“Black Boxes” in Passenger Vehicles: Policy Issues
Released: 2014-07-22T00:00:00

Introduction

The National Highway Traffic Safety Administration (NHTSA) is proposing to require event data recorders (EDRs)—widely referred to as "black boxes"—on all new passenger vehicles sold in the United States. Although over 90% of the new cars and light trucks sold in the United States already come with EDRs intended to capture information about the final seconds before a crash, these are installed voluntarily by the manufacturers; NHTSA's current rules mainly specify certain types of information that must be recorded if a vehicle is equipped with an EDR. NHTSA's proposed regulation would make EDRs mandatory, but would not substantively change federal requirements about the information the devices must collect.

EDRs are not new. Flight data recorders, also widely referred to as "black boxes," have been installed in aircraft since the 1950s and are used after accidents to reconstruct the critical moments of a plane's operations. Event recorders are also in use in railroad locomotives and large cargo and passenger ships. But the mandatory installation of EDRs in passenger cars has been controversial in Congress. While legislators have generally recognized the devices' potential safety value, in passing the Moving Ahead for Progress in the 21 st Century Act in 2012 (MAP-21) , Congress declined to mandate EDRs in new passenger vehicles due to some members' concerns about driver privacy. A proposal to bar the U.S. Department of Transportation (DOT) from using appropriated funds to develop regulations mandating data recorders was passed by the House of Representatives in 2013, but was not enacted. A bill to limit access to EDR data, S. 1925 , was ordered to be reported by the Senate Commerce Committee in April 2014.

The Technological Evolution of Motor Vehicle EDRs

An EDR is a device installed in a motor vehicle that records certain technical information about a vehicle's operational performance for a few seconds immediately prior to and during a crash. Early versions of EDRs used analog signal processing and recording to analyze and store data and were first tested by NHTSA in the 1970s. The first commercial EDRs were installed by General Motors Corp. (GM) in select models in 1974.

EDRs have evolved over the past 40 years as motor vehicles have increasingly come to rely on electronic sensors. Greater energy efficiency was a primary goal of the move to electronics. A key component in the electronics system is the engine control unit (ECU), which collects and analyzes information about the engine's operation, such as throttle position, revolutions per minute, and airflow. Based on these engine variables, the ECU sends instructions to the fuel injectors varying the length of time a fuel injector pulses or specifying how much spark advance the engine receives in order to improve fuel economy.

These are among the variables which are recorded by EDRs. But over time, as automakers sought ways to evaluate the sensors and make the new systems easier to service, the role of the ECU was expanded to include a diagnostic component which stored data on problems detected through the sensors. This new source of information was helpful to mechanics attempting to address vehicle performance issues, but also laid the groundwork for data recovery technology. For example, the airbag sensor could store a fault, but also could count the number of times the engine had been started since the fault was generated.

An EDR is a small box, which is generally installed under one of the front seats of a vehicle or sometimes in the center console.

The EDR is the key electronic component in recording an accident. It accumulates data from a dedicated sensor or, sometimes, from a vehicle network. Passenger vehicle EDRs are usually incorporated within an air bag electronic controller. A crash-sensing algorithm decides within 15-50 milliseconds (msec) after an impact when the airbag should be inflated, based on model-specific criteria stored in a sensor. The algorithm also determines when the pre-crash data will be recorded. As discussed later in this report, a current NHTSA rule specifies that if the vehicle has an EDR, information on 15 data elements must be recorded at the time of a crash. EDRs installed by some manufacturers collect other data not mandated by federal regulations. Among the data points a particular manufacturer's EDR may record are seat track positions, the weight of the occupants of the driver's seat and front passenger seat, and additional detail on air bag deployment. Neither existing nor proposed regulations mandate that such information be recorded, but NHTSA regulations specify what intervals must be recorded if a manufacturer installs a black box designed to collect such data.

Information stored is limited only by the amount of available memory in the sensor. Once the crash data are stored on the EDR, they cannot be erased or altered. An exception is a "near-deployment" of the airbag, i.e., an accident which does not set off the airbag. In such cases, the data stored on the sensor are cleared from the memory after 250 ignition cycles (about 60 days on average).

