CLASS-8 Semi-Tractor and School BUS defect petition DP21005
SAE J1939 Data Bus Vulnerability. NHTSA’s Office of Defects Investigation opened this defect petition about the cybersecurity on 2 model years (2001–2006). Opened Dec 23, 2021, closed Feb 7, 2022 after 2 months without a recall. closed
What NHTSA says
Source: Office of Defects Investigation, as filedIn a letter dated September 27, 2021, Mr. James Lamb, Executive Director of the Small Business in Transportation Coalition (SBTC), petitioned the National Highway Traffic Safety Administration (NHTSA), requesting the initiation of a defect investigation into the potential hacking susceptibility of the Society of Automotive Engineers (SAE) J1939 Data Bus standard. SAE J1939 is the vehicle bus recommended practice used for communication and diagnostics among vehicle components. In support of the petition, the petitioner cited a study from University of Michigan (Michigan) researchers alleging a SAE J1939 Data Bus vulnerability in a Model Year (MY) 2001 school bus and a MY 2006 Class-8 semi-tractor. The study alleges that, due to the vulnerability, vehicle critical safety functions such as the accelerator control or braking systems are susceptible to unauthorized access and control and increases risk to motor vehicle safety. On December 23, 2021, the Office of Defects Investigation (ODI) opened DP21-005 to evaluate the petitioner's request. The petitioner did not specify the make and model of the vehicles with the alleged safety defect. The only categories of relevant vehicles specified were found in the study: MY 2001 school buses and MY 2006 Class-8 semi-tractors. ODI has not received any complaints of any type related to this alleged vulnerability (The single complaint identified above is the petition.). This evaluation included searches of complaints from vehicle owners, operators, and fleet supervisors. Further, based on the available information, ODI has not found any similar events/complaints/allegations suggesting a real-life vulnerability. The vehicle compromises reported in the Michigan study required physical access to the J1939 connector in order to affect vehicle critical safety functions such as the accelerator control or braking systems. Whether there is a potential for remote compromise is a factor that NHTSA has considered in evaluating the likelihood or frequency of a potential safety defect. The Michigan study did not demonstrate a remote compromise of these vehicles. In addition, based on the age of the subject model year school buses and semi-tractors, they do not have over-the-air software update capabilities/internet connection to make remote compromise possible. Therefore, given a thorough analysis of the potential for finding a safety-related defect in the subject vehicles, and in view of NHTSA?s enforcement priorities, a defects investigation is unlikely to result in a finding that a defect related to motor vehicle safety exists. NHTSA is authorized to issue an order requiring notification and remedy of a defect if the Agency's investigation shows a defect in the design, construction, or performance of a motor vehicle that presents an unreasonable risk to safety (49 U.S.C. ?? 30102(a)(9), 30118).Given the absence of any similar events/incidents related to this matter and lack of demonstrated potential for remote compromise, it is unlikely that an order concerning the notification and remedy of a safety-related defect would be issued due to any investigation opened as a result of granting this petition. Therefore, upon full consideration of the information presented in the petition, and the potential risks to safety, the petition is denied. The denial of this petition does not foreclose the Agency from taking further action if warranted, or the potential for a future finding that a safety-related defect exists based upon additional information the Agency may receive. A notice of denial of this petition will be published in the Federal Register.
A Defect Petition is a petition from a member of the public asking NHTSA to open a defect investigation; the agency grants or denies it and publishes the reasons. The summary is the agency’s own text from its investigation file, unedited; the opening and closing resumes with the full reasoning are on NHTSA’s site under this number.
What this means for an owner
Source: and what happens nextAn investigation is not a finding that a defect exists, and it puts no duty on anyone. NHTSA opens a Preliminary Evaluation when complaints and other reports suggest a condition worth asking the manufacturer about; it upgrades to an Engineering Analysis when the answers warrant testing; it closes either when it recommends a recall, when the manufacturer recalls on its own, or when no defect trend is found. The agency’s own goals are about four months for a petition, eight for a Preliminary Evaluation or a Recall Query and eighteen for an Engineering Analysis; many run longer.
This one closed without a recall. That means NHTSA found no defect trend it chose to act on at the time, or the manufacturer addressed the condition another way (a service campaign or a bulletin, which have their own pages). A closed file can be reopened if new reports arrive.
Model years it names
Source: as NHTSA filed themAlso named: 2006 CLASS-8 Semi-Tractor CLASS-8 Semi-Tractor; 2001 School BUS School BUS.
A vehicle page’s investigation list carries the same action; a name here is the scope NHTSA opened, not a list of affected VINs.
Common questions
Source: NHTSA Office of Defects InvestigationIs DP21005 a recall?
No. A defect petition is NHTSA asking questions, not a recall. A safety recall carries an NHTSA campaign number and a duty to repair for free; this one closed without one. Whether one particular vehicle has an open recall is a VIN question at nhtsa.gov/recalls.
Is DP21005 still open?
No. It closed on Feb 7, 2022 without a recall.
Which vehicles does DP21005 cover?
NHTSA opened it on 2 model years: 2006 CLASS-8 Semi-Tractor CLASS-8 Semi-Tractor, 2001 School BUS School BUS. That is the scope of the inquiry, not a list of affected vehicles; a recall, if one follows, defines its own population by VIN.