Plugged In: An EV Newsletter Vol. 2, No. 9

November’s edition of Plugged In concludes a three-part series focused on the impact of technology and AI on the automotive industry. DW Member Greg Ewing discusses the significant cybersecurity and privacy risks associated with connected cars, vehicles equipped with built-in internet connectivity. As cars become increasingly connected, they generate vast amounts of data, raising significant cybersecurity and privacy concerns. Greg’s article explores the potential risks of connected vehicles, from hacking vulnerabilities to data privacy issues, and outlines how automakers and consumers can protect themselves in this rapidly evolving landscape. Next, Bob Weiss considers the contrasting perspectives on Tesla’s future in the autonomous driving industry, with some voicing optimism about the company's potential to dominate the space while others express skepticism about regulatory, technological, and competitive challenges. The newsletter concludes with Bob’s interview of Doug Patton, Principal of Jupiter Consulting LLC and a former automotive industry executive. The interview covers a range of topics, including battery technologies, the symbiotic relationship between electrification and autonomous driving, the current technological competition between Tesla and Waymo, and global EV market challenges, including China's growing dominance.

Heather Frayre | Member Partner

Imagine a company that can pinpoint the exact location of every car in the world or data about all of your driving habits and routes being used to identify your friends and family, to recalculate your health insurance, or to send advertisements for the coffee shop on your way to your kid’s school.  All of this is possible – if not already happening – with our connected cars.  The wealth of data generated by our connected cars raises incredibly significant cybersecurity and privacy concerns that must be addressed.

1.   What is a Connected Car?

A connected car is any car – electric, hybrid, or gas powered – with a built-in cellular modem that allows that car to communicate over the internet.  These cars generally come with a service to manage that communication.  Chevrolet and General Motors have OnStar.  Ford has FordPass.  Stellantis has Uconnect.  Many vehicles allow consumers to bring their own with Android Auto or Apple Car Play.  In 2020, 91% of new cars sold in the U.S. were connected.[1]  The percentage of new US vehicles that will be connected is predicted to hit 95% by 2030.[2]

This connectedness provides a myriad of new features and conveniences.  Our navigation systems tell us where to go, our telematics systems track our operation of the vehicle and notify us of needed service, and our infotainment systems keep us entertained while we drive or wait. 

But now, by adding signals in and out, we’ve added significant potential threat vectors and new areas for potential invasion of privacy.  In the past, an attack on a car was generally mechanical:  breaking a window, picking a lock, hotwiring the ignition.  Our connected cars provide many more opportunities for attack. 

2.   Five functional areas lead the cybersecurity and privacy concerns.

There are at least five primary functional areas of concern with our connected cars.  First, telematics systems use sensors to track the location and operation of a vehicle.  This data is often shared through the OEM so that consumers can manage the vehicle.  This may include remotely starting the vehicle, calling emergency services in case of an accident, remotely setting climate controls, opening windows, or starting and stopping music.  Many third-party apps allow these features and more.  OEMs may use the same data to improve performance, identify problems early, or troubleshoot problems that arise.

Second, power-related systems generate voluminous data including information on remaining charge, distance available, time to refuel, etc.  These in turn send data to OEMs or third parties to, for example, recommend the next charging or fueling location.

Third, navigation systems tell us how to get where we want to go and often include saved locations and favorite routes.  But these systems also necessarily hold data on driving behavior, food preferences, family information, which doctors we visit, which events we attend, and other derivative data.

Fourth, infotainment systems store music choices.  But potentially more importantly, store the consumer’s voice and related voice commands, frequent numbers for calls and texts, potentially the actual content of calls and texts. 

Fifth, there are numerous third-party apps such as Android Auto or Apple Car Play that can have access to any of the data above if the consumer agrees.  Not only are these a distinct opportunity to access a vehicle, but they also invariably result in third-party databases storing large amounts of consumer data.

3.   Why does any of this matter?

Why does this matter from a cybersecurity and privacy perspective?  In 2019, an ethical hacker gained access to digital keys of cars worldwide for multiple different manufacturers.  Then, using a third-party software package, the hacker executed commands on those cars – unlocked doors, opened windows, disabled security – without the driver’s knowledge.  The third party software provider fixed the problem. 

Similarly, hackers gained access to data held by a device independent telematics company and were able to execute commands (unlock doors, start engines, honk horns) on consumer cars, police cars, ambulances, and other law enforcement vehicles. 

As another example, in 2022, hackers gained access to vehicles and the ability to remotely start, unlock, locate, flash the lights, and honk the horn on the cars through a SiriusXM vulnerability.  This system was used in cars made by Acura, BMW, Honda, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and Toyota. 

Finally, in 2021, news broke of Ulysses, a third party that claimed to be able to give the military real time location data for 15 billion vehicles around the world.[3]  It was able to provide this precise location information based on data collected by the cars and their components; they required no additional apps or access.

4.   Companies can and should protect themselves and their customers.

In the face of consumer demand for connected features and the increased risk that these features bring, companies must protect themselves both to avoid a breach and, if it happens, after a breach.

