Automotive Industries Association of Canada

Submission for:

A Consultation on a Modern Copyright Framework for Artificial Intelligence and the Internet of Things

September 24, 2021

About AIA Canada

Canada’s automotive aftermarket sector is responsible for maintaining the health and safety of Canada’s fleet of 29 million vehicles. It does so through the provision of vehicle repair  and maintenance services and replacement vehicle parts and supplies.

Represented by the Automotive Industries Association of Canada (AIA Canada), the country’s automotive aftermarket is worth an estimated $32.2 billion (2019). We are present in every riding in Canada, employing 491,800 workers.

The sector supply chain and our members include parts manufacturers, wholesalers and distributors, retailers including Canadian Tire and independent auto shops like Midas and Mr. Transmission.

Copyright and Vehicles

Over 29 million vehicles operate on Canada’s roads. The safe and efficient operation of vehicles is critical to Canadians’ overall health and safety, achieving our country’s greenhouse gas emission targets and the country’s economic success. This submission will outline the challenges faced by the automotive aftermarket regarding the Copyright Act and identify opportunities for improvement.

Our sector is very supportive of important principles in balanced copyright including fairness for consumers and a level playing field for businesses that support them.

Intellectual property is a pillar of the dynamic that exists between auto manufacturers, motorists, and parts and repair professionals in the automotive aftermarket. For decades we have sought to work collaboratively to find a balance between the technologies and systems that auto manufacturers place in vehicles and the ability of the aftermarket to repair and improve those vehicles.

In 2009, a voluntary agreement called the Canadian Automotive Service Information Standard (CASIS) was signed. The agreement provides a framework for auto manufacturers to share equally with independent auto shops and authorized dealerships special diagnostic tools and official auto manufacturer service and repair information. The tools and information are needed to service vehicles that are equipped with on-board diagnostics. The agreement ensures that an open, fair and competitive aftermarket exists.

Much has changed since 2009. Vehicles contain more technology, including telematics systems. Telematics systems collect, store, process and transmit vehicle data directly from vehicles on the road back to the auto manufacturer. In addition, because notable auto manufacturers have refused to join the CASIS agreement, its effectiveness has been undermined. A voluntary approach was a good first start, but this 2010’s agreement will not be sufficient to ensure that consumers continue to have the right to repair their vehicle at the service facility of their choice and that the aftermarket is able to continue to innovate.

In polling conducted in August, 2021 by Abacus Data, 94% of Canadians either agreed or strongly agreed that consumers should have the ability to get their vehicles serviced at the service facility of their choosing. A majority of Canadians (83%) agreed that auto manufacturers should be required by law to share vehicle data with independent auto shops so they can repair vehicles.

The Right to Repair needs to be formally established in Canada’s Copyright Act

We are aware of the contention that the text and data mining (TDM) of vehicle data helps auto manufacturers make discoveries that enable them innovate.

We do not believe that innovation should be the sole jurisdiction of the auto manufacturers, but rather that innovation should be encouraged throughout the entire automotive value chain. This includes the need to allow aftermarket parts manufacturers to be able to use important information that will improve the products they make available to consumers. Enabling innovation throughout the automotive value chain will provide a fair balance while supporting consumers’ needs and respecting their preferences.

The State of Voluntary Agreements for Repair

The CASIS agreement signed in 2009 came about in response to new technology that had the potential to restrict consumer’s right to choose where they serviced their vehicle and limit the ability of independent auto shops to compete.

In 1998 in Canada, it became the law that vehicles be equipped with on-board diagnostics (OBD-II). OBD-II is a computer system that collects information from the network of sensors inside a vehicle, which the system can then use to regulate vehicle systems or alert the user to problems. Technicians plug into the OBD-II port using a diagnostic scan tool to access diagnostic trouble codes needed to repair vehicles.

Being able to access OBD-II diagnostic data is critical for technicians and should be a right of the vehicle’s owner. AIA Canada believes that the principles of market competition and consumer choice that underpin the CASIS agreement should apply today and that a new access regime should be created to ensure these principles are upheld.

The greatest challenge to this system is the vehicle telematics systems that are now installed on new vehicles by auto manufacturers.

Vehicles have become an important pillar of the Internet of Things. They should be explicitly included in the consideration of the Copyright Act.

The CASIS agreement mitigated threats to consumer’s right to repair their vehicle at the service facility of their choice and the ability of independent auto shops to compete.  However, emerging challenges require a rethink of the relationship between auto manufacturers and independent auto shops. This new approach should have at its center the best interests of the vehicle owner or operator. It should also preserve competition that keeps costs low and ensures vehicle repair and maintenance services are available in all parts of Canada, including rural and remote communities.