The EDR is connected to other sensors, such as the anti-lock brake computer ( Figure 2 ). It collects data from these sensors and continually replaces previously stored data every five seconds. Only the most recent data are retained when airbags are deployed in a crash situation. The data are retrieved by a cable to the EDR or, alternatively, to the vehicle's onboard diagnostic port (known as OBD-II) located near the steering wheel.

EDRs in passenger vehicles collect a much more limited range of information than "black boxes" aboard other types of transportation vehicles. For example, flight data recorders aboard aircraft can record hundreds of flight parameters for up to 25 hours, and cockpit voice recorders capture all voices in the cockpit for the duration of a flight. Data recorders in railroad locomotives must preserve information on about 25 different variables over a 48-hour period. EDRs in automobiles have no voice recording capabilities and are not designed to store large volumes of data.

The EDR data can be useful in a variety of ways. They may be used by law enforcement agencies to help determine why an accident occurred. They could potentially be used to evaluate a driver's responsibility for a crash. The data are used by automakers to better understand vehicle performance in crash situations, thereby possibly leading to vehicle redesign and safer automobiles. They may also be used by federal, state, and local highway officials to evaluate road conditions and safety configurations that could be improved to mitigate accidents.

NHTSA's Regulation of EDRs

NHTSA's Special Crash Investigations (SCI) program first used EDR information in a crash investigation in 1991 (in conjunction with GM, which had manufactured the vehicle involved in the crash being reviewed). In the years following, NHTSA worked with automakers to improve understanding of how electronic sensors could contribute to the evaluation of crash conditions. In 1997, the National Transportation Safety Board (NTSB) recommended greater use of EDRs because of their potential to improve highway safety. In 1997, the NTSB recommended that NHTSA "pursue crash information gathering using EDRs" and that it

develop and implement, in conjunction with the domestic and international automobile manufacturers, a plan to gather better information on crash pulses and other crash parameters in actual crashes, utilizing current or augmented crash sensing and recording devices.

Two years later, the NTSB issued additional recommendations that NHTSA require EDRs to be installed in school buses and motor coaches. To address these recommendations, NHTSA established an EDR working group of industry, academic, and other government organizations, which met from 1998-2000. In 2001, the working group concluded that EDR technology could

have the potential to improve highway safety through improved occupant protection systems; be applied to all types of motor vehicles, but that different types of EDRs would be needed for lightweight vehicles than for heavy trucks and buses; capture a wide range of crash-related data which would be beneficial to researchers, investigators, and manufacturers (if open access, without personal identifiers, was provided); reduce the number and severity of crashes if there is driver and employee awareness of how EDR systems work; be most successful if many vehicles on the road utilize EDRs and there is a corresponding infrastructure to use the data; and be even more effective if integrated with automatic crash notification systems and the car's other electronics (such as global positioning system and cellular phones), thereby providing early notice of and details about a collision.

The working group reported that NHTSA was already incorporating EDR data into its motor vehicle research databases. In addition, it pointed out that most EDR systems were unique and proprietary, such that only the vehicle manufacturer was able to download and analyze the data.

Based on the research and recommendations of the working group and consumer petitions for using the technology for increasing vehicle safety, NHTSA proposed its first EDR regulation in June 2004 and issued the final regulation in August 2006.

Regulation of Voluntarily Installed EDRs

The 2006 NHTSA regulation did not mandate vehicles to have EDRs; only those voluntarily equipped are subject to the regulation. (At the time it was estimated that 64% of new light vehicles were already equipped with them.) Rather, in recognizing that this technology was increasingly becoming a feature in many vehicles, NHTSA sought to standardize the types of data being collected

so that such data may be put to the most effective future use and to ensure that EDR infrastructure develops in such a way as to speed medical assistance through providing a foundation for automatic crash notification (ACN).

Applied to all light vehicles (cars, pick-up trucks, SUVs) with EDRs sold after September 2012, the regulation requires:

a standard set of data elements and formatting. The regulation lists 15 technical requirements pertaining to time/interval sample rates. For example, cars equipped with EDRs are required to record crash-related information on vehicle speed, driver safety belt status, and timing of air bag deployment. a few milliseconds of data capture, rather than several minutes. See Appendix A for the specific recording intervals. crash survivability of an EDR during and after front and side vehicle crash tests commercial availability of the tools necessary for crash investigators to retrieve data from an EDR; and owners' manuals to include information on the functions and capabilities of the EDR as a means of raising public awareness.

