Trends+Analysis News

Cybersecurity Worries Threaten to Lock Out Repairers

Order Reprints

The overall goal is to protect the consumer, Aaron Lowe of the Auto Care Association (ACA) says. The goal isn’t the problem, though; it’s the means of reaching it that could pose an issue.

Last fall, two separate regulatory moves were proposed by divisions of the U.S. government that have the potential to shape the ability of independent automotive repair professionals to properly work on vehicles.

As reported by Ratchet+Wrench in late October, the U.S. Copyright Office issued a ruling that would allow vehicle owners to perform vehicle diagnosis, repair and modification on the electronic control units (ECUs) of their own vehicles without fear of prosecution under the Digital Millennium Copyright Act (DMCA).

There was no such exemption granted for third-parties; i.e., independent repair businesses.

That same week, Lowe and the ACA sent a letter to a U.S. House of Representatives subcommittee to warn against provisions included in a new draft bill aimed at improving the National Highway Traffic Safety Administration’s ability to regulate vehicle manufacturers and keep consumers safe. Language in that bill, Lowe argues, is too vague and could lead to car companies having “full control over who has access to key vehicle systems many of which are needed for repair purposes.”

“Such action could have severe anti-competitive impacts on our industry and car owners who depend on independent repair shops for about 80 percent of post-warranty repairs.” —Aaron Lowe, senior VP of regulatory and government affairs, Auto Care Association

And Lowe isn’t alone in his assessment. Many across the industry are concerned, some wondering how these decisions butt up against the agreements laid out in the Memorandum of Understanding signed in 2013 that essentially put an end to the Right to Repair debate, giving indy shops access to the information, tools and software of vehicle manufacturers.

It’s all in the name of consumer safety, Lowe explains. Vehicle technology is advancing at a consistently rapid pace, and regulatory efforts have struggled to match. But, some fear, the automotive aftermarket is being ignored in this effort to catch up.


Enacted in 1998, the DMCA prohibits the circumvention of measures put in place by a copyright owner to protect copyright works.

The ECUs in vehicles are copyrighted by the manufacturers—each with their own sophisticated system of inter-vehicle communication. This is why truly universal scan tools do not exist today, and was one of the major sticking points among shop operators and industry representatives during the Right to Repair battle.

Included in the DMCA, though, is a provision that allows the Copyright Office to grant exemptions from anticircumvention language. That’s how the exemption for vehicle repair, diagnosis or modification (for the vehicle owner) was granted.

Many manufacturers and related associations pushed for it, including the Specialty Equipment Market Association (SEMA). SEMA is made up of roughly 6,800 automotive manufacturers, distributors, installers and retailers, and the organization provided comments to the Copyright Office during its decisionmaking process. When the decision was announced in October, SEMA CEO and president Chris Kersting said that “SEMA has always maintained that the right to access vehicle systems to utilize, maintain and upgrade vehicles is legal as fair use under copyright law, as are activities undertaken to achieve interoperability with aftermarket products.”

Aftermarket associations supported the provision, but came up short in offering full praise.

The Automotive Service Association (ASA) took issue with the provision not allowing repairers to modify or work on “computer programs primarily designed for the control of telematics or entertainment systems … when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function.”

The ASA released a statement saying, in part, “Clearly, car owners should have the ability to obtain the services of an independent shop for working on their car.”


Similar to the DMCA provision, the addition to the “Discussion Draft to Provide Greater Transparency, Accountability and Safety Authority to the [NHTSA]” brought on by the House Subcommittee on Commerce, Manufacturing and Trade also excludes repair professionals from accessing the ECU or “critical system” of a vehicle.

“It should be noted that the ECU is the brain of a vehicle and therefore for a service facility to repair a vehicle system, they will need access to that ECU for both the diagnosis and repair,” Lowe wrote in his letter to Congress members. “The language in the draft is extremely vague and could be interpreted to provide the car company with full control over who has access to key vehicles systems many of which are needed for repair purposes.”

The hope, Lowe says, is that these regulatory efforts will be re-evaluated and new provisions added to incorporate the automotive aftermarket. As vehicle technology continues to advance, the ramifications will only become greater and greater.

“Such action could have severe anti-competitive impacts on our industry and car owners who depend on independent repair shops for about 80 percent of post-warranty repairs,” he says.

Recommended Products

2015 Ratchet+Wrench Shop Performance Survey: Complete Report

2016 Ratchet+Wrench Shop Technology Survey: Complete Report

2016 Ratchet+Wrench Shop Performance Survey: Complete Report

Related Articles

The Challenges Autonomous Cars Pose to Future of Cybersecurity

The Auto Repair Shop's Role in Connected Car Cybersecurity

Vehicle Recall Records Offer Opportunity for Aftermarket

You must login or register in order to post a comment.