Vehicles in the IoT ecosystem

Canada’s Copyright Act seeks to provide balance between rights holders and users. The consultation documents rightly point out that the needs of users are changing and that creators should continue to be encouraged to invest and create jobs.

The consultation document rightly points out that manufacturers are now using technological protection measures (TPMs) to “protect software incorporated within products… in ways that are linked to achieving other business objectives, including strengthening cyber security and requiring consumers to only use manufacturer-authorized repair services.” This development is concerning for the automotive aftermarket. Protections originally anticipated to help software developers protect their code and authors to ensure their works are not reproduced may now be used to deny vehicle owners the right to repair their vehicle.

Testing the exceptions of the Act could be very costly, especially for any small business trying to facilitate repairs if the matter needs to be brought before the courts. Cost does matter to Canada’s independent auto shops, the overwhelming majority of which are small businesses (86%) with fewer than 10 employees. An outright repair provision would provide peace of mind to independent auto shops. It would also give vehicle owners clarity and assurance that their vehicle can be repaired at a facility of their choice.

AIA Canada strongly agrees with the sentiments expressed by other stakeholders in the Parliamentary proceedings that TPMs are too restrictive and prohibit non-infringing activities. We believe that in the absence of adequate exceptions for the purposes of repair, auto manufacturers will be be further incentivized to deploy TPMs that make it more difficult for vehicle owners to repair their vehicle at the service facility of their choice.

Repair should be identified as a non-infringing purpose in the Copyright Act. The Act should also include an exception for breaking a technological protection measure for the list of non-infringing purposes as defined in the Act.

AIA Canada supports other stakeholders calling for clarification of the law such that private contracts or end-user license agreements cannot override exceptions in the Act.

In a survey conducted by Abacus Data in August 2021, it was found that of the 9 in 10 Canadians who have a personal or family vehicle, 33% of respondents were unsure who owned the data collected by their vehicle. A further 36% mistakenly believed that the owner of the vehicle owned the data produced by the vehicle they operate. This clearly points to the fact that the majority of Canadians do not understand the dynamics of data ownership and are not adequately educated on the fine print of the paperwork they sign when purchasing or leasing a vehicle. End-user agreements are very complex and should not be allowed to supersede consumer benefits that ought to be made clear in the Copyright Act.

Increasing numbers of software-enabled vehicles are finding their way onto Canada’s roads. Ensuring that technological advancements continue to benefit consumers and enhance their safety and experiences should be a fundamental goal of this review. Doing so will require them to have the right to choose which service facility repairs their vehicle. As the consultation document rightly notes, effective maintenance will limit environmental waste. Perhaps even more importantly, it can also ensure the vehicles that stay on the road are running more efficiently and polluting less.

AIA Canada prefers the proposed approach of introducing a specific legislative exception to the prohibitions regarding TPMs for the purpose of repair. However, in a situation where legislation appears difficult to pass, a regulatory approach in the interim would be acceptable if it explicitly includes vehicles and vehicle components explicitly.

Repair

3.2.i.

What kinds of repair activities require access to copyrighted works (e.g. software) and circumvention of TPMs (e.g. repairing, maintaining, testing, diagnostics, modifying, enhancing, and achieving interoperability with another product)?

Software is not the only type of copyrighted work that technicians need access to in order to maintain or repair vehicles.

In the automotive aftermarket, independent auto shops often require subscriptions to official auto manufacturer service and repair information to service vehicles.

Despite that added expense, the average cost for repairs at an independent auto shop is $243 while the average price paid per visit to a new vehicle dealership is $323. That difference represents the importance of competition in the market.

While the types of service differ, all of the activities mentioned will depend to some degree on access to copyrighted works in some manner, regardless of how that access is obtained.

3.2.iii.

What kinds of TPMs hinder repair of software-enabled products (e.g., do the TPMs control access to copyright subject matter, or prevent copying of copyright subject matter such as software)?

In most cases, TPMs in automotive control access to copyrighted subject matter. The most common types of TPMs include subscriptions to official auto manufacturer service and repair information needed to conduct repairs. In addition, these subscriptions include time limits on use (24-48 hours) or longer subscriptions, including monthly and yearly. Costs are incurred regularly by the aftermarket to help Canadians repair products they have already purchased. This creates a steady stream of revenue for auto manufacturers who have already developed, marketed and sold their products.

