Black Box in Cars

December 20, 2014

Most commercial airplanes have an indestructible flight recorder known as a "black box” — even though the casing is actually bright orange — that records information from the flight computers. Another box records cockpit audio and other sources around the plane. In the event of a crash, investigators can recover the black boxes and find out exactly what happened.

Cars can have black boxes, too. In fact, it's a good bet your current car has one. And if it doesn’t, your next new car certainly will. That's why you should know exactly what that black box is recording, who can get the information and how you can stay in control.

A bit of history

Black boxes in cars aren't a new thing. They were installed in cars from Cadillac, Buick, Chevrolet and Pontiac in 1994 to help General Motors manufacturers learn how their cars performed in crashes.

Since the early 2000s, the National Highway Traffic Safety Administration has been collecting black box information to get a better picture of the circumstances surrounding accidents. Last year, 96 percent of new cars sold in the United States came with a black box. As of Sept. 1, 2014, every new vehicle must have one.

Black box data have been used in a few high-profile investigations. In 2011, Massachusetts Lt. Gov. Timothy Murray totaled a government car. He claimed he was driving the speed limit and was wearing a seat belt. Investigators used his black box data to show he was driving 100 mph and wasn’t buckled in at the time of the crash.

Wondering if your car has a black box? This site lists the year, make and model of nearly every car that has one. You can also check your car's manual. If you're buying a car from a dealership, it has to tell you if the car has a black box.

What do black boxes record?

While the first-generation event data recorders did little more than track whether the car's airbags deployed, recording and sensor technologies have become smaller and much more powerful. The NHTSA has mandated that every new recorder must track 15 variables, although older recorders might not have all of them.

The information includes vehicle speed, throttle position, airbag deployment times, whether the brakes were applied, whether seat belts were worn, engine speed, steering angles and more. Manufacturers may include up to 30 additional data points if they want, but they say they don't include GPS location, video or audio. Also, the black box stores information only for 20 seconds around the crash.

Still, many privacy advocates worry that the recording length might eventually increase and include more identifying information. That raises the question of who can access the data in the first place.

Who can pull the data?

Getting your hands on black box data requires professional training and a Crash Data Retrieval system that starts at $2,000 and can cost up to $20,000 with accessories. The CDR system plugs into the on-board diagnostics port under the dashboard on the driver's side and transfers the information to a special computer program.

Obviously, car manufacturers have the equipment. The NHTSA and law enforcement have the resources to get the information either directly or through specialized third parties. Third-party shops often pull the data as part of an accident reconstruction service. Insurance companies and law firms may also use third parties to get data for accident investigations or court cases.

Then there's the group everyone worries about — hackers. In most cases, I doubt hackers want your black box data. It would need to contain a lot more data on you to make it worth their while.

Hackers are more interested in hacking cars so they can take control of them from a distance. Unfortunately, they're getting good at it, and it's getting easier as cars become more and more computer controlled. Do you own one of the three most hackable cars in the world? Click here to find out.

That's the technical side of downloading black box data. There's a legal side as well. As of this writing, 15 states — Arkansas, California, Colorado, Connecticut, Delaware, Maine, Nevada, New Hampshire, New York, North Dakota, Oregon, Texas, Utah, Virginia and Washington — have passed regulations regarding who can pull the information with and without the car owner's permission.

You can find an up-to-date list of the states and their rules at the National Conference of State Legislatures site. In general, however, no one can pull data without your permission or a court order. Insurance companies can't use the data to set your rates unless you opt into a program, and those programs usually use another tracking unit. The rules are much less clear in states that haven't passed any legislation yet.

Can you keep your data private?

Still, anyone with a court order, or just the right tool and a little time, can get at your black box information. There's no way you can delete the data or disable the black box.

Fortunately, there is a simpler option. Products like AutoCYB, OBD Lock and OBD Saver put a lock on the diagnostic port so no one can plug anything into it without your permission. That keeps people from resetting information, extracting data or falsifying records that could be used against you.

Whether a court order would require you to hand over the keys to the lock is another story. I'll leave that one for the lawyers to decide. But you can at least make sure that nothing short of a court order lets someone get your data.

----------------------

On the Kim Komando Show, the nation's largest weekend radio talk show, Kim takes calls and dispenses advice on today's digital lifestyle, from smartphones and tablets to online privacy and data hacks. For her daily tips, free newsletters and more, visit her website at Komando.com. Kim also posts breaking tech news 24/7 at News.Komando.com.

Very interesting. Thanks for posting.

However, I wouldn't be so confident that hackers have no interest in such data. It seems to me that such info would be useful as part of a larger attack designed to take control of a car---or simply designed to cause the car to misbehave.

Bollocks! BS! Yes the data is there and I can pull it with my scan tool... as far as using it? Cyber hack? Someone is trying to sell OBD lock products here.... Don't worry about it.... You can not do anything about it. It is built right into the ECM of your vehicle. Yes it will incriminate you... No you can't erase it after you crash... Just drive the way you should and if you crash, know the speed, engine load, TPS, MAP, and other readings will be there for all to see...

 Recent laws in California ban local auto parts stores from reading codes for you any more.  Only auto repair shops are allowed to.  So, I got the little code reader. 

I've got an OBDII reader.  Plugs into the car.  It has blue tooth to an app on my phone.  Cost me $23 or so and the app is $3.  I can read all the 'black box' stuff; things like G-force max, throttle position, brake application, tire pressure, etc.  Probably a lot more, but I use it to get mpg figures. (Which are different than those on the inflated dash read-out)  It lets me clear all the fields just like clearing codes that pop up. 
I originally got it to clear a code when my wife didn't tighten the fuel cap tight enough and a code popped up.  When any code pops up on a Subaru, it disables the cruise control and the 4 wheel drive.


Here is the one I got;
http://www.amazon.com/BAFX-Products-Bluetooth-diagnostics-Android/dp/B005NLQAHS/ref=sr_1_1?ie=UTF8&qid=1419615121&sr=8-1&keywords=obdii+code+reader+bluetooth

$23 plus the app.  I don't remember which app I got, but read reviews and you'll find one that you'll like. 

I also was able to use this to troubleshoot a AC compressor issue; I could read the engine temp, the compressor temp, the freon temp at the radiator, etc.  The radiator fan wasn't kicking in at the right temp.  Replaced the sensor for the AC that reads the temp to turn on the fan and it worked.   Dealer told me it would cost $600.  I got this troubleshot and fixed for under $50. 

Here is a link to the referred to list in paragraph 6:
http://www.harristechnical.com/downloads/EDR%20List.pdf