State and federal regulators appear to have made a breakthrough to move forward with a voter-approved vehicle repair data law after legal battles and safety concerns stalled its implementation.
A bit more than two months after the National Highway Traffic Safety Administration warned that a 2020 Massachusetts “right to repair” update might clash with federal law, the same agency softened its position and said the measure “may successfully be implemented” with some tweaks.
The potential compromise centers on wireless access to a vehicle’s systems under the law, which seeks to provide owners and independent repair shops with telematic repair data common in many newer cars and trucks.
Manufacturers could comply with the law by providing wireless access “from within close physical distance to the vehicle,” but not across a greater distance, using Bluetooth or another system, Attorney General Andrea Campbell’s office said.
Federal regulators said Tuesday that practice would comply with the state law without triggering the same cybersecurity concerns that NHTSA previously warned could run afoul of existing federal safety requirements.
“In NHTSA’s view, a solution like this one, if implemented with appropriate care, would significantly reduce the cybersecurity risks – and therefore the safety risks – associated with remote access,” NHTSA Assistant Chief Counsel for Litigation and Enforcement Kerry Kolodziej wrote in a letter to Campbell’s office. “Limiting the geographical range of access would significantly reduce the risk that malicious actors could exploit vulnerabilities at scale to access multiple vehicles, including, importantly, when vehicles are driven on a roadway.”
“Such a short-range wireless compliance approach, implemented appropriately, therefore would not be preempted [by federal law],” Kolodziej added.
Campbell’s office replied in its own letter to NHTSA that, based on its interpretation of the law, manufacturers could comply by allowing Bluetooth or other “short-range wireless protocol” access to telematic data and systems.
“In 2020, Massachusetts voters overwhelmingly approved the Right to Repair law to ensure that car owners could choose where their cars would be repaired – and that owners and repair shops would have access to the data required to make those repairs,” Campbell spokesperson Molly McGlynn said in a statement. “We appreciate NHTSA’s clarification today that our state law is not preempted by federal law. Now that the federal government has clearly spoken, and the federal court has rejected the auto manufacturers’ attempt to block the law from taking full effect, it is time for all manufacturers who sell cars in Massachusetts to implement the law’s requirements.”
It wasn’t immediately clear Tuesday afternoon how regulators would proceed or when manufacturers would need to begin complying with the 2020 law.
U.S. District Court Judge Douglas Woodlock is still weighing the lawsuit manufacturers filed.
And while Campbell’s office called for manufacturers to follow the requirements, the correspondence filed in court signaled that more time might be needed.
“Based on our discussions to-date, it appears that the Massachusetts Attorney General and NHTSA also share a common understanding that implementing this compliance option with the secure ‘open access platform,’ as required in the Law, is not immediately available, and that vehicle manufacturers may require a reasonable period of time to securely develop, test, and implement this technology,” Kolodziej wrote.
Ben Halle, director of public affairs for the U.S. Department of Transportation, praised NHTSA and Campbell’s office as identifying a “path forward.”
“USDOT strongly supports the right to repair and is eager to promote consumers’ ability to choose independent or DIY repairs without compromising safety to themselves or others on our nation’s roads,” Halle wrote in a statement provided by Campbell’s office. “The clarifications contained in the exchange of letters between state and federal partners ensure a path forward to promote competition and give consumers more options, while mitigating a dangerous risk to safety.”
The movement toward compromise prompted an outpouring of praise from elected officials and from supporters of the original ballot question.
Tommy Hickey, executive director of the Massachusetts Right to Repair coalition that led the 2020 campaign, said his group is “pleased to see that NHTSA has reevaluated its position and concluded there are multiple ways to implement the right to repair law that don’t conflict with the Federal Vehicle Safety Act.”
“We urge NHTSA to commit to a level playing field by ensuring car manufacturers give the same access to diagnostic and repair information to car owners and independent repair shops as they do to their franchise dealers,” Hickey said in a statement. “Vehicle owners must have the right to take their cars and trucks where they choose for repairs.”
U.S. Sens. Elizabeth Warren and Ed Markey, who had criticized NHTSA’s earlier position, added in a joint statement: “The federal government has heeded our call and clarified that Massachusetts’ Right to Repair law can now be enforced. Today’s action will not only help to ease burdens and lower costs for Massachusetts drivers, but also ensure that transportation regulators continue to build on the promise of the Biden administration’s pro-competition, pro-consumer agenda.”
Manufacturers quickly challenged the law soon after the question passed with 75 percent support, and it’s been tied up in court since then.
NHTSA intervened in June, arguing that the data access requirements in the law could allow a “malicious actor” to remotely control vehicles and lead to crashes, injuries or deaths.
The agency effectively told manufacturers at that point that they should not comply with the Massachusetts law because it was preempted by federal safety law, casting doubt over the future of the measure.
NHTSA said Tuesday that its earlier warnings “do not arise from a belief that any particular entity or person seeking to repair a vehicle – whether a vehicle manufacturer or manufacturer-affiliated dealer, an independent repair facility, or a do-it-yourself vehicle owner – necessarily poses a greater cybersecurity concern than another.”
“Whenever access to write or execute command functionality remotely is contemplated, it is important to be vigilant to minimize risks,” Kolodziej wrote. “NHTSA works to minimize this risk at any level of access – whether by an original equipment manufacturer, dealer, or independent repair facility – and is continually overseeing existing systems for cybersecurity vulnerabilities.”
The agency also stressed that vehicle manufacturers should not disable telematic functions in an attempt to comply with the Massachusetts law, warning that such a step would “disserve vehicle owner safety without advancing the right to repair.”