In a 2019 J.D. Power survey of independent auto shops across Canada, half of the respondents said official auto manufacturer service and repair information issues are a reason that they limit or do not offer certain work. Types of work that is limited or not offered because of access to information issues:

• ECU reprogramming/diagnostics
• Software issues
• Immobilization/security codes
• Audio/entertainment/navigation system

Advanced driver assistance systems (ADAS)

Since 2018, new vehicles sold in Canada must be equipped with a backup camera, an ADAS feature. Other ADAS features include lane departure, blind spot and forward collision warnings. The Government of Canada is considering additional ADAS regulations; a 2020 consultation sought feedback on if Motor Vehicle Safety Regulations should be updated to include additional ADAS regulations.

 

To successfully service ADAS, technicians require access to:

• Specialist calibration and diagnostic tools; and
• Access to official auto manufacturer service and repair information, including procedures and methods needed to accurately calibrate and validate systems.

While driving, drivers trust that those systems are operating properly. Therefore, it is critical that the independent auto shops that represent the largest portion of vehicle repairers in Canada have access to the resources that they need to properly repair ADAS-equipped vehicles.  In Canada in 2019, there were 4,572 dealerships (not all with service departments) and 24,665 independent auto shops (both mechanical and collision).

There is near-zero standardization among auto manufacturers when it comes to ADAS calibration requirements and parameters. In a research document issued by the American Automobile Association in January 2019, the Association identified up to 20 different names among 34 auto manufacturers for the same ADAS feature and a variety of different calibration procedures. The Motor & Equipment Manufacturers Association (MEMA) said at least 30 million cars on U.S. roads had ADAS-related repair restrictions from auto manufacturers preventing independent auto shops from fixing them. A MEMA industry survey found that without use of auto manufacturer scan tools, independent auto shops are unable to interpret and fix 20% to 30% of ADAS diagnostic trouble codes, leading the vehicle to be sent to a dealership.

Because ADAS systems are not standardized, ADAS is an official auto manufacturer service and repair information issue.

Non-standardization is a costly endeavor for shops that service multiple vehicle brands. The resources needed to deal with such a complex calibration environment can easily break the six-figure mark.

In 2019, MEMA responded to a United States Federal Trade Commission consultation on repair restrictions. MEMA called for auto manufacturers to be prohibited from making vehicle warranties conditional on original ADAS parts or service, bringing the new technology in line with rules on traditional automotive parts. MEMA called for aftermarket access to the latest diagnostic information from vehicle software needed to properly service ADAS.

We are very concerned that without a guaranteed right to repair, auto manufacturers will have incentives to further restrict access to the information that the aftermarket needs to repair vehicles. That would mirror the activities of auto manufacturers like Tesla whose copyrighted subject matter is not available to independent auto shops in Canada.

3.2.iv.

What forms do the TPMs take (e.g. are TPMs mostly digital in form, or are they instead part of the physical configuration of a product?

TPM’s that hinder reparability include:

• Access to vehicle’s diagnostic trouble codes: Telematics systems transmit vehicle directly to auto manufacturers who control access to it.
• Specialist calibration and diagnostic tools: These tools are needed to provide certain repair and maintenance services.
• Access to official auto manufacturer service and repair information
• Warranty terms and conditions: Auto manufacturers making vehicle warranties conditional on drivers servicing their vehicles at authorized dealerships and/or the use of OEM parts
• Extended Vehicle Concept (ExVE): Auto manufacturers advocate that third parties should access vehicle data through a data sharing framework referred to as the ExVE. Under ExVE, telematics data is transmitted over a secure and encrypted communication channel to a dedicated auto manufacturer cloud server. Independent auto shops access data from an auto manufacturer’s website. ExVE gives auto manufacturers control of access to vehicle data needed for repairs. Auto manufacturers, competitors in the aftermarket sector, can dictate to their competitors the terms of access to data, including cost, timing and scope. 

3.2.v.

What is the nature and extent of effort required to determine whether, which, or how many TPMs must be circumvented for repairs? For example, are there instances where multiple TPMs must be circumvented to repair a product, or it is difficult to determine whether a digital lock is actually a TPM in the sense of copyright law?

Many TPMs are specific not only to a particular vehicle make and model, but they can be serialized to a specific VIN (vehicle identification number).

3.2.vii.

To what extent do repair activities involve: (a) a repair person/company circumventing a TPM on behalf of a client as part of the repair service; and (b) a repair person/company making or providing a technology, device, or component to another person to be used in order to circumvent a TPM for the purpose of repair?

