October 17, 2023
On April 27, Safety Research & Strategies petitioned the National Highway Traffic Safety Administration for rulemaking to revise the compliance test for FMVSS 114, Theft Protection and Rollaway Prevention. The request was prompted by the rising crashes, deaths and injuries linked to Hyundai/Kia vehicles with inadequate theft protection, and by NHTSA’s reluctance to take any enforcement action.
The tsunami of thefts began in 2021, when car thieves in Milwaukee learned to take advantage of a vulnerability in MY 2010-2021 Hyundai and Kia vehicles with traditional metal keys. The numbers began to jump that July when a video posted to TikTok demonstrated how to exploit the lack of meaningful theft-prevention features in Hyundai/Kia vehicles by evading the rudimentary burglar alarm, removing the plastic steering column shroud to access the ignition cylinder and with household items and no technical skill, start the engine and drive off. The how-to video quickly went viral, with mainly teenaged thieves posting their exploits under the hashtag “Kia Boys.”
At the time, The Safety Record provided its readers with the regulatory history of FMVSS 114, from the standard’s origins and intent to the changes that were meant to address the evolution of automotive technology, but have rendered the standard so ineffective, that it no longer acts as a safeguard against theft or rollaway.
Today, SRS amended its petition with updated crash and harm numbers, to stress the importance of revising the current compliance test from one that is nearly impossible to fail, to one that reasonably assesses whether the system in place deters casual thieves. The data also support the need for an effective recall, not simply a “customer satisfaction” campaign, because it’s increasingly clear these vehicles contain a defect that represents an unreasonable risk to motor vehicle safety.
Citing the limitations of FMVSS 114, NHTSA has continued to resist calls from state and municipal government officials to force Hyundai and Kia to recall nearly 9 million 2011 to 2022 models with inadequate theft prevention features for failing to comply with the standard.
(Korean-based manufacturers Kia Corp. and Hyundai Motor Corp. are affiliates of Hyundai Motor Group. Both companies are involved in the joint design and development of vehicles sold globally under their respective brands. Hyundai Motor Co. owns 33.88 percent of Kia Corp., making it the largest investor in the company.)
Hyundai and Kia have instead issued customer satisfaction campaigns that include updated software for some affected models and aftermarket steering wheel locks for others, in attempt to quell the theft epidemic that’s largely been driven by kids. The new software updates the theft alarm logic to extend the alarm sound from 30 seconds to one minute, and requires the key to be in the ignition switch to turn the vehicle on. With the new software, locking the doors with the key fob sets the factory alarm and activates an “ignition kill” feature which customers have to use the key fob to unlock their vehicles to deactivate. Hyundai/Kia also offered window stickers announcing the presence of anti-theft software. Owners of vehicles ineligible for the software fix got a reimbursement for a steering wheel lock.
Previously, in vehicles equipped with a burglar alarm, the system would only prevent an engine start if the burglar alarm was activated – a major design oversight. These updates disallow an engine start when bypassing the ignition lock cylinder, and rotating the ignition switch, but they only work when the burglar alarm is armed, meaning that the doors are locked using the key fob or the key in the driver’s door. However, if the alarm was never triggered (because entry was gained via the broken window – the way many of these thieves have operated), the vehicle could still be started, and the ignition kill feature would not be activated, even though the alarm was still armed.
Perhaps this is a reason why those “fixes” have not done nearly enough to halt the utter chaos caused by the combination of a TikTok video, showing budding car thieves just how quick and easy is it to steal a Hyundai or a Kia, with a minute and a USB cable, and two automakers who eschewed immobilizers. According to the Highway Loss Data Institute, while 96 percent of automakers had immobilizers as standard equipment in MY 2015 vehicles, only 26 percent of Hyundai/Kias were so equipped.
During the last two years, the vulnerabilities of Hyundai/Kia vehicles without immobilizers have caused an astonishing number of thefts, crashes, injuries and deaths, along with other violent crimes – carjackings, homicides, and burglaries (ramming a car into a storefront to break in), to name a few, committed in a stolen Hyundai or Kia. Some of these incidents involve drivers who are too young to get a driver’s license. For example, in July 2022, two 14-year-olds in Columbus, Ohio died, and a third was injured, when they crashed a stolen Sonata into a warehouse, ejecting two occupants and trapping a third inside the vehicle. A year later in Orlando, Florida, a 15-year-old driver ran a red light at high speed, striking an SUV and killing a 23-year-old man. The stolen Santa Fe had five passengers: ages 16, 15, 14, and 13 years.
