Geo-Specific
,
Regulation
,
Standards, Regulations & Compliance
Cybersecurity Requirements Could Clash With Right-to-Repair
Automakers are generally on track to implement new European Union cybersecurity requirements embedded into tailpipe emissions regulations instigated by the long shadow of Volkswagen’s emissions scandal, but there could be a clash between those new rules and others that are intended to give Europeans a free choice of repairers for their vehicles.
Codified in Euro 7, the latest version of the European Union’s emissions standard, the regulations are the first European tailpipe rules to be rolled out since the Dieselgate scandal. The German automaker was caught using “defeat device” software to smuggle heavy-polluting diesel engines past emissions tests by triggering fuel-economy dampening controls only during laboratory testing conditions.
The new regulation introduces a requirement for all gas-powered vehicles to have an on-board system for monitoring nitrogen oxide and particulate matter emissions, with the data being available through the diagnostic port and – with anonymization – over the air. This is where the Euro 7 standard’s new cybersecurity elements come into play.
The aim is to make sure that the data and the vehicle’s emissions control software cannot be tampered with. This means controlling access to the engine control unit via the onboard diagnostic port and other interfaces, as well as stopping unauthorized over-the-air updates that could alter reported emissions performance. The data coming from onboard emissions monitoring sensors also has to be protected from spoofing.
As much as Volkswagen lost trust worldwide as a result of its Dieselgate, the primary risk the new cybersecurity regulations address is external hackers, said Jan-Peter von Hunnius, an automotive cybersecurity expert at the automotive cybersecurity firm CYEQT Knowledge Base.
Dieselgate was “a real and significant case, but it falls squarely into the domain of compliance failure, corporate governance breakdown, and fraud, not cybersecurity in the technical sense,” he told Information Security Media Group. “The central threat actor in automotive cybersecurity – as in cybersecurity broadly – is the malicious actor or adversary: hackers, thieves, or other attackers seeking to exploit available attack paths to gain unauthorized access to the vehicle, its ECUs, connected applications, OTA update mechanisms, or backend infrastructure.”
Most automakers are well prepared for the new requirements, von Hunnius said. They’ve had since at least mid-2024 to prepare for them, courtesy of the widely recognized United Nations Regulation 155 on automotive cybersecurity. The EU’s Euro 7 regulation directs manufacturers to the U.N. rule for implementation requirements, which have similarly influenced regulations in car-producing countries such as India and South Korea.
“For the issue of emission diagnostics, placing a security gateway between the vehicle’s external diagnostic port and the internal [control area network] bus network that controls critical functions like the engine and after-treatment system is commonplace in passenger cars,” von Hunnius told Information Security Media Group on Thursday. “This gateway requires authentication, typically using digital certificates, to allow access only to authorized diagnostic tools from manufacturers or certified independent workshops.”
“OEMs are also extending these security principles to their software update management systems, as required by the companion U.N. Regulation 156, to ensure any OTA updates to emissions software are cryptographically signed and verified,” von Hunnius added.
Under the Euro 7 timeline, deadlines for implementation start this coming November, when EU and national emission approval can no longer be granted to new models of regular passenger cars and delivery vehicles that don’t meet the requirements. A year later, it will become impossible to register new cars that don’t conform. Similar deadlines will come for heavy-duty vehicles in May 2028 and May 2029.
Makers of passenger vehicles shouldn’t have a problem meeting these deadlines, von Hunnius said, but “commercial vehicles are years behind. Euro 7 will be a challenge for them, so will U.N. R155.”
He sees another potential looming problem: a clash between the new cybersecurity requirements and the burgeoning right-to-repair movement, which aims to force manufacturers to make it easier for consumers to fix things themselves or take their purchases to independent repair shops.
That’s because of the required gateway authorization, which is an application of the threat analysis and risk management processes that are set out in standards such as ISO/SAE 21434 and demanded by U.N. R155.
“The core tension arises because the same technical measures used to secure a vehicle against a ‘tuning shop’ are also used to lock out a legitimate independent mechanic,” von Hunnius said. “The secure gateway authentication that prevents unauthorized ECU reflashing also creates a barrier for independent repairers who need access to the same data for diagnostics and repair … Independent workshops risk being unable to service vehicles if manufacturers do not provide them with the necessary authentication credentials or secure access pathways.”
And the manufacturers can’t simply shut those independent workshops out – since 2007, Europe has also been forcing them to give such repairers the access to diagnostic equipment and maintenance and repair information that they need.
“The tension is structurally unavoidable because both objectives are legitimate and use the same security mechanisms,” von Hunnius said. “The challenge is immense, as it requires creating a secure, scalable and equitable digital ecosystem for vehicle repair … This is a central architectural and policy challenge the automotive industry needs to address.”
According to the European Commission’s implementing act for Euro 7’s cybersecurity aspects, manufacturers will be allowed to use their own infrastructure and cybersecurity methods, as long as they stick by the terms of U.N. R155. Their onboard monitoring systems will need to send data to their servers “as soon as connectivity conditions are appropriate,” though transmission may be delayed if the vehicle is being operated outside the EU.
Across the English Channel, the United Kingdom will also require new vehicles to conform with U.N. R155 and R156 – the deadlines there begin in June. South Korea began introducing its own spin on the U.N. rules last year, while China introduced similar requirements for its automakers at the start of this year.
The wider cybersecurity risks of today’s connected cars are another story. The EU’s Network and Information Systems Cooperation Group said in a risk assessment published last month that existing rules should mitigate many “top risks” as long as they are adequately implemented, but connected vehicles can be hacked through “various pathways,” potentially leading to full remote takeovers or vast leaks of sensitive data.
“The type-approval regime has mainly been created to ensure traffic safety,” warned the group, which comprises experts from EU’s cybersecurity agency ENISA, among others. “New kinds of threats may aim to disturb EU public safety in an organized manner and such actions may potentially have government backing. Resources of public or private companies implementing type-approval regulations are not enough to mitigate these new threats adequately.”