Out of Control in the Driver’s Seat
You’re tooling down the highway when suddenly your car’s A/C turns on to full blast. Then the radio fires up and switches to a Hip-Hop station.
You’re startled when the wipers turn on, wiper fluid obscuring your view of the road for a moment.
You’re frantically trying to turn it all off when your car loses power completely, leaving you stranded on a busy stretch of road with no shoulder, a semi closing in fast from behind you.
That sounds a little a scene from a spy thriller or maybe even the “X-Files,” but it happened to the driver of a 2014 Jeep Cherokee as researchers Charlie Miller and Chris Valasek hacked into and took control of it.
The duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.
Miller and Valasek first made headlines in 2013, when they publicized their success hacking into Ford and Toyota models. At that time, they only managed to accomplish the attacks while their PC was plugged into the vehicles’ diagnostic ports.
Only two years later, the duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.
They found they could do it from absolutely anywhere, so long as they had an internet connection. Most disturbing of all, they identified a loophole that could be used to attack multiple cars at once — creating a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.
The team published part of the project online and later demonstrated their “progress” at the 2015 Black Hat conference.
Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get.
After Miller and Valasek published their results, Fiat Chrysler issued a recall for 1.4 million vehicles affected by the vulnerability exploited by the team. The automotive industry has been on high alert ever since, even while they simultaneously boast about models equipped with more and better technology.
Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get. The push toward autonomous vehicles will only increase those vulnerabilities.
“We are a long way from securing the non-autonomous vehicles, let alone the autonomous ones,” said Stefan Savage, a computer science professor at the University of California, San Diego, during an Enigma security conference early this year.
Autonomous isn’t necessarily synonymous with “connected,” however, even for early entrants to the commercial autonomous vehicle space.
Daimler’s Freightliner Inspiration, the world’s first road-ready self-driving truck, “doesn’t rely on ‘connectivity’ or wireless communication to/from the outside world to drive itself,” said Dan Holden, manager of corporate risk and insurance for Daimler Trucks North America.
“Rather, the system is self-contained, meaning it uses production cameras and radars as inputs to determine the vehicle position and keep it centered in its lane. Therefore the Inspiration truck is as secure from a cyber perspective as production vehicles today.”
More Frightening Than Fiction
Until cyber vulnerabilities can be addressed, it doesn’t take a broad stretch of the imagination to see what the future implications could be for this type of attack. Consider a few scenarios:
- The vehicle of a courier transporting sensitive documents is disabled in a remote location, where armed thieves are waiting to steal the documents.
- A high-level executive receives a message alerting him that ransomers have control of his teen daughter’s car — with her in it — and will drive it off of a bridge if he doesn’t pay $10 million in Bitcoin.
- A ring of thieves finds a way into the systems of a trucking fleet’s rigs through its onboard camera system, enabling it to stop the trucks remotely so teams can hijack the cargo.
- An extreme hactivist group decides to “brick” every car in Los Angeles, disrupting businesses and lives until its demands are met.
- An attacker hacking into a commercial truck’s system disables the brakes, sending the truck careening into a school bus in the middle of an intersection.
Keep in mind that even less extreme types of hacking could create vulnerabilities for both individuals and businesses.
Miller and Valasek proved their ability to wirelessly hack a vehicle for surveillance, tracking GPS coordinates, measuring speed, and tracing routes. When a vehicle’s onboard systems are connected to the driver’s smartphone, the smartphone is also at risk for attack, and any data stored in it is fair game, including passwords and credit card information.
Government and Industry Respond
Miller and Valasek’s work is part of what inspired the drafting of an automotive security bill introduced last year. The Security and Privacy In Your Car Act (the SPY Car Act) would require cars sold in the U.S. to meet certain standards of protection against digital attacks and privacy.
The bill’s creators surveyed 20 carmakers and discovered that only seven used independent security testing to check their vehicles’ security, and only two had tools in place to stop a hacker intrusion.
Several Japanese companies are working on automotive cyber security technology.
In March, the FBI, along with the Department of Transportation and the National Highway Traffic and Safety Administration, published an advisory on the realities of hackable vehicles and making recommendations to increase security.
