Computers on Wheels: Complaint Against Auto Manufacturer For Allegedly Botched Software Update Survives (For Now)

A federal court in Georgia recently denied a motion to dismiss filed by an auto manufacturer seeking to avoid a putative class action lawsuit filed by an owner who claimed that an allegedly botched over-the-air (OTA) software update sent in May 2020 bricked the communications device that drove the “infotainment” system and other electronic components installed in his 2011 Porsche Panamera, causing the device to enter “a near-continuous reboot cycle” that damaged equipment and drained the vehicle’s battery. The decision appears to be the first time a court has considered the application of the Computer Fraud and Abuse Act (“CFAA”) to vehicle-installed computers.

In Bowen v. Porsche Cars N.A., Inc., a case filed in the U.S. District Court for the Northern District of Georgia in January 2021, the vehicle owner claimed that a signal transmitted by Sirius XM Radio and “facilitated” by Porsche during a 2020 Memorial Day weekend promotional campaign caused a major malfunction in the Porsche Communications Management (PCM) unit of his and “many” other Porsche vehicles. The vehicle owner asserted claims for (1) violation of the CFAA, (2) trespass to personalty, (3) negligence, and (4) unjust enrichment. Porsche filed a Rule 12(b)(6) motion to dismiss, arguing that the complaint did not state a claim against the manufacturer because, among other things, it did not allege that Porsche (as opposed to Sirius) actually intended to transmit anything to the vehicle.

In a September 20, 2021 order, the federal court granted Porsche’s motion to dismiss the claims for negligence and unjust enrichment, but found that Porsche must answer the vehicle owner’s claims for violation of the CFAA and trespass to personalty. Porsche had argued in its motion to dismiss that the vehicle owner’s CFAA claim failed because (1) the vehicle owner did not sufficiently alleged that Porsche intended to access the vehicle’s PCM, (2) any alleged access was authorized because the vehicle owner consented to receiving satellite radio transmissions, and (3) the vehicle owner failed to allege damages sufficient to meet the $5,000 threshold for CFAA claims. But the court found that “[t]he intent element under the CFAA requires merely that access to a computer system not be a careless or inadvertent mistake,” and that the vehicle owner’s allegation that Porsche “intentionally accessed” the PCMs by “either directly sending or facilitating the transmittal” of an OTA update was sufficient to satisfy the minimal burden to avoid dismissal under Fed. R. Civ. P. 12(b)(6).

The court also rejected Porsche’s argument that the vehicle owner had tacitly consented to receive software updates that modify the vehicle’s PCM by buying a vehicle with an antenna that receives Sirius satellite radio transmissions. The court found that in order to find such consent it would have to consider evidence not yet produced in the case. And, the court said, even if it “could determine from the alleged facts that [the owner’s] purchase of a vehicle with a satellite antenna constitutes consent to receive satellite transmissions in general, Porsche’s argument that such consent extends to software updates to his PCM is beyond the scope of the Court’s inquiry at this stage of the litigation. The court likewise held that the vehicle owner had sufficiently pled in excess of $5,000 in economic damages, both in his own capacity and on behalf of the putative class, and that whether the vehicle owner could ultimately prove these allegations was an issue of fact to be resolved at a later stage in the proceeding. Finally, the court denied Porsche’s motion to dismiss the vehicle owner’s claim for trespass to personalty, finding that “[c]ourts applying Georgia law have found that ‘digital trespass’ can sustain a claim for trespass upon one’s personal belongings.”

Although the court denied the motion to dismiss the CFAA and trespass to personalty claims, it recognized that there are significant factual disputes as to whether Porsche engaged in any conduct at all, much less conduct that violated the CFAA or constituted a tort. Porsche promised in its moving papers that if any portion of the case survived its motion to dismiss, the manufacturer “would introduce evidence demonstrating that it did not and cannot update PCMs remotely as alleged.” While it may be difficult to avoid these sorts of lawsuits given the liberal pleading standard for civil complaints, car manufacturers should review their processes to ensure that they are taking appropriate steps to protect themselves as much as possible from claims like those asserted in these cases.