City councils push recall of Kias and Hyundais as thefts still surge — will it make a difference?

CATHY WURZER: The thefts of Kias and Hyundais have not slowed down since they became a problem during the pandemic. In Minneapolis, Police tallied 2,378 Kia and Hyundai thefts in 2022, which was an 836% increase. In 2023, the number is still rising-- nearly doubling to 4,085 as of November.

Some of those vehicles have been stolen multiple times. The automakers have offered software updates, and local departments have offered steering wheel locks. But that hasn't seemed to prevent thefts. Joining us right now to explain where car owners and city officials can go from here is Michael Brooks. He's the Executive Director for the Center for Auto Safety. That's the national consumer advocacy organization. Michael, welcome to the program.

MICHAEL BROOKS: Thanks, Cathy. Happy to be here.

CATHY WURZER: Remind folks why are certain models of kias and hyundais so easy to steal.

MICHAEL BROOKS: So these vehicles were built without the immobilizer, which is, essentially, a piece of the vehicle that prevents the car from being started if you don't have the actual key to the car. There's an electrical signal that's cut off by a radio signal if you don't have your key in the ignition at the time you're trying to turn it on. And that allows anyone to break into these Kia and Hyundai vehicles, and rip away the steering column, and insert a USB cable and start the vehicle without a key present.

CATHY WURZER: This would seem to be a big problem. Why hasn't Kia and Hyundai issued their own recalls?

MICHAEL BROOKS: Well, they're relying on the fact that the National Highway Traffic Safety Administration hasn't really pressed them to do a safety recall. Somehow, even though we've seen at least 40 deaths related to the situation and well over 100 injuries, and primarily to adolescents-- we see a lot of adolescents wrapped up in this-- they don't believe it's a safety issue. And that's, essentially, because the law says that if there's been any intervening criminal act or damage to the vehicle caused by a criminal, that the company is, essentially, absolved of its recall authority.

CATHY WURZER: OK. So what would it take for NHTSA to issue a recall?

MICHAEL BROOKS: Well, NHTSA would have to make a finding that there was a defect present in these vehicles that was unsafe-- it was a defect related to motor vehicle safety. For us, that's not that big of a deal. I think it's fairly obvious that there's a problem here. But the reason that they're not able to do that is because NHTSA itself had in place a regulation that allowed for vehicles to be built without immobilizers.

And so they played a pretty big role in the problem here by not forcing manufacturers to upgrade their vehicle security. We've seen this develop when installing an extra part like an immobilizer is going to cost the manufacturer money. And Kia and Hyundai, unfortunately, chose the cheaper option of not installing them. And that's why we're seeing this problem across America.

CATHY WURZER: This seems like a mess. Of course, we talked about this the software security upgrades that they've offered. Are they worth anything? And how many people have gotten that security upgrade?

MICHAEL BROOKS: They are worth something. They do appear to be working in many circumstances. The one major drawback here and why this recall would really help out is that we don't really know at any one point just how many people have gotten this into their vehicles, have gotten this software update.

At last look, it was around 20% to 30%. Maybe it's still a little higher than that. But still, if you're looking for a vehicle to steal, you've still got, say, a 2 out of 3 chance, if you approach a Hyundai or Kia, that it's not going to have that software update installed. So until that number becomes much higher and discourages criminals from targeting these vehicles, we don't think we're going to see a lot of better outcomes here. We think that a recall is necessary to get this issue in front of consumers and to ensure that they know that it's really important that they get in their dealer to fix the problem.

CATHY WURZER: I would think that, given the magnitude of the problem, insurance companies would be on the hook for paying for damage for many of these cars. Are they putting pressure on officials?

MICHAEL BROOKS: Yes. And, in fact, they've been certainly put pressure on Kia and Hyundai last year. A number of insurers refused to continue covering Hyundais and Kias that didn't have these immobilizers. And that really spurned Hyundai and Kia, who at that point had been doing very little to actually put out the software fix that is now having some success and some effect.

But we think more needs to be done. And I think the key to all of this is the National Highway Traffic Safety Administration, which is what the city council is trying to address, saying, hey, NHTSA, you need to get off your duff and do something about this before more people are killed.

CATHY WURZER: Does it help to have, say, Minnesota's Attorney General Keith Ellison launching a probe to determine if they violated state consumer protection and public nuisance laws? Does that help at all?

MICHAEL BROOKS: Yeah. I think any form of pressure that can be applied is helpful here. Anything that can either get the software update to be rolled out more effectively to more consumers to get the word out to more people to get it to get the software update-- almost anything that is done that gets the word out and also that presses authorities to, perhaps, deem this a recall, that would really, really go a long way towards getting the information to everyone that owns a Hyundai and Kia vehicle, and letting them know that they have a fix that's available that they should be taking advantage of.

CATHY WURZER: I even hate to bring this up, but we're talking about an immobilizer. And cars are so smart nowadays and getting smarter bunches of high tech technology in them-- I'm wondering if there's something else that's out there that could pose a problem, other security risks we don't even see at this point.

MICHAEL BROOKS: Well, this is a huge concern for us about this whole situation is that we've got phones now that if someone steals your phone, it's going to be useless to them because of a simple pin code. And yet, there are 6,000-pound vehicles sitting around waiting to be cracked open at a moment's notice and easily driven down the road by a 12-year-old. So it definitely points out that there is a problem in securing vehicles.

And this is a broader concern for us, because NHTSA has the authority to put in place cybersecurity regulations that can protect the entire vehicle from these type of intrusions. But the agency hasn't moved on that. And so as we move forward into an era where there's news coming out today about China, and cybersecurity, and their ability to hack into American infrastructure-- well, this is the American transportation infrastructure that is, essentially, being left wide open for those types of attacks, and primarily because the agency that's in charge of regulating the process seems to believe that an intervening criminal act absolves them of any authority to take care of the problem.

Here, it's 12-year-old, 13-year-old people taking joy rides. But if it's a state actor in the future committing criminal acts to hack into vehicles and cause another type of mayhem, how is the agency then going to be able to step up and take care of that problem if they don't believe they have the authority here? So it's a very big concern of ours, and we really believe that cybersecurity regulations are needed to ensure that there's a safe future, both for Hyundai and Kia vehicles and their owners, as well as the broader transportation ecosystem.

CATHY WURZER: All right. Interesting story. Thank you, Michael.

MICHAEL BROOKS: You're welcome. Thank you for having me.

CATHY WURZER: Michael Brooks has been with us. He's the Executive Director for the Center for Auto Safety.