Several Japanese companies are working on automotive cyber security technology. Panasonic is developing a device that can detect unauthorized network signals and cancel them out. Fujitsu Laboratories and a researcher from Yokohama National University are developing technology that detect an attack, notify the driver, and encrypt signals to allow the vehicle to be stopped safely.
However these technologies are still five years away from commercial availability, as are fully encrypted next-generation automotive networks.
Transportation companies, their clients and every organization with a fleet of its own should be asking questions about the security of the vehicles that are used in the course of their daily operations — and whether they have cover that will respond if their vehicles fall prey to cyber tampering.
“Having insurance coverage in place that would address bodily injury and property damage is something companies should seriously consider as this risk matures,” said William A. Boeck, senior vice president. and insurance and claims counsel for Lockton’s cyber risk practice.
Focus on Sleep Apnea in the Transportation Industry
An estimated 22 million people in the U.S. may have undiagnosed obstructive sleep apnea. For workers in the transportation industry that can be deadly.
The government is looking at accidents that resulted in multiple fatalities as it considers whether to propose requirements specific to obstructive sleep apnea. In the Federal Register notice, the government referred to the condition as a “national health and transportation safety issue.”
“Undiagnosed or inadequately treated moderate to severe OSA can cause unintended sleep episodes and deficits in attention, concentration, situational awareness, memory, and the capacity to safely respond to hazards when performing safety sensitive service,” the notice read.
“For individuals with OSA, eight hours of sleep can be less refreshing than four hours of ordinary, uninterrupted sleep, according to a study by the American Academy of Sleep Medicine. The size and scope of the potential problem means that OSA presents a critical safety issue for all modes and operations in the transportation industry.”
“Undiagnosed or inadequately treated moderate to severe OSA can cause unintended sleep episodes and deficits in attention, concentration, situational awareness, memory, and the capacity to safely respond to hazards when performing safety sensitive service.” — Federal Register notice
OSA is described as a respiratory disorder in which there is a reduction or cessation of breathing while sleeping. Risk factors include obesity, male gender, advancing age, family history of OSA, large neck size, and an anatomically small oropharynx (throat).
The Federal Motor Carrier Safety Administration and Federal Railroad Administration issued a joint Advance Notice of Proposed Rulemaking and will host three public listening sessions in Washington, D.C., Chicago, and Los Angeles.
“The collection and analysis of sound data on the impact of OSA must be our immediate first step,” said Scott Darling, acting administrator for the safety administration. “We call upon the public to help us better understand the prevalence of OSA among commercial truck and bus drivers, as well as the safety and economic impacts on the truck and bus industries.”
The FRA is also developing a rule that would require certain railroads to establish fatigue management plans.
The most recent fatal accident described in the notice occurred in the early morning hours in December 2013 when a Metro North Railroad commuter train derailed in New York City, killing four passengers and injuring at least 61 others.
The train had been traveling at 82 miles per hour despite the 30 mph speed limit when it came off a curved track. The engineer reported feeling dazed just before the accident and his wife complained about his snoring.
A subsequent evaluation determined he had severe OSA. Despite having multiple risk factors, the driver had never been screened for the condition. The National Transportation Safety Board said his undiagnosed OSA had been exacerbated by a recent circadian rhythm shift required by his work schedule, causing him to fall asleep.
“It is imperative for everyone’s safety that commercial motor vehicle drivers and train operators be fully focused and immediately responsive at all times,” said U.S. Transportation Secretary Anthony Foxx. “DOT strongly encourages comment from the public on how to best respond to this national health and transportation safety issue.”
Helping Investment Advisers Hurdle New “Customer First” Government Regulation
This spring, the Department of Labor (DOL) rolled out a set of rule changes likely to raise issues for advisers managing their customers’ retirement investment accounts. In an already challenging compliance environment, the new regulation will push financial advisory firms to adapt their business models to adhere to a higher standard while staying profitable.
The new proposal mandates a fiduciary standard that requires advisers to place a client’s best interests before their own when recommending investments, rather than adhering to a more lenient suitability standard. In addition to increasing compliance costs, this standard also ups the liability risk for advisers.