While the 2006 regulation set forth requirements for EDR data elements, NHTSA believed that a new rulemaking was needed to require all vehicles to have EDR technology.

Mandated Black Boxes

In December 2012, NHTSA proposed an expanded safety standard that would mandate the installation of EDRs on all light vehicles sold in the United States after September 1, 2014. The rulemaking would not change any of the substantive requirements of the 2006 standard in terms of amount and types of information that an EDR must collect. The rulemaking has not been completed, and if a final rule is issued, it will have a later effective date than initially proposed.

In its Federal Register notice proposing the rule, NHTSA said it was taking the step for three main reasons. It estimated that about 8% of the new light vehicle fleet does not have EDR technology, that those vehicles' manufacturers would not voluntarily install EDRs without the regulation, and that

requiring all light vehicles required to have frontal air bags to be equipped with EDRs would help improve vehicle safety for consumers, while imposing relatively limited costs on the automobile industry.

NHTSA stated that upgrading the regulation from the voluntary 2006 rule to a Federal Motor Vehicle Safety Standard (FMVSS) would expand enforcement options and allow NHTSA to seek civil penalties "for failure to provide an EDR or for failure to provide one that performs properly."

In addition, NHTSA said that more expensive vehicles that are also equipped with advanced safety systems—such as collision avoidance technologies—will be the most affected by the new regulation. By applying EDRs to cars with these emerging technologies, NHTSA will be able to gather information on their performance in accidents, the agency said. NHTSA argued that having that information may lead to further safety improvements in all vehicles.

State Regulation of Vehicle Information

Although the federal Drivers Privacy Protection Act (DPPA) places some limits on access to a vehicle owner's personal information, it does not protect information collected by an EDR. The only explicit restrictions on the use of EDR data are in state law.

Specific laws have been enacted in 14 states to clarify that the data recorded on an EDRs is owned primarily by the motor vehicle owner and that a car owner must be notified (usually in the owner's manual) that the car is equipped with an EDR. The state laws differ, but generally allow others to access EDR data:

with the owner's consent; in response to a court order or probable cause of an offense; for improving vehicle safety; by auto dealers and auto technicians seeking to repair a vehicle; and to dispatch emergency personnel.

In its 2006 rulemaking setting minimum EDR data requirements, NHTSA noted that manufacturers had asked it to explicitly state that the rule preempted inconsistent state and local regulations. NHTSA declined to do so, although it noted that

general principles of preemption law would operate so as to displace any conflicting State law or regulations. It is our view that any State laws or regulations that would require or prohibit the types of EDRs addressed by our regulation, or that would affect their design or operation, would create a conflict and therefore be preempted.

EDR Policy Issues

Saving Lives by Improving Vehicle and Road Safety

Vehicle crashes impose an enormous expense on society and on individuals. In the United States, over 30,000 people die each year in vehicle-related crashes and around 4 million people are injured. NHTSA has estimated that these crashes impose costs of about $871 billion annually—the equivalent of 2% of GDP—in harm to individuals and costs to society from lost productivity and other factors. Analyses of crashes are important for helping to understand how crashes can be prevented or mitigated, and how vehicle occupants can be protected in the event of a crash.

Crash analysis is challenging. Crashes often occur on heavily trafficked roads, where the investigator is under pressure to clear the scene quickly in order to restore traffic flow. In some cases the investigator is at risk from passing traffic. Many crashes happen at night and in inclement weather, further hampering investigation. The investigator may not be able to interview participants or witnesses, and if they are available neither the crash vehicle occupants nor witnesses may be able to provide accurate information; in the case of the crash vehicle occupants, they may have reason to lie.

EDR data are useful in analyzing crashes. They provide specific information about several factors, such as vehicle speed and brake application, which can help investigators understand the crash sequence. They also provide crash data in volumes that are not obtainable in any other way, making possible statistical analysis focused on detailed elements of crash involvement. Vehicle manufacturers, NHTSA, and other safety groups perform crash tests on vehicles, but relatively few such tests are conducted annually. By contrast, NHTSA collects crash data, including EDR data, from thousands of investigations of actual vehicle crashes each year.