In the automotive sector, repair activities almost always require a repair person/company accessing the on-board diagnostic systems that control access to vehicle data. Very few individuals or households would have access to the tools or have the know-how that would allow them to connect to vehicle systems to assess issues. As vehicles become more software-defined, the ability of non-professionals to service vehicles further diminish.

3.2.viii.

Is cyber security, public safety and/or the disclosure of personal information at risk when a person circumvents a TPM for the purpose of repairing a product (e.g. interference with the functioning of a product and release of unsafe products on the marketplace); if so, what mitigation measures can be taken to reduce these risks?

The automotive aftermarket, both repairers and parts manufacturers, has the highest possible incentive to ensure cybersecurity.

Vehicle Security Professional Program (VSP)

Under the VSP program, which was a part of the CASIS agreement, authorized technicians at independent auto shops effectively handled secure and sensitive information.  The VSP program was developed in response to the inability of technicians to perform certain work that was dependent on the use of security-related information. The VSP was developed as a mechanism to facilitate the secure transfer of highly sensitive information.

The program allowed only vetted and registered professionals to access security-sensitive information related to vehicles, including key codes and immobilizer reset information. Authorized automotive locksmiths and technicians were given credentials that they used every time they logged onto auto manufacturer Service Information Source subscription-based websites. Authorized individuals were only allowed to access information at the request of the customer.

Not all auto manufacturers participated in the VSP program and the information that participating automakers made accessible to VSPs was at their discretion. The VSP program was terminated when the National Automotive Service Task Force (U.S. based) began accepting applications directly from Canadians.

Extended Vehicle Concept vs. the Secure Vehicle Interface

Manufacturers often cite cyber security and public safety as risks when fighting back against right to repair initiatives. Auto manufacturers argue that the Extended Vehicle Concept, a closed system approach, provides the best cyber and data security. However, open systems also provide additional benefits to consumers and may provide better protection against cybersecurity attacks. Many businesses in the information technology sector have opted to make important divisions and products available as open source because of the widely distributed nature of support and monitoring for open source models.

The Secure Vehicle Interface (SVI) offers another model that puts the vehicle owner in control of which service facilities have access to their vehicle’s data. SVI is based on 3 European Committee for Standardization (CEN) /International Organization for Standardization (ISO) standards: TS 21177, TS 21185 and TS 21184.

The SVI is a communication protocol that is hidden in the coding of vehicle technology. It collects vehicle data from the Controller Area Network (CAN). The CAN acts like a vehicle’s nervous system - it enables different vehicle systems to communicate with one another. No matter the auto manufacturer, the SVI converts vehicle data from the CAN into a common language.

Vehicle owners authorize service providers to access to their diagnostic data through an app. Upon authorization, technicians can pull diagnostic data directly, in real-time and remotely onto a computer device.

SVI is secure. Only recognized and authorized external systems, including service providers and smart traffic infrastructure, can access the platform. A single firewall protects wired and wireless connections. SVI uses the standardized Internet techniques of Public Key Infrastructure (PKI) and digital certificates to manage identity and access. These same techniques are used in E-commerce, online banking, internet gaming, smartphones and cloud computing.

Since SVI is embedded in each vehicle, a cyber-attack would have to be conducted vehicle-by vehicle. This decentralized approach offers benefits over the proprietary networks envisioned by auto manufacturers.

Because it is not new hardware, but embedded coding, SVI is deploy-ready and retrofittable.

As of model year 2022, new vehicles sold in Massachusetts equipped with telematics systems will have to be SVI-equipped.

Both ExVE and SVI provide safety and security - only SVI maintains market competition and the right to repair.

Standardized approach

A standardized approach to cybersecurity for the automotive sector is essential. Unilateral approaches taken on an auto manufacturer-by-auto manufacturer basis will only harm competition in the aftermarket sector. It is conceivable that these networks would also be more attractive targets for attack than secure, distributed systems that interact with service facilities on vehicle-by-vehicle basis.

3.2.ix.

Are there products, or categories of products, for which the circumvention of TPMs for the purpose of repairing them would introduce undue risks to personal health and safety or to network functionality and public safety access?

The process of repairing a product implies that it is restored to its maximal function. When it comes to vehicles and components, a product is not repaired if undue risks are introduced following maintenance or replacement.

We believe strongly that enshrined right to repair legislation and regulation will create an appropriate framework where all stakeholders in the automotive sector can find alignment. That alignment and collaboration will ensure the important questions regarding personal health and safety, network functionality and public safety access are addressed. As partners in safety, auto manufacturers and the aftermarket will ensure these concerns are accounted for.

