-highest reason customers call for assistance. Even legislators have begun to act, with California and Maryland having introduced legislation that would require the automakers to set up systems by 2008 that would enable vehicle owners and lessees access to their keys' information for locksmiths to make duplicates. The discourse ignores the fact that key code tags were provided already at purchase and that vehicle security can be, by necessity, compromised by this convenience."There is enough buy-in for the SDRM for automakers to move forward 
with a strawman. 
I suggest we do that." 
- Mark Saxonberg, Toyota

Stating the need here is easier said than done, for knowing the desired end begs the question of how to get there. In the case of new legislation, the liability and privacy issues involved, the technology and systems required, the dialogue between divergent stakeholders and even the wording in current legislation can present major hurdles. Certainly, access by the legitimate owner to the needed information is an admirable objective - one shared by most within and outside the industry. To some demanding a solution, it is just as easy as that. But the means to that end is not as simple as just saying it. It involves more complex issues: personal privacy, vehicle security, law enforcement concerns, geopolitical differences and others come in to play.

Stating the need is easy, but finding a solution has a vast number of hurdles to cross along the way. In short, wishing just doesn't make it so. The road from simple to complex is not fueled by rhetoric; rather, it takes sweat, dialogue, tolerance and time.

What is the right way? The National Automobile Service Task Force's Vehicle Security Committee (VSC) has held a series of meetings - most recently on April 3 - open to those wishing to work on a solution that addresses the concerns surrounding access to vehicle security information.  These issues are wide-ranging in their scope. Only two automakers - GM and Ford - are headquartered in the United States. The rest are mainly in Europe, Japan and South Korea. This adds a layer to the participation and approval process and, therefore, time. Consumers with an entry problem want their immediate problem fixed, but not at the expense of compromising their personal security later. Liability concerns for all stakeholders need to be addressed. In addition, while law enforcement agencies and related legislation recognizes the word "locksmith," the language does not make any reference to, nor recognize "automotive technician" as a component to their solutions. This, like any other legislative matter, takes education to effect changes. Central to that education is developing a model that is a workable solution. During the VSC meetings, representatives from the industry's domestic and foreign-based automakers, automotive technicians, locksmiths, law enforcement, insurance industry, tool makers and consumer advocate groups have worked diligently to develop and refine a Secure Data Release Model (SDRM) that addresses these concerns. "If it isn't reasonably affordable and accessible, it 
won't get used." 
- Dave Lanspeary, Dave's Auto Repair

In accomplishing this, the VSC has incorporated safeguards within the SDRM's architecture to protect both consumers' and participating organizations' private information and to provide security preventing the SDRM from being compromised or accessed by illegitimate and/or unauthorized persons. Specific details of the SDRM's architecture to achieve this will remain confidential at this time. 

The VSC is well aware that some will not embrace the model right away - be it automotive technicians, locksmiths, automakers or others. Even within the confines of the meetings, individual concerns and differences regarding buy-in exist. That's the nature of any group, and the VSC is the better for encouraging and welcoming all views. It is what viable consensus decisions are all about. 

Some participants have already agreed entirely; some are agreeable in principal, but are waiting to see the SDRM model in action. Some may never buy in, even when a workable solution is available. At the April 3 meeting, VSC Co-Chair Mark Saxonberg put it like this: While most have bought-in to the SDRM, there are still a few OEMs that have not yet embraced the concept. "There is enough buy-in for the SDRM for automakers to move forward with a strawman [project]. I suggest we do that," he added. Those present agreed.

Real traction takes time During April and early May, the Associated Locksmiths of America (ALOA) and the Automotive Service Association (ASA) will develop the framework for the implementation of a SDRM strawman. Both will co-host a registry of legitimate users from the locksmith and automotive technican sectors respectively. ALOA also will determine, with input from the FBI and National Insurance Crime Bureau, the contractual arrangements to define the criteria for acceptance into the registry, to ensure that only verified, registered users get access to needed vehicle security information. We Reap What We Sow Like other aspects of life, vehicle technology has become more complex in recent years, accompanied with increased costs for repair or service. It's the price paid for improved performance, environmental friendliness, the growing demand for more infotainment and other consumer- or regulator-driven demands. Just as advances with computers, healthcare and other areas that touch our lives, these features have experienced increases in product costs, but so too, their servicing and security costs. It's the price one pays in today's world.

Interestingly enough though, in the presence of many advances in recent years, those in the automotive industry can be their own worst enemy. Seeking to be viewed by the public as a professional - with the knowledge, skills and abilities worthy of higher rates aligned to the high level of professional service provided - some still embrace being the low-cost provider, effectively dragging down prices, and with them, eroding the very public image sought by most.

So too, with ever increasing vehicle technology, which includes the security systems. Here is an opportunity to leverage the complexity of vehicle security systems to gain the training needed, reinforce that the advances are in the consumer's interest and merit a professional's expertise. It remains to be seen if the industry will embrace the costs associated with achieving the next level in customer service.

Although ASA and ALOA will share ownership of the SDRM, access will be open industry-wide to repair professionals who meet and accept the criteria established for becoming and remaining registered. Other issues, such as affordability and ensuring that access is available to verified registrants on a 24/7 basis also are being addressed. 

"I think it is very important to understand that ASA and ALOA have ponied up to finance the SDRM, as well as the fact that the registry will be open to all professionals that qualify and will not be limited to members of these two groups," said VSC Co-Chair Dave Lanspeary. "Further, it needs to be understood that affordability and ease of use are determining factors in the design and implementation of the SDRM. If it isn't reasonably affordable and accessible, it won't get used."

The registration criteria will encompass requirements for recordkeeping, bonding, recertification, liability and a means of positive identification for both the service person and consumer. In addition, an audit trail for every access attempt into the SDRM will be integrated into the model's architecture. These details will be discussed, refined and potentially finalized at a follow-up VSC meeting in May.

Once completed, the following month will be used to test the SDRM strawman in simulated and real-world applications to ensure the model works as planned. In effect, within 60 days or so, the VSC anticipates having a proven solution that provides vehicle access information without compromising any of the participants or the vehicle owner. The details of the strawman experience will be discussed at a VSC meeting in July at the ALOA annual conference in Las Vegas.

For the public and the automotive and locksmith industries, the day of a certified and registered automotive locksmith may soon be at hand. Whether it is seen as just another cost to complain about or as a professional opportunity will be in the beholder's eye. Either way, the industry will move forward.

(Sources: NASTF Vehicle Security Committee, California Senate, Center for Auto Safety)