Some days ago, Mark Cuban published on LinkedIn a question about weaponized cars: who has developed solutions to detect/prevent such events? I live close to Nice, so I would definitely extend the question to trucks, and basically to anything heavy that moves faster tn humans.
Terrorists are not easy to distinguish from normal drivers before it’s too late
In the real life of a security consultant, terrorists are a problem in a risk analysis. Whatever technology you think about can be somehow abused by terrorists, and terrorists are really an annoying kind of attacker:
- Terrorists don’t care about being caught or killed, which greatly limits the efficiency of many countermeasures, which are designed to make sure that the bad guys eventually get caught (like good logs). With terrorists in a car, the only countermeasure that works is the one that stops them immediately.
- Terrorists are often “bad users” rather than intruders, which means that countermeasures against them must be applied against users. If a car decides to crash itself following a perceived attack, it better be sure that it is actually driven by a terrorist, not just a careless driver.
- Any drastic countermeasure that is designed against terrorists may be misused by other attackers (or even by terrorists themselves) to create havoc. Self-destructing cars are not a pretty sight.
In the end, because of these and similar issues, in a classical risk analysis, terrorists are not listed among the bad guys, and if they are, they are explicitly ignored. Yet, Mark Cuban’s question makes sense, so should we do something about it? I have browsed some of the answers to his question, and I am now reaching my own conclusions:
- First, whatever we will do on vehicles now will not affect older vehicles, so terrorists will still have access to a large number of weapons for many years to come.
- The first consequence is that it is necessary to work on the infrastructure. In Nice, the Promenade des Anglais is now protected physically against weaponized vehicles. They have done a rather good job, using small poles and palm trees as obstacles.
- Also, infrastructure has an IoT component, such as the V2I (vehicle-to-infrastructure) communication. The infrastructure can therefore emit an emergency signal to surrounding vehicles when it detects a potential attack.
- Beyond responding to such infrastructure events, adding countermeasures in cars is difficult. The guy who drives on the sidewalk may be escaping from terrorists, so such countermeasures would still be hard to define.
- Any measure based on deep learning and analysis of drivers’ behavior is also very hard to define and enforce without moving straight to a police state.
- In the long term, full and mandatory automation sounds like a good countermeasure, which also addresses many more problems.
But then, none of this is easy. If we consider the emergency signal sent by the infrastructure in case of attack, there are many potential issues:
- If someone simply crashes into a barrier, who will decide that it is not an attack, and how long will that take?
- Emergency vehicles should not be directly affected by the emergency signal. But then, we need to ensure that terrorists don’t steal emergency vehicles.
- How can we refrain bad guys (terrorists or not) from sending emergency signal just to stop traffic?
There is always a trade-off between our protection and our freedom
In the end, I am not sure that we are ready yet to do anything to deter terrorists from weaponizing our vehicles. The main reason is that the security measures required to do so impose strong contraints on us. So far, we have accepted additional constraints in airports and planes, but we balk at a laptop ban in long-haul flights. And I am quite sure that our tolerance threshold in our cars is very low.
So, we should of course protect our cars from terrorists, but I am afraid that we will not do anything about it for now.