3.2.x.

Do TPMs unduly restrict competition in the aftermarket sector? If so, are particular TPMs or classes of TPMs of concern? Are particular industries or products affected more than others; and if so, how are they affected and how does it affect consumers?

In considering any exceptions to the prohibitions regarding TPM circumvention activities for the purpose of repair, the Government wants to ensure that any new TPM exception for repair does not interfere with the creative industries' ability to rely on TPMs to protect their investments.

TPMs restrict competition in a number of ways:

• They create barriers to new entrants in the aftermarket, whether in automotive repair or in the development of aftermarket products.
• Prevent competitors from adding new software functionality that interoperates with existing software.
• They create real and potential loss of business from independent auto shops to authorized automaker dealerships.
• They prevent parts manufacturers from producing diagnostic tools for the aftermarket sector by copying vehicle software for the purpose of reverse engineering the vehicle systems to ensure interoperability with their own tools.
• Restrict access to non-copyrightable parameters and functions that must be altered in order to improve or optimize vehicle performance.

The rise of telematics data in vehicles has generated significant concern among our membership in recent years. Jurisdictions including the European Union, Great Britain and Massachusetts have made headway on the right to repair in automotive. Massachusetts’ first Right-to-Repair law was introduced in 2012, and in 2020 another law was passed that ensures independent auto shops in the state are able to service vehicles equipped with telematics systems.

Access to Data for Repair (Text and Data Mining)

Text and data mining as defined in this consultation is less of a concern for the automotive aftermarket in this consultation than other items covered. However, the principle of access to the data or text that could be mined is very much a priority. Further, the application of technological protection measures in vehicles is a major concern. In particular, the exception for TDM activity related to temporary reproductions for technological processes in section 30.71 is highly relevant.

Restricting access to copyrighted content makes good sense when that protection is set to ensure a competitor does not create a new product that would replace the manufacturer’s product on the open market. It does not, however, make sense when the restriction limits an owner’s ability to fix or improve a product they have purchased – particularly a vehicle, one of the most expensive purchases an individual makes in their lifetime.

Vehicle owners should have an overarching right to determine how that vehicle and all its component parts are repaired, by whom, where, and when they choose.

The ability to mine data may become necessary in the future for vehicle diagnostics and repair. It is important that this legislative review anticipate that need as vehicles generate more data and become more connected.

Interoperability

The discussion on interoperability in the consultation document reflects a decade of developments in the automotive aftermarket.

“TPM and non-TPM-related barriers to interoperability have prompted some industries to develop industry-wide standards for certain important technologies in recognition of the economic benefits that interoperability can provide the whole of the industry.”

This description reflects the industry-wide voluntary agreement that CASIS provides in the automotive sector. CASIS has been very useful to ensure fairness and certainty for SMEs and for consumers since 2009. However, as the consultation document acknowledges, barriers to interoperability can become barriers to entry for SMEs or inhibit the ability of SMEs to innovate.

AIA Canada has observed that some new-entrant manufacturers, including Tesla, have not signed onto the agreement.

Changes in the marketplace should be reflected in statute and not in voluntary agreements to ensure the benefits of interoperability continue for the automotive sector and for consumers.

The consultation highlights particular frustration in the agricultural manufacturing industry where TPMs used by some OEMs on their products’ software and on proprietary technologies are limiting interoperability. This limits the ability for manufacturers of third-party products to innovate and bring new products to market. We have observed the exact same challenges in the automotive sector.

The government is keen to maintain appropriate incentives for investment and innovation, while promoting competition. Incenting auto manufacturers to invest in copyrighted works should be balanced with the size and scope of the automotive aftermarket and Canadians’ dependence on our services and products.

A further consideration should be the fact that no new vehicle rolls off a production line or dealer lot half built or partially functioning. The automotive aftermarket is not competing to produce copies or substitutes for the auto manufacturers’ product or innovative designs—the aftermarket only maintains, repairs or provides products that complement the products that auto manufacturers have already derived profit from. Their investments to innovate have already paid returns when the vehicle rolls off the lot. At that point, the consumer’s safety and preferences, and environmental benefits should be the priority of Canada’s copyright policy.

The interoperability exceptions in the Act do not apply if a “person does an act that constitutes an infringement of copyright.” Enshrining ‘repair or maintenance’ as a non-infringing use would benefit repair shops across Canada and would ensure consumer fairness.