When Autonomous Vehicles Are Hacked, Who Is Liable?
Total Page:16
File Type:pdf, Size:1020Kb
When Autonomous Vehicles Are Hacked, Who Is Liable? Zev Winkelman, Maya Buenaventura, James M. Anderson, Nahom M. Beyene, Pavan Katkar, Gregory Cyril Baumann For more information on this publication, visit www.rand.org/t/RR2654 Library of Congress Cataloging-in-Publication Data is available for this publication. ISBN: 978-1-9774-0323-0 Published by the RAND Corporation, Santa Monica, Calif. © Copyright 2019 RAND Corporation R® is a registered trademark. Cover: Adobe Stock/Production Perig. Limited Print and Electronic Distribution Rights This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited. Permission is given to duplicate this document for personal use only, as long as it is unaltered and complete. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial use. For information on reprint and linking permissions, please visit www.rand.org/pubs/permissions. The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors. Support RAND Make a tax-deductible charitable contribution at www.rand.org/giving/contribute www.rand.org Preface This report examines the civil liability implications that would flow from hackers commandeering or hacking autonomous vehicles (AVs) and using them to cause harm. Thanks to AVs, roles and civil legal response may shift among manufacturers, component makers, dealers, and owners (be they individual or fleet owners). Factor in the likeli- hood that hackers will attack AVs, and it becomes prudent to begin mapping the kind of damages that could arise—and who may face claims for damages. The RAND Institute for Civil Justice funded this work. Participants in the auto industry and the technology field, insur- ers, legal professionals, and potential owners of driverless cars will find value in this discussion of the liability implications of hackers attack- ing AVs. RAND Institute for Civil Justice The RAND Institute for Civil Justice (ICJ) is dedicated to improving the civil justice system by supplying policymakers and the public with rigorous and nonpartisan research. Its studies identify trends in liti- gation and inform policy choices concerning liability, compensation, regulation, risk management, and insurance. The Institute builds on a long tradition of RAND Corporation research characterized by an interdisciplinary, empirical approach to public policy issues and rigor- ous standards of quality, objectivity, and independence. ICJ research is supported by pooled grants from a range of sources, including cor- porations, trade and professional associations, individuals, government iii iv When Autonomous Vehicles Are Hacked, Who Is Liable? agencies, and private foundations. All its reports are subject to peer review and disseminated widely to policymakers, practitioners in law and business, other researchers, and the public. The ICJ is part of the Justice Policy Program within the RAND Social and Economic Well- Being Division. The program focuses on such topics as access to jus- tice, policing, corrections, drug policy, and court system reform, as well as other policy concerns pertaining to public safety and criminal and civil justice. For more information, email [email protected]. RAND Ventures The RAND Corporation is a research organization that develops solu- tions to public policy challenges to help make communities through- out the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. RAND Ventures is a vehicle for investing in policy solutions. Philanthropic contributions support our ability to take the long view, tackle tough and often-controversial topics, and share our findings in innovative and compelling ways. RAND’s research findings and recommendations are based on data and evidence, and therefore do not necessarily reflect the policy preferences or interests of its clients, donors, or supporters. Funding for this venture was provided by gifts from RAND sup- porters and income from operations. Contents Preface ............................................................................. iii Figures and Tables ............................................................... ix Summary .......................................................................... xi Acknowledgments ...............................................................xv Abbreviations ................................................................... xvii CHAPTER ONE Introduction—Understanding the Context ................................. 1 CHAPTER TWO Autonomous Vehicles and Future Roadways ................................ 5 What Is an Autonomous Vehicle, and How Does It Work? .................. 6 The Ecosystem of Autonomous Vehicles ........................................ 8 CHAPTER THREE How Can Hackers Exploit Autonomous Vehicles?.........................13 Hacking the Autonomous Vehicle by Exploiting Software Vulnerabilities ................................................................14 Physically Hacking the Autonomous Vehicle by Plugging in a Malicious Device .............................................................14 Hacking the Components of the Autonomous Vehicle Ecosystem .........14 What Types of Attacks Are Plausible? ..........................................15 Effects of Various Hacks .........................................................17 v vi When Autonomous Vehicles Are Hacked, Who Is Liable? CHAPTER FOUR Hacked Autonomous Vehicles and the Harms They Can Cause ........21 Examples of Vehicles Causing Damage ....................................... 22 Potential Hackers and Their Motivations ......................................25 Targets That Are Vulnerable to Hacked Autonomous Vehicles ............ 30 What Types of Harm Can Hacked Autonomous Vehicles Cause? ..........33 Conclusions ....................................................................... 34 CHAPTER FIVE Shifting Roles and Responsibilities for Information Assurance for Autonomous Vehicle Cybersecurity .....................................37 Parties Responsible for Automotive Cybersecurity ........................... 38 Phase-by-Phase Analysis of Shifts in Roles and Responsibilities ........... 42 Societal Perceptions and Responses to Emerging Autonomous Vehicle Trends .........................................................................53 Future Considerations for Autonomous Vehicle Stakeholders .............. 56 CHAPTER SIX Civil Liability and Cyberattacks: General Legal Framework ...........59 Civil Liability for the Criminal Actions of Another Party .................. 60 The Economic Loss Rule .........................................................63 Potential Defendants............................................................. 64 Acceptance of Liability by Autonomous Vehicle Manufacturers ........... 66 Federal and State Laws and Best Practices Relating to Autonomous Vehicles ........................................................................67 Liability for Software Flaws ......................................................69 Civil Liability Theories ...........................................................72 Damages Available Under Tort Theories ...................................... 88 Summarizing Liability Theories in the Context of Hacked Autonomous Vehicles ........................................................89 CHAPTER SEVEN Legal Analysis of Hypothetical Risk Scenarios ............................91 Scenario 1: Ransomware .........................................................91 Scenario 2: Military Base Damage ............................................. 98 Scenario 3: Hacking of Infrastructure ........................................ 101 Contents vii Scenario 4: Theft of Corporate Information ................................. 106 Scenario Takeaways ............................................................. 108 CHAPTER EIGHT Conclusions ..................................................................... 113 APPENDIXES A. Cyber Exploits Against Autonomous Vehicles ...................... 119 B. The Phases of the National Institute of Standards and Technology Cyber-Physical System Draft Framework ............ 129 Bibliography .................................................................... 131 Figures and Tables Figures 2.1. Diagram of Autonomous Vehicle Components ................... 7 2.2. Ecosystem of Autonomous Vehicles ................................ 8 5.1. Current Phases of Vehicle Development and Use ............... 40 5.2. Emerging Phases of Vehicle Development and Use .............41 Tables 3.1. Hacks on Autonomous Vehicle Components and Their Results .................................................................18 4.1. Typical Characteristics of Cyber Threats ........................ 26 4.2. Autonomous Vehicle Hackers’ Intentions ........................ 27 4.3. Commercial Facilities Subsectors ..................................33 5.1. Expansion of Responsibility in the Development and Production Phase ................................................... 44 5.2. On-Demand