On July 21, 2020, the FBI issued a Private Industry Notification (PIN 20200721-001) describing an industry and academic study performed on a set of self-certified ELDs identifying a number of security vulnerabilities. The vulnerabilities could allow an attacker to steal and corrupt data, and in some cases inject commands into a vehicle’s electronic control unit (ECU) to cause the vehicle to respond in unexpected ways. ELDs are designed to collect the log data from commercial trucks and provide a method to electronically send inspection reports to the Department of Transportation’s Federal Motor Carrier Safety Administration (DOT FMCSA). However, like any device with network connectivity, they are susceptible to electronic attack, disruption, and compromise. If the device is connected with shipment tracking or dispatching networks, an attacker could access those networks or cause disruption. And, like any device with network connectivity, if it was not designed with security in mind, it is highly probable attackers will figure out ways to use the vulnerabilities to their advantage.

Although the DOT FMCSA released the “Cybersecurity Best Practices for Integration/Retrofit of Telematics and Aftermarket Electronic Systems” in May 2020, many of the existing ELDs commercially available for the study were self-certified in 2019 and the security best practices may not have been implemented. Many ELDs are designed to use mobile devices to submit ELD information, so the security concern goes beyond the ELD itself and includes the network and devices in the network as well. Organizations must examine their entire connected network of trucks, ECUs, devices, application interfaces and computer systems to effectively identify threats, evaluate risks, and take appropriate action to protect the ELD solution.

Assessing and selecting an ELD solution requires up front diligence so an organization can incorporate the appropriate technologies and controls for ongoing due care. We recommend addressing the following questions as part of due diligence when selecting and designing an ELD solution:

• Is there a data flow map to help understand where the data is created, collected, processed, transmitted and stored?
• What are the threats and risks at each point in the data flow?
• How is the information protected (e.g., encrypted) in motion and at rest?
• Has the solution been independently tested for security vulnerabilities?
• How is security built-in to the design and development process for the solution?
• If used in combination with a cloud solution, does the cloud solution have an independent security assessment?
• Does the solution require access to our internal network?
• What are our responsibilities in managing the solution to keep it secure?
• What other safeguards does the solution use to protect the integrity of data?

These questions are not a barrier to using new technology, they help identify potential issues and give management the information needed to make an informed decision. These same questions should be addressed for every critical system or solution in the environment. The risk assessment process should be applied at the information system as well as the organization level.

Additional technical reviews, configuration review, tracking and testing can be worked into the approach as well. The questions above are the just the first step in identifying threats and risks for ELD solutions.

Please contact the RubinBrown Cyber Security team for more information about ELDs or other security concerns.

^{Readers should not act upon information presented without individual professional consultation.}

^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}