“Unfortunately, this incident – with a very young, inexperienced driver crashing a stolen Hyundai/Kia vehicle, causing deaths and injuries – has become all too common,” says Attorney Frank Melton of the Florida firm Newsome Melton, who is preparing to file a case in the Orlando incident. “The automaker has a responsibility to ensure that kids who have no technical training and aren’t even eligible for drivers licenses can’t breach the vehicle’s anti-theft features in less than two minutes – and NHTSA should use its statutory enforcement tools to hold automakers to that obligation. In the absence of either, accountability will move to the courts, as the damage continues.”
In May, a 12-year-old and 13-year-old in Hamden, Connecticut were arrested after crashing two different stolen vehicles.
The total number of crashes, injuries and deaths, is, as yet, unknown. No single entity appears to be officially tracking them; news reports are the current source. On February 14, when NHTSA announced the launch of the campaign, it linked these thefts to at least 14 reported crashes and eight fatalities. That was already an undercount. By then, the media had written about 42 crashes, 27 injuries, and 21 deaths, from June 2021, when a 16-year-old boy from Milwaukee in a stolen Kia Sportage died after a police chase and head-on crash with an SUV, which left five occupants seriously injured, to February 12, 2023, when three 13-year-old boys were arrested after allegedly stealing a Kia and crashing into another car, killing a 71-year-old man.
Since then, the news media reported another 90 such crashes, resulting in 23 more deaths (including a six-month-old boy, a four-year-old boy, and a 14-year-old driver), 99 injuries, some of which were said to be serious injuries, and one house fire. In addition, these thefts have caused structure damage and other vehicle damage, including seven police cruisers, a fire engine and a school bus, caused by, often youthful, drivers of stolen Hyundai/Kia vehicles. In total, using new stories as the sole source, from June 2021 through October 12, we identified 132 crashes, 44 deaths and 126 injuries. Again, this is likely an incomplete accounting.
The theft rates have been through the roof – in many cities disproportionately higher in the Hyundai/Kias that lack immobilizers than in any other competitors’ models. In April, California Attorney General Rob Bonta and 16 of his counterparts across the nation sent a letter to Acting NHTSA Administrator Anne Carlson asking NHTSA to compel a recall of MY 2011-2022 Hyundai and Kia vehicles without immobilizers. The letter stated:
For example, in Los Angeles, thefts of Hyundais and Kias increased by approximately 85% in 2022, and made up almost three quarters of the entire increase in stolen cars of any make and model in the city. 7 Hyundais and Kias also constituted approximately 20% of stolen cars in Los Angeles in 2022, up from 13% in 2021. Similarly, in Berkeley, California, thefts of these cars have made up 38% of vehicle thefts since the end of 2022. California cities’ data is consistent with data from other states. For instance, in Minneapolis and St. Paul, Minnesota, thefts of Hyundais and Kias increased 836% and 611%, respectively, in 2022. In Columbus, Ohio, Hyundais and Kias constituted nearly 45% of stolen cars in 2022, in Milwaukee, 58%, and in Minneapolis, 33%.
Data from a July civil complaint filed by the 17 cities in seven states against Hyundai/Kia in a California federal court, contains a city-by-city account of the precipitous and continuing rise of thefts, crashes, injuries, death and crimes associated with Hyundai/Kia thefts. For example, Madison Wisconsin reported that between 2021 and 2022, thefts of Kia vehicles rose by 124 percent; in the summer of 2022, thefts of Kia and Hyundai automobiles increased by 270 percent, accounting for more than half of the auto thefts there.
Atty. General Bonta noted that the Hyundai Kia vehicles with inadequate theft protection violated the requirements of FMVSS 114:
Specifically, FMVSS Number 114, S5.1 requires vehicles to have “a starting system which, whenever the key is removed from the starting system prevents: (a) [t]he normal activation of the vehicle’s engine or motor; and (b) [e]ither steering, or forward self-mobility, of the vehicle, or both.”