EDR data can help vehicle manufacturers improve the safety performance of vehicles. They also can help inform traffic safety policies and regulations intended to prevent or mitigate the effects of crashes. For example, EDR data were helpful in analyzing the high-profile unintended vehicle acceleration issue with Toyota vehicles in 2009 and 2010.

Assessing Liability and Preventing Fraud in Traffic Crashes

By providing data from the systems of vehicles involved in crashes, EDRs can help to mitigate the "he said, she said" aspect of crash investigations. As noted above, eyewitness testimony can be unreliable, and crash participant testimony even more so. EDR data also can help prevent fraud by scam artists who deliberately stage car "accidents" to make claims against state and local governments, school districts, and other entities with "deep pockets."

Some insurers see the potential for tying premiums to documented driving habits of policy holders, part of a move within the insurance industry to implement "usage based insurance" (UBI). One insurance industry observer noted that EDRs

combined with telematics devices, provide a powerful and accurate documentation of driving habits, independent of any of the traditional lifestyle, economic and situational risk factors that have been part of auto insurance.

One insurance company has already experimented with providing policy owners the option of installing a device that records data similar to that recorded by the EDR in exchange for a policy discount; the company expects that such data could indicate how safely the driver drove (e.g., did the driver routinely engage in hard braking and hard acceleration). Insurers may be able to access EDR data in policyholders' vehicles if provisions in insurance contracts require policyholders to cooperate with the insurer. (Some states do not allow insurance contracts to require this access.) In addition, insurance companies could reduce premiums for policyholders who consent in advance to share EDR data in the event of a crash.

Privacy Concerns

Perhaps the most prominent concern about EDRs is their impact on personal privacy. While current regulations provide only that EDRs, if installed, track 15 specific data elements, technological advances may allow greater data collection. In addition, individual auto manufacturers are free to collect more data, or to collect data for longer time periods, than required under NHTSA's EDR rule. When combined with other technologies, such as onboard navigation systems and mapping apps, EDR data could be transmitted beyond the vehicle owner's control.

Part of the concern over EDRs and personal privacy may stem from a mistaken notion that EDRs, like airplane black boxes, are recording audio and even location information. In principle, there is no technological reason that EDRs could not collect such data, as the cost of sensors and data storage steadily shrinks. As one critic contended,

the EDRs, if made mandatory, will provide a wide open door to the comings and goings of every American. Tracking not simply how fast you drive or whether you ride your brakes, EDRs have the ability to collect the location and distances of where you drive every time you get into your car.

NHTSA has noted that "there is concern about crash-related data being collected from privately owned motor vehicles that could be used against the owner." While NHTSA itself is not allowed by federal law to disclose personal identifiers of crash information, other entities—such as insurance companies, salvage yards, local police departments, or subsequent vehicle owners—can also obtain a car's data. Appendix B lists entities that may seek to access EDR data and their reasons for using it.

NHTSA has said that EDR data used by NHTSA should not raise privacy concerns because the agency does not collect information that would identify an individual; the closest information to that would be the vehicle identification number (VIN), which can only be used to identify the owner (although not the driver) of a vehicle if linked to a vehicle registration database that includes this information.

Is the vehicle owner aware that the vehicle has an EDR?

EDRs have been in vehicles for many years, but their spread has been gradual and has not been a high profile issue. NHTSA's proposed EDR rule would require that a vehicle's owner's manual include a statement explaining the existence and purpose of the EDR in the vehicle.

Who has access to EDR information?

There is no national standard governing access to information from an EDR. In the states that have enacted legislation governing EDR data, the vehicle owner is declared the owner of the EDR information. But even in those, the laws allow others to have access to the data without the vehicle owner's permission in certain circumstances. In many cases, as with leased vehicles, the driver of the vehicle may not be the owner. And some automobile insurance policies may transfer ownership of EDR data, or the entire vehicle, to the insurer in the event of a significant claim.

EDR legislation enacted in some states typically allows access to EDR data without the owner's consent for safety research, vehicle servicing, and by court order, with other exceptions provided in some states. Auto insurance policies typically have clauses that require the vehicle owner to cooperate with an investigation in connection with a claim, which could include allowing access to the EDR data.