The rule changes will also disrupt the traditional broker-dealer model by pressuring firms to do away with commissions and move instead to fee-based compensation. Fee-based models remove the incentive to recommend high-cost investments to clients when less expensive, comparable options exist.
“Broker-dealers currently follow a sales distribution model, and the concern driving this shift in compensation structure is that IRAs have been suffering because of the commission factor,” said Richard Haran, who oversees the Financial Institutions book of business for Liberty International Underwriters. “Overall, the fiduciary standard is more difficult to comply with than a suitability standard, and the fee-based model could make it harder to do so in an economical way. Broker dealers may have to change the way they do business.”
As a consequence of the new DOL regulation, the Securities and Exchange Commission (SEC) will be forced to respond with its own fiduciary standard which will tighten up their regulations to even the playing field and create consistency for customers seeking investment management.
Because the SEC relies on securities law while the DOL takes guidance from ERISA, there will undoubtedly be nuances between the two new standards, creating compliance confusion for both Registered Investment Advisors (RIAs)and broker-dealers.
To ensure they adhere to the new structure, “we could see more broker-dealers become RIAs or get dually registered, since advisers already follow a fee-based compensation model,” Haran said. “The result is that there will be likely more RIAs after the regulation passes.”
But RIAs have their own set of challenges awaiting them. The SEC announced it would beef up oversight of investment advisors with more frequent examinations, which historically were few and far between.
“Examiners will focus on individual investments deemed very risky,” said Melanie Rivera, Financial Institutions Underwriter for LIU. “They’ll also be looking more closely at cyber security, as RIAs control private customer information like Social Security numbers and account numbers.”
Demand for Cover
In the face of regulatory uncertainty and increased scrutiny from the SEC, investment managers will need to be sure they have coverage to safeguard them from any oversight or failure to comply exactly with the new standards.
In collaboration with claims experts, underwriters, legal counsel and outside brokers, Liberty International Underwriters revamped older forms for investment adviser professional liability and condensed them into a single form that addresses emerging compliance needs.
The new form for investment management solutions pulls together seven coverages:
- Investment Adviser E&O, including a cyber sub-limit
- Investment Advisers D&O
- Mutual Funds D&O and E&O
- Hedge Fund D&O and E&O
- Employment Practices Liability
- Fiduciary Liability
- Service Providers D&O
“A comprehensive solution, like the revamped form provides, will help advisers navigate the new regulatory environment,” Rivera said. “It’s a one-stop shop, allowing clients to bind coverage more efficiently and provide peace of mind.”
Ahead of the Curve
The new form demonstrates how LIU’s best-in class expertise lends itself to the collaborative and innovative approach necessary to anticipate trends and address emerging needs in the marketplace.
“Seeing the pending regulation, we worked internally to assess what the effect would be on our adviser clients, and how we could respond to make the transition as easy as possible,” Haran said. “We believe the new form will not only meet the increased demand for coverage, but actually creates a better product with the introduction of cyber sublimits, which are built into the investment adviser E&O policy.”
The combined form also considers another potential need: cost of correction coverage. Complying with a fiduciary standard could increase the need for this type of cover, which is not currently offered on a consistent basis. LIU’s form will offer cost of correction coverage on a sublimited basis by endorsement.
“We’ve tried to cross product lines and not stay siloed,” Haran said. “Our clients are facing new risks, in a new regulatory environment, and they need a tailored approach. LIU’s history of collaboration and innovation demonstrates that we can provide unique solutions to meet their needs.”
For more information about Liberty International Underwriters’ products for investment managers, visit www.LIU-USA.com.
Liberty International Underwriters is the marketing name for the broker-distributed specialty lines business operations of Liberty Mutual Insurance. Certain coverage may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds and insureds are therefore not protected by such funds. This literature is a summary only and does not include all terms, conditions, or exclusions of the coverage described. Please refer to the actual policy issued for complete details of coverage and exclusions.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Liberty International Underwriters. The editorial staff of Risk & Insurance had no role in its preparation.