Should manufacturers do more to stop vehicle theft? Updated rules could force them

Samantha Sannella loves Jeeps — she’s had four in the last eight years — and she knows that thieves covet them, too. In fact, one Jeep disappeared from in front of her Toronto home.

“My previous jeep — which I love, love, loved — was stolen the first week I bought it,” said Sannella, who belongs to a number of Facebook groups for Jeep owners.

“I mean, every day, somebody posts that they’ve had their Jeep stolen.”

Still, when she bought a new Jeep Rubicon, she was surprised her insurance company required her to install an anti-theft device at her own cost or pay a $500 surcharge.

“If so many cars are being stolen, really the manufacturers should be putting them in,” she said.

• How should vehicle theft be addressed? Send your thoughts to ask@cbc.ca.

According to the Insurance Bureau of Canada, in 2022, claims paid out for vehicle thefts exceeded $1.2 billion for the first time.

As thefts rise exponentially, owners and insurers say manufacturers should address known vulnerabilities in vehicle technology, which have been exploited by thieves.

Key stakeholders, manufacturers, insurers, law enforcement and all levels of government will be looking for solutions at a national summit on combating auto theft in Ottawa on Feb. 8. 

How vehicles get hacked

Bryan Gast, vice president of the investigative services division at Équité Association, which investigates vehicle thefts and frauds on behalf of member insurance companies, said standards must be updated.

He said thieves are hacking the Controller Area Network (CAN bus) of vehicles, which enables communication between various electrical components.

“So CAN bus attacks, reprogramming thefts, relay attacks, all of those things aren’t included in the current standard. So really, it’s building a vehicle and designing a vehicle with the technology to prevent theft is really the key,” Gast said. 

For example, before 2007, Transport Canada did not require vehicles to have engine immobilizers, Gast explained. But when vehicles with keyless and remote start technologies were introduced, safety standards recommended by UL Standards & Engagement (ULSE) were made mandatory.

Canadian Motor Vehicle Safety Standard 114 requires that all new vehicles manufactured or imported for sale in Canada with a gross vehicle weight rating of 4,536 kilograms or less must be equipped with an immobilization system.

Gast said immobilizers were effective at first and thefts plummeted, but are now easily exploited by thieves with new technology, so manufacturers need to update anti-theft measures.

“Everything else is reactive. If we can stop the theft in the first place, that’s a step forward,” he said.

According to Gast, there is a new standard out that Transport Canada could adopt: ULC 338: Vehicle Theft Deterrent Equipment and System was published in July 2023, and specifically addresses techniques used by thieves.

“The updated scope also included after-market installation, as well as other updates to align with modern technology, such as, cybersecurity and CAN bus,” said Catie Talenti, manager of media relations at ULSE, which published the standard.

In a statement, Transport Canada said it “continuously reviews Canada’s standards, which includes monitoring how technology is evolving, how that evolution affects federal standards, and whether those standards need to adapt to reflect modern technological changes.”

But vehicle manufacturers are skeptical that adopting new standards will be the solution.

Automakers say to target criminals

In a statement, Brian Kingston, president and CEO of the Canadian Vehicle Manufacturers’ Association, which includes Ford Motor Company of Canada, General Motors of Canada and Stellantis, said increasing the risk of prosecution is the most effective way to deter vehicle theft.

“And at the same time, providing more outbound inspection controls at the ports to prevent the flow of stolen vehicles to foreign markets by organized criminal organizations,” he added.

David Adams, president and CEO of Global Automakers of Canada, said suggesting updated standards assumes that automakers are not constantly upgrading and hardening their vehicle security systems.

“The real issue is well-financed, technologically-savvy, highly organized crime, which is exploiting a myriad of vulnerabilities in Canada making us a source country for stolen vehicles globally,” he says.

He cited the United States, where vehicle immobilizers are not mandatory, an example.

“We should have proportionately less vehicle theft in Canada given the required immobilizers here — that is not Canada’s experience.”

Adams said issues include a porous port, lack of officers and easy availability of devices to facilitate theft online. Meanwhile, he said making cars more difficult to steal increases the likelihood of more violent crimes like home invasions and carjackings, as well as potentially making vehicles more difficult to repair.

New technology, new challenges

Mitra Mirhassani is a professor and co-director of SHIELD Automotive Cybersecurity Centre of Excellence at the University of Windsor.  

She said the CAN bus has been identified as a weak point for hacking vehicle networks, and new technologies and global standards are being developed to increase security. 

“But no system is ever 100 per cent secure,” she said. “No one can claim that their cars are without any security flaws.”

Modern cars are complex technology systems, she said, with features added for safety, convenience and enjoyment.

“Wireless connectivity, infotainment systems, sensors, microcontrollers and other electronic parts, and all of these add their portion of challenges in full vehicle security.”

Mirhassani said adding too many security features could also impact a vehicle’s performance and add cost to consumers. And thieves would eventually find workarounds.

“What I’m saying is that there is no silver bullet to solve this from the technology side,” she said.