Morning Read: A Lawsuit Against Uber Highlights the Rush to Conquer Driverless Cars

Welcome to the Morning Read, a daily post where I recommend and discuss a white paper, blog post, chapter of a book, or some sort of text I find useful for DFIR analysts.

Today’s morning read is part 2 of a one-two punch Uber is receiving related to their autonomous vehicles. Here’s a copy of the article over at the New York Times (“NYT”):


I don’t want to create a streak of picking on Uber; I’ve ceased my personal business with the company. However, there is a lot going on concerning digital forensics at the moment, and it’s worth trying to find lessons in the events that are taking place.

The article begins by discussing a recent case where an autonomous Uber vehicle ran a red light in front of San Francisco’s MOMA. A video of this event is provided below — I’d suggest watching it:

Uber claims that the running of the red light occurred during human control, not computer. The company even lauded the event as a reason why they needed to continue autonomous development — to build safer roads. Oh, the irony.

As it turns out, a couple of Uber employees came forward under anonymity and provided documents showing the car was driving itself. NYT reviewed these documents and found a total of six red lights were not recognized by the car.


I will not get into the debate of the legitimacy of this story. Instead, I’ll focus on some of the DFIR takeaways.

  • Car forensics is getting closer. I can’t put a particular ETA on this, but vehicle forensics are getting closer and closer. As the world of self-driving vehicles comes closer, DFIR analysts are going to need to start understanding systems just like this.
  • Humans aren’t immune to these systems. In the linked video, a pedestrian is entering the crosswalk as the car runs the red light. If the worst were to happen, digital forensics may become the key to getting justice or awarding damages.
  • Third-party analysis is going to be crucial. Right now, self-driving vehicles fall under R&D for companies working on the technology. As a result, the data also sits with the company. Note that the article discuss internal Uber reports that showed the correct findings, but the press release said something else. Just like most DFIR engagements, third-parties are going to be essential in interpreting the data correctly.

Suggestions for Analysts

I can’t publish something that says we should go out and study car forensics — it’s simply not feasible at this point. What I will say instead is that, as DFIR analysts, we must be ready and willing to embrace new technologies as they appear. Remember, there was a period of time when receiving a cell phone for forensics was extremely rare — now, there’s an entire career of it (and a fantastic SANS course, if I may say). It’s only a matter of time before these other technologies, especially those capable of taking lives, become more “normal” as well.

Additionally, as I mentioned above, right now these systems are proprietary to the companies developing them. Unlike Windows or Mac, DFIR can’t just go buy a copy of the OS and start testing it to understand forensic implications. We have to take the data as we can get it, and work together to make sure we understand what the evidence is saying.

Until tomorrow.