Will Quebec’s Class Action Lawsuit Force Automakers to Get Serious About Car Theft?

There’s almost always a cost for convenience when it comes to cars. That adaptive cruise control system that makes dealing with stop-and-go traffic effortless relies on an array of body-mounted sensors that can transform even the lightest fender bender into an expensive repair job. Big touchscreen infotainment systems can turn your car into a brick if they fail, rendering most vehicle features inaccessible behind a black wall of plastic.

And that key fob you carry in your purse or pocket? The one that lets you walk up to the door handle of your daily driver and unlock it without having to push a button? According to a new class action lawsuit recently approved in Quebec, it gives would-be thieves an easy way to make off with your vehicle. On top of that, the legal action asserts that automakers — 13 in all, covering most major brands operating in Canada — were all too aware of the weaknesses in keyless fob technology and yet did nothing to protect owners from theft.

The Second-Oldest Profession

Let’s be clear: keyless fobs didn’t invent car theft, a profession that can trace its roots back more than a hundred years to the era before internal combustion, when outlaws stole horses, not horsepower.

In fact, for much of the first 80 or so years of the automobile, theft protection relied on little more than traditional key locks that were easily defeated by tools as simple as a slim piece of metal stuffed between the window and the door skin, and then a screwdriver and a deft rewiring job under the dashboard. Owners had to turn to the aftermarket for anti-theft devices like removable steering wheels, The Club, and even alarms and ignition kill switches to try to stay one step ahead of thieves.

It wasn’t until the 1990s that automaker apathy began to evaporate, as technologies like laser-cut keys (much more difficult to copy) and vehicle immobilizers became common. Soon, keys were incorporating radio-frequency identification (RFID) technology that further identified them as legitimate to the vehicle’s ignition system, sending signals to the car’s electronic control unit (ECU) that it was OK to fire up the engine.

A Technological Arms Race

As vehicle security improved, so did the tools that car thieves used to defeat it. Adding fuel to the fire was the growing demand for convenience from customers, which led to the debut of keyless entry. Early applications relied on fobs with buttons that had to be physically pressed to either lock or unlock a car’s doors, but eventually, proximity sensors were added into the mix that fully automated the radio handshake, right up until the point of pushing the start button in the cockpit. Today, mobile apps can connect vehicles to a digital network that makes remote locking, unlocking, and even starting up as easy as having a phone in your pocket.

Every one of these features represents a foothold for tech-savvy thieves eager to probe for weaknesses. Attacks on vehicle security became increasingly sophisticated, in many ways mirroring the endless battle between software companies and hackers intent on accessing the ones and zeros that tie our Internet-enabled world together. 

Thieves developed devices that could capture the unlock codes sent between a key fob sitting on a kitchen counter and a parked vehicle in the driveway, amplifying it and relaying it to someone waiting beside the door ready to open it. Once inside, the vehicle’s software is reprogrammed to accept a new key that is then used by the perpetrators to drive off into the night. Some attacks rely instead on physical access to the vehicle’s electrical system, pulling headlights from their plugs to recode the vehicle from the outside using something called a CAN injection.

A Code Of Silence Surrounding Fob Security

As advanced as anti-theft technology might seem today, the dollar value attached to car theft continues to rise: in 1996, Canada’s stolen vehicles represented $1.1 billion in losses, adjusted for today’s dollars. By 2023, that amount had climbed to $1.5 billion.

The main drivers behind Quebec’s class action lawsuit claim that automakers haven’t been keeping up their side of the arms race against thieves, and that this led directly to the undeniable increase in the number of vehicles stolen during the pandemic. There has been little communication with owners about the security risks surrounding keyless fobs, plaintiffs say, which has prevented them from taking steps to better protect their cars and trucks from being stolen. On top of that, the lawsuit describes keyless fob technology as a “design flaw” in vehicle security.

Will Anything Change?

Are cars more vulnerable to thieves because of keyless fobs? Any access point on an automobile presents an invitation to would-be thieves, whether that’s a window that’s easily broken, a door that’s jimmied open, or an ignition switch that’s brute-forced into starting up. In that sense, yes, keyless entry and ignition present one more avenue that criminals can exploit to gain access to your daily driver.

It’s clear that automotive security is a constantly evolving environment. With keyless entry being an established feature on almost every modern model, automakers need to keep pace with the technologies arrayed against them in their quest to keep their customers’ cars from disappearing into cargo containers and chop shops. The success of the Quebec lawsuit hangs on the need to prove that car companies were aware of the attacks on vehicle security that fobs made possible, but took no action to protect owners.

We may be entering a world where major manufacturers need a team of full-time security experts pushing zero-day software updates over-the-air to owners in response to newly emerging theft threats, emulating what IT departments all over the world have been doing for decades. Even then, there will be millions of autos left behind, vehicles that were built before updatable technology was in the design spec.

The outcome of the Quebec class action lawsuit will likely play a role in determining how serious car companies become about fortifying keyless entry protections in Canada. The plaintiffs are demanding a payout of $1,500 for anyone who owns a vehicle that uses this technology, an enormous slice of the market that brings with it financial repercussions that automakers won’t be able to ignore. Then again, with thefts slowing down in Canada after their pandemic-related boil-over, there’s no guarantee that the legal move will succeed in doing anything other than raising awareness of the vulnerabilities that keyless fobs present in modern autos.