One key way to protect both before and after a breach is to ensure that any connected vehicle or components of those vehicles apply well-regarded technical standards.  There are numerous standards promulgated by many different organizations that apply to every aspect of connected vehicles.  For example, Society of Automotive Engineers International (SAE),[4] International Standard of Organization (ISO),[5] Auto-ISAC, National Highway Traffic Safety Administration (NHTSA),[6] Cybersecurity Infrastructure Security Agency (CISA), NIST, and industry associations.

Applying these standards ensures a company is applying industry best-practices and therefore reduces its risk profile.  Additionally, if an OEM or manufacturer does suffer a breach, it will most likely be judged in litigation, government investigations, and in the court of public opinion.  In each of these fora, a company that applied industry standards pre-breach can point to those practices as proof that it took all reasonable precautions and protected its customers. 

The NHTSA has also proposed an industry wide set of cybersecurity best practices for connected vehicles.  Most notably, NHTSA encouraged the industry to create a mechanism for data sharing, Auto-ISAC.[7]  Through Auto-ISAC, the industry is intended to find methods for accelerating the adoption of lessons learned across the industry, including effective information sharing before and after breaches.

5.   Privacy considerations with connected cars are very high.

In addition to the cybersecurity risks related to accessing or controlling a vehicle without the owner’s permission, connected vehicles raise numerous potential privacy concerns.  Multiple privacy laws may apply to any data processing done by a connected car depending on what types of data are collected, who the data subjects are, and where the data is stored.  For example, in the United States, this would include state privacy laws and Federal oversight provided by the FTC that ensures fair trade practices through transparency.  In Europe, the United Kingdom, or Switzerland, the applicable version of GDPR will apply.  In China, the Personal Information Protection Law (PIPL) and the Data Security Law (DSL) may be applicable. 

To comply with the various privacy legal requirements, OEMs will generally be required to disclose the data collected by their vehicles, including data from any components incorporated in that car, how that data is used, and allow consumers to exercise their applicable rights.  Similarly, if a connected vehicle collects biometric data such as voice, fingerprints, or facial images, the OEM will be required to meet the specific requirements of the relevant biometrics law.  Failure to comply with these jurisdiction specific requirements could result in fines or sanctions from government authorities. 

Consumers must also be aware that automakers may share biometric data – or other collected data – with law enforcement.  The legal requirements to share with law enforcement may also be a lower threshold than most consumers expect.  For example, the privacy policies covering this data routinely do not require police to provide a warrant, but instead indicate that data may be shared as “part of an investigation or request, whether formal or informal, from law enforcement or a governmental authority.”

Over time there is no question that better and better security will be developed and privacy practices will be implemented.  Simultaneously, bad actors will constantly strive to invent new ways to circumvent security and the volume of data will make data sharing with third parties more and more valuable.  This is the typical ebb and flow of security and privacy but one which all drivers of connected cars should be aware. 

Gregory L. Ewing | Member Partner

There seem to be differing perspectives about the future of Tesla. In early October, in a major event, Tesla, or perhaps more particularly, its controversial Chief Executive Officer and majority owner, Elon Musk, unveiled two new vehicles: (1) the Cybercab, an autonomous driving vehicle with no steering wheel or pedals (projected cost of less than $30,000); and (2) the Robovan, an AV capable of transporting 20 occupants and cargo. Musk also touted Tesla's "Fully Self Driving" software. There are those who suggest that these and related autonomous driving products/services could increase Tesla's enterprise value to three trillion by 2030. Many analysts were lukewarm to the presentation, suggesting that given the lack of specifics in terms of timing, specific business model, etc., that there was more sizzle than steak to the presentation and that there were major unaddressed obstacles to Tesla achieving major success in autonomous driving. 

On the other hand, there are those that embrace Musk's aggressive vision and believe that Tesla will succeed in being a leader in, if not ultimately dominate, the autonomous driving space and AI and their various applications. 

Perhaps acknowledging the substantial lead its well-funded competitors have achieved in terms of experience and technology, an analyst from Oppenheimer poses the question this way: "The question we are left with is whether Tesla can leverage its significant data collection and manufacturing cost advantages into a dominant position in self-driving vehicles/services". 

I will try to lay out both sides below (not exhaustively, given space limitations) and leave it to the reader to draw their own conclusion. 

Pro Case

One of Tesla's biggest boosters is ARK, which has, as of September 30, 2024, approximately 5.6 billion dollars under management and describes itself as "a global asset manager specializing in thematic investing in disruptive innovation" headed by Kathy Wood. Tesla represents ARK's largest holding and constitutes approximately 15% of its portfolio. In a recent  investment report entitled "Countdown to Cybercar, Tesla's Multi-Trillion Dollar Robotaxi Opportunity"[8], the author states: "In our view, an autonomous taxi platform will unlock a multi-trillion dollar market and begin to dominate Tesla's valuation approaching 90% of its enterprise value over the next five years." and projects a $2,000 stock price in 2027. On November 1, 2024, Tesla closed trading at $248.98 per share. ARK sees Robotaxi contributing 64% and EVs contributing 46% of Tesla's EBITDA in 2027.   