Physically, access to EDR data is generally under the control of the vehicle owner, since the physical interface for the device is inside the vehicle. However, it is possible to transmit the data, if the vehicle is so equipped. Vehicles with Advanced Automatic Crash Notification systems (such as GM's OnStar) transmit EDR information to a central location when software in the vehicle determines that a crash has occurred, based on data from the EDR. In vehicles with wireless data transmission capabilities, it would be possible to have regular or continuous transmission of EDR data.

DOT is working with vehicle manufacturers and third parties to develop "connected vehicle technologies," a system in which vehicles would constantly be communicating with other vehicles and roadside infrastructure regarding traffic, road conditions, and vehicle performance data in order to minimize the risk of collision and maximize traffic flow. It is possible that hackers would be able to compromise the security of EDR data by accessing wireless data exchanges among vehicles. This information might become commercially valuable if manufacturers expand EDR data collection far beyond the minimum requirements established by NHTSA, turning the EDR into a hub for a wide variety of vehicle data, much of which may have nothing to do with crashes.

It is imaginable that some drivers might even want such data to be distributed to selected individuals; as one recent newspaper article explained:

Recently, auto makers have started allowing software developers to draw data from the car itself, like fuel economy. Developers imagine creating apps that track detailed gas mileage for every trip a car makes, or even lets groups of friends or family members view each other's results to see who drives most efficiently.

Privacy issues related to data not provided to NHTSA are generally outside NHTSA's legal authority, although it does have the authority to forbid commercial entities from rendering federally required safety features in a vehicle inoperative. This authority may affect proposals from some privacy advocates who argue that EDRs should be designed so that vehicle owners can turn them off.

Can technology also protect privacy?

While NHTSA was studying EDR technology, the Institute of Electrical and Electronics Engineers (IEEE) issued in 2004 the first universal, voluntary standard specifying minimal performance characteristics for memory devices in autos, trucks, buses, ambulances, and fire trucks. IEEE Standard 1616 is an international protocol issued to help manufacturers develop black boxes with up to 86 data elements that will survive in crash situations.

IEEE and others have argued that NHTSA's pending EDR regulation does not go far enough to protect owners' privacy. In 2010, IEEE issued a new Standard 1616a, which specifies a lockout system to block unauthorized access that could otherwise lead to data tampering, odometer fraud, and VIN theft. It argued that such steps are necessary to ensure that motorists embraced the EDR technology in the long run. With this lockout standard, a motorist would have a separate key which would lock access to the OBD-II connector (as well as the EDR). In a letter to the NHTSA Administrator, IEEE stated:

we believe public acceptance is crucial to the goals of this rulemaking... . We agree with the findings of a National Academies study that noted "Paralleling the concerns over legal acceptability of EDRs are concerns over public acceptability. A consumer revolt against the installation of EDRs could negatively impact sales and/or lead manufacturers to offer owners the option to turn off their EDRs or even stop installation of them altogether. These options would seriously limit the amount of EDR data collected for research by personnel in law enforcement, insurance, government, manufacturing and education."

Congressional Involvement

The ownership and privacy of the data recorded by an EDR have been issues of concern among legislators since 2004. In every Congress since then, bills have been introduced that include these requirements:

At the time of purchase, auto dealers would have to disclose the presence of EDRs in new automobiles, the type of information collected, and its possible use by law enforcement officials. Owner's manuals would be required to include the same information. New vehicles equipped with EDRs could not be sold unless the devices could be disabled by car owners. The Federal Trade Commission would be tasked with enforcement of violations of these EDR provisions, which would be identified as unfair or deceptive acts. NHTSA would be tasked with studying and reporting to Congress on the usefulness and consequences of implementing EDR technology.

The only vote on a proposal in this category came in 2012 on H.Amdt. 1368 , offered by Representative Landry to H.R. 5972 , the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act for 2013. His amendment was supported by Representative Rahall, the ranking Democrat on the Transportation and Infrastructure Committee. Passed by voice vote, it would have prohibited the use of funds in that bill to develop regulations mandating a range of recording technology (including EDRs) on passenger and commercial vehicles. In his floor statement, Representative Landry argued that

the Department of Transportation has become obsessed with electronically monitoring vehicle movements. Right now, the DOT is working on a mandate which would require that every car have a device which is very similar to an airplane's black box.