The rampant theft of Hyundai and Kia vehicles makes clear that these vehicles’ starting systems do not prevent engine activation, steering, or forward self-mobility when the key is removed from the starting system. Indeed, because the vehicles have easily bypassed ignition switches, a screwdriver and USB cable are sufficient to start and drive off with the cars in a matter of seconds or minutes—no key required. Such starting systems do not meet FMVSS Number 114’s requirements. The lack of engine immobilizers in these vehicles, which could have provided a second line of defense against theft, has compounded and exacerbated this problem.
Additionally, these Hyundai and Kia vehicles’ vulnerability to theft constitutes a defect posing an unreasonable risk to safety, providing NHTSA with an independent basis to order a recall. Even young teenagers are able to access the ignition system and drive off in these vehicles
And, just as The Safety Record pointed out right after the fix was announced, Atty General Bonta noted that a customer satisfaction program allows the automakers to bypass the notice and accountability requirements of a formal recall. The Attorneys General complained that such a program would roll out too slowly and reach too few.
In a June letter, Cem Hatipoglu, NHTSA’s acting associate director for enforcement, responded to Bonta and the other AGs, saying that NHTSA wasn’t inclined to take any action other than monitoring the situation. He wrote:
At this time, NHTSA has not determined that this issue constitutes either a safety defect or noncompliance requiring a recall under the National Traffic and Motor Vehicle Safety Act, 49 U.S.C. Chapter 301. The Federal Motor Vehicle Safety Standard identified in your letter, FMVSS No. 114, does not require an engine immobilizer. See 49 C.F.R. § 571.114. Also, the test procedure specified in that standard does not contemplate actions taken by criminal actors to break open or remove part of the steering column and take out the ignition lock to start a vehicle. [Emphasis added.]See id. § 571.114, S6. Here, the safety risk arises from unsafe use of a motor vehicle by an unauthorized person after taking significant destructive actions to parts of the vehicle.
Hatipoglu’s assertion that the compliance test doesn’t address hotwiring is technically true, but NHTSA absolutely did consider that very reality in promulgating the standard, and in a 2004 interpretation letter from then-NHTSA Chief Counsel Jacqueline Glassman noted that in a response to an unidentified automaker requesting guidance on its engine immobilizer and the requirements of FMVSS 114. Glassman agreed that the system the automaker described would be compliant with FMVSS 114 because if an attempt was made to circumvent the ignition lock, including through “hot-wiring,” the immobilizer prevented engine starting without the key.
The current compliance test basically allows the tester to sit in the vehicle without the physical key or key fob, and try to start it. Pretty impossible to fail. Immobilizers are optional, but automakers that install them must pass specific and more rigorous test requirements, based on the standard in Canada, where immobilizers are required.
According to 49 CFR Part 552.8 .8 Notification of agency action on the petition, NHTSA was supposed to get back to us by the end of August:
After considering the technical review conducted under § 552.6, and taking into account appropriate factors, which may include, among others, allocation of agency resources, agency priorities and the likelihood of success in litigation which might arise from the order, the Administrator will grant or deny the petition. NHTSA will notify the petitioner of the decision to grant or deny the petition within 120 days after its receipt of the petition.
As vehicles become more complex, the need for strong NHTSA leadership and adequate resources becomes more urgent. And yet, the agency has long been stymied by the lack of a confirmed administrator with enough tenure to provide it. From April 2017 to May 2022, NHTSA has been run by a series of short-term acting administrators. The last administrator, Steven Cliff, was nominated by President Biden in January 2021, but not confirmed by the U.S. Senate until May 2022. He left in August 2022 for the California Air Resources Board. Biden nominated the current Acting Administrator Ann Carlson on February 13, but was forced to withdraw it in May, after Republicans opposed her green initiatives, such as rigorous fuel efficiency requirements.
It is difficult for a public health agency, with a safety mission as critical as NHTSA’s, to fulfill it while rudderless. The ongoing Hyundai-Kia debacle is but one result.