In its annual research report, entitled "Big Ideas 2024"[9], it notes that according to its research, ARK believes that robotaxi platforms could redefine personal mobility and generate $28 trillion in enterprise value during the next five to ten years. 

ARK is not the only prominent Wall Street analyst that is very bullish on Tesla. Dan Ives of Wedbush Securities opines that he believes autonomous driving could be a trillion dollar opportunity for Tesla and said that he thinks Tesla is the most undervalued AI stock in the entire stock market. Analysts at Deutsche Bank are also optimistic regarding Tesla's prospects in autonomous driving, projecting an additional $4 billion in sales and an additional $1 billion in pretax earnings by 2030. 

ARK, in its report noted above, addresses the issue of Tesla’s competitors having entered into the AV market well before Tesla. The author notes that Tesla will scale faster than Waymo because it won't rely on HD maps or geofencing, but will use real world driving miles.  Tesla customers drive 5 million miles per day in Full Self Driving (FSD) mode and 87 million miles per day in U.S. non-FSD, creating a database much larger and more diverse than Waymo. He further cited Tesla’s U.S. based manufacturing capacity as an additional advantage that will allow Tesla to scale up rapidly and close the current lead-time gap with its prime competitor, Waymo, which currently has no manufacturing capacity of its own. 

Acknowledging that autonomous driving, rather than sales of EVs, is the future of the company, Musk is quoted as telling investors that, "If somebody doesn't believe Tesla is going to solve autonomy, I think they should not be an investor in the company".  

Cons

1.         Regulatory Approval – One of the major obstacles to Tesla's entry into the autonomous driving field, let alone dominance, is regulatory obstacles. Although Tesla has driving testing permits that allows it to test autonomous technology with a safety driver on public roads, it does not have driverless testing permits, nor have they even applied for such permits according to TechCrunch, quoting a public information officer from the California DMV. Waymo has obtained regulatory approval and operates a Level 4 driving system in several cities. There are also federal regulatory requirements. As TechCrunch noted in a recent article, "If Tesla wants to mass produce its robotaxis with no traditional driver controls, it needs to obtain an exemption from the Federal Motor Vehicle Safety Standards" and that NHTSA has confirmed that Tesla has not applied for such an exemption, which will likely not be easy to obtain.

2.         Its Competitors Are Way Ahead – In an article[10] appearing in the October 15^th edition of Fortune, the author noted: "….by the time Tesla revealed its robotaxi vehicle on controlled private property, competitors have been out on the public roads in high-traffic, complex, urban areas for years." The author cites, in particular, Alphabet-owned Waymo, which is reported to conduct 100,000 paid rides a week in San Francisco and LA and is continuing to expand its operations to other major cities. 

3.         Technology – In an article appearing in the October 11^th edition of the Wall Street Journal entitled: "Musk Shows Off Driverless Robotaxi to Be Priced Under $30,000"[11], the author notes how Tesla lags its rivals in terms of the state of its driverless technology stating, "Tesla also needs to make leaps in advancing its own driver-assist software, which today is considered a ‘level 2’ system (requiring some level of driver involvement)” and that, "By contrast, Waymo has achieved ‘level 4’ autonomy on its cars, which means it can operate them without a human driver in most circumstances." 

There is another risk regarding Tesla's chosen technology. In an article entitled, "Have AI advances led to self-driving breakthroughs or a dead end"[12], the author highlights the risk related to Tesla's controversial choice of self-driving technology. In contrast to Waymo, Mobileye and others, Tesla had adopted "end-to-end" learning model, which is described as "ingesting tribes of data and produce driving commands without intermediate coded guardrails or insight into how results are derived." Waymo, on the other hand, has adopted what is described as more of a compound system that includes multiple components. Sterling Anderson, currently chief product officer of Aurora innovation and formerly chief of Tesla Autopilot, believes that Tesla's approach is "exactly wrong" and amounts to a "train and pray" strategy that provides no assurance of safe results or ability to vet a problem.

The New York Times and Bloomberg Law reported recently that NHTSA recently opened a defect investigation into Tesla's FSD, following reports of four crashes, one involving a fatality, while the system was in operation. In the October 18^th New York Times article entitled, "Tesla Self-Driving System Will Be Investigated by Safety Agency"[13], the author noted that the focus of the investigation was whether Tesla's self-driving software had safeguards in place to require drivers to retake control of their cars in situations the autonomous technology couldn't handle on its own. The author concluded: "But the investigation by the safety agency is an indication that, even if Tesla succeeds in perfecting the technology, it will still face significant regulatory hurdles." The author further notes that "Tesla's self-driving software depends on cameras to operate, unlike other manufacturers who also use radar or laser technology that are often better at detecting objects and people when the view is obstructed by poor weather or bright sunshine."

Conclusion 

There are plenty of what appear to be valid arguments on both sides of the debate. Perhaps the deciding factor might be Musk himself. Putting politics and personality aside, Musk is a driven genius and has a proven successful track record of proving his doubters wrong. 

Robert Weiss | Of Counsel | Co-Chair, EV Initiative