Several Members of Congress argued that the proper venue for consideration of this amendment was the soon-to-be-debated surface transportation reauthorization. The Landry amendment was not enacted, because the Senate did not pass a comparable transportation appropriation bill in 2012; DOT funding was governed by a separate continuing resolution.

Separately, Congress has considered a number of bills mandating the use of EDRs. For example, a Motor Vehicle Safety Act, introduced in 2010 in both the House and Senate, included a provision to establish a Council for Vehicle Electronics, Vehicle Software and Emerging Technologies within NHTSA to integrate NHTSA's expertise in these areas. The bills also mandated that all new passenger vehicles be equipped with EDRs by 2015 and all new medium and heavy duty vehicles by 2017, and had provisions limiting retrieval and access to EDR data. The bills were reported by committees in each house, but neither was passed.

Three other bills to mandate EDRs were introduced in the 111 th Congress as well. Their provisions included the following:

phase-in of EDRs in passenger automobiles over several years; establishment of a universal data retrieval method and an EDR database for research and analysis; requirement that every new car owner's manual disclose the presence of an EDR; limitation on retrieval of EDR data except by vehicle owners, mandated by a court, or retrieved by NHTSA. Alternatively, some bills allowed full retrieval if driver and vehicle identification number (VIN) were not disclosed.

None of these bills was passed.

EDR Language in Surface Transportation Reauthorization

The 2010 proposal to establish a Council on Vehicle Electronics was incorporated into S. 1813 , the surface transportation reauthorization, which passed the Senate on April 24, 2012. The bill mandated that all new passenger cars have EDRs by model year 2015 and, like the proposed Motor Vehicle Safety Act of 2010, stipulated that data are owned by the car owner, except in certain circumstances. It required DOT to submit a report within two years of enactment, assessing the safety and privacy impacts of EDRs.

The House-passed surface transportation bill, H.R. 4348 , did not contain the EDR provisions or provide for the Council on Vehicle Electronics. The House-Senate conference eliminated the EDR provisions from the bill, which was enacted as the Moving Ahead for Progress in the 21 st Century Act (MAP-21, P.L. 112-141 ). The law did establish a Council for Vehicle Electronics. While not focused specifically on EDRs, its mission is to examine and report back to Congress on "the need for safety standards with regard to electronic systems in passenger motor vehicles" and to consider "security needs for those electronic systems to prevent unauthorized access, and the effect of surrounding environments on the electronic systems.

Current Legislation

In the 113 th Congress, Representative Capuano introduced H.R. 2414 , which would require manufacturers to post a window sticker in each new car, stating that there is an EDR in the vehicle, where it is located, the type of information it records and that such information may be used in law enforcement. It would prohibit the sale of vehicles after 2015 unless vehicle owners can control the recording of information on the EDR. The legislation also states that any data recorded by an EDR is the vehicle owner's property and can only be retrieved with the owner's consent, in response to a court order, or by a vehicle repair technician. It is pending in the House Energy and Commerce and Judiciary Committees.

In April 2014, the Senate Committee on Commerce, Science and Transportation unanimously ordered reported S. 1925 , the Driver Privacy Act, sponsored by Senators Hoeven and Klobuchar. The bill would limit access to EDR data to the vehicle owner or lessee. Exceptions would allow access if authorized by judicial or administrative authorities (for the retrieval of admissible evidence), with the informed written consent of owners or lessees for any purpose, and for safety investigations, emergency response purposes, or traffic safety research. If used for safety research, information that would identify individual owners and vehicle identification numbers would have to be redacted. The bill requires NHTSA to conduct a study to determine the amount of time EDRs should capture and record data, and to issue regulations on that subject within two years of submitting the study to Congress.

On June 10, 2014, during consideration of H.R. 4745 , the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act for 2015, the House adopted by voice vote H.Amdt. 8335 , sponsored by Representative Yoho, which would bar use of federal funds to enforce regulations mandating passenger vehicle EDRs. The amendment would also prohibit the use of federal funds that might mandate global positioning system tracking. In his floor remarks, Representative Yoho cited

a need to provide clarity to the confusion surrounding who is the owner of the data collected by these event data recorders. I believe that ownership resides with the owner of the vehicle. However, until such time as this issue is resolved, I must defer to my constituents back home who are adamantly opposed to these black boxes.

Appendix A. Data Recorded by an EDR

Appendix B. Entities Seeking Use of EDR Data