|
|
The Truth About Transponders Robert F. Mangine
History With the demise of the former Soviet Union in the mid-eighties,
the Russian and former Soviet Bloc black market demands for European vehicles increased dramatically. Under
increasing pressure from the German insurance industry, the application of transponder technology for automotive purposes
was developed. In 1995, BMW transponder equipped vehicles were the first to be introduced in the U.S. Domestically
manufactured vehicles began using limited transponder technology in 1996 with the certain Japanese transponder equipped cars
first arriving in the U.S. in 1997. The availability of the transponder systems in new vehicles has increased
rapidly over the past decade. There are only two OEM immobilizer type systems in use today, the transponder system and the
Passlock System (exclusive to GM vehicles), with variants of the transponder system for vehicle electronic protection currently
being the most prevalent anti-theft system employed worldwide.
Modern automotive security consists of two separate and distinct layers. One is physical protection and includes the ignition lock, steering column locking mechanism, gear selector lock, and protected electrical starter (ignition) switch. The second autonomous layer of protection is electronic, which includes the engine immobilizer (transponder system). One layer of protection has absolutely no relative connection with the other. In order to start and operate the vehicle without the properly cut mechanical key containing the vehicle specific transponder, both the physical protection and the electronic protection must be defeated or compromised separately and independently of one another. No longer can a thief use tools combined
with force to only defeat the physical protection. Now, the electronic protection must also be compromised
or by-passed which requires knowledge, skill and expensive specialized equipment. Not even a sledge hammer
would serve a useful purpose when coping with the vehicle electronic protection.
One of the most significant features of the transponder system is the micro-transponder (transmitter-responder) that is embedded in the head of the ignition key. This allows a vital component of the electronic system to be removed from the vehicle by the driver along with the mechanical ignition key. The vehicle on-board components include a ring antenna (also known as an induction coil) located around the outer ignition lock, a transceiver (transmitter-receiver) adjacent to the ring antenna, and, depending on manufacturer, a Body Control Module (BCM) or Electronic Control Module (ECM), usually located in the interior dashboard. When the ignition key is inserted in the ignition lock keyway and rotated, the vehicle electronics and systems are energized. A signal is then sent through the transceiver and to the ring antenna. This signal is broadcast from the ring antenna to the transponder embedded in the head of the key. The key mounted transponder has no battery or independent power source and the transponder is energized by the electromagnetic field from the ring antenna. The transponder will then send a return signal back to the ring antenna which is processed through the system. What is essentially occurring is a by-directional radio frequency communication between the ignition key and steering column. If the vehicle systems are energized, and no vehicle specific properly programmed transponder is present, the signal being broadcast by the column mounted ring antenna will receive no reply. This will result in vehicle engine functions being disabled. The transponder system is considered a passive
engine immobilizer system and requires no specific action on the part of the driver, other than key insertion and rotation
to energize the vehicle. Compromise of the Transponder System The basic working premise regarding any type of vehicle protection is that anything one person designs, another person will determine how to compromise it given sufficient time, knowledge, skill and equipment. This pertains not only to electronic anti-theft systems, but ignition locks/column assemblies as well. It is equally important to remember there are specific procedures that must be followed and detectible damage that will occur when defeating or compromising the physical components. In the late nineties one domestic transponder system could be compromised through the power distribution center (fuse/relay box) using a series of jumper wires. This procedure would take 45 minutes or longer. One Japanese transponder system could be compromised by changing the vehicle ECM. By the early 2000’s this type of compromise of those selected systems was no longer effective. And, although there were these weaknesses in certain early systems, compromise of the transponder system (electronic protection) alone would not allow the vehicle to be driven. Defeat of the ignition lock/steering column (physical protection) was also required, had to be accomplished separately and would result in physical detectable damage to the parts. Improved electronics began to appear between 2001 and 2003. To now compromise the systems a specialized Scan Tool (hand held computer) was needed in order to program a new key to the system. These professional locksmith tools, including vehicle specific software, can be obtained at a cost of $4,000 to $6,000 from locksmith supply stores. A new, vehicle specific transponder key must also be obtained. After the Scan Tool is plugged into vehicle the OBD port, one of the first on screen prompts from the Scan Tool is to energize the vehicle, since you can not program a cold vehicle. To accomplish this, the steering column assembly/ignition lock (physical protection) must first be defeated. If a stolen-recovered vehicle with electronic transponder protection does not have the column assembly/ignition lock defeated, then the presence of the transponder system or compromise of the transponder system is irrelevant as the vehicle could not be energized or shifted/steered. Certain transponders can be “cloned” (copied) using a special electronic device designed specifically for this purpose. Cloning of a transponder key (those that are capable of being cloned) not only requires the electronic key cloning machine and a new vehicle specific transponder be present, but also an existing, properly programmed transponder key for that particular vehicle to originate the cloning process. Once again, the ignition lock/steering column assembly must still be defeated even with a “cloned” key present.
Transponder equipped vehicles that are recovered with significant fire and thermal damage are still subject to a proper examination. Although the on-board vehicle transponder components have been consumed by the fire, it can still be possible to determine whether or not the steering column/ignition lock had been physically defeated. And, as noted earlier, the steering column/ignition lock must be defeated prior to an individual even considering dealing with the transponder system. This is true regardless of the type of vehicle or date of manufacture. Modern automotive forensic examination has been practiced since the mid-seventies, a full two decades prior to the introduction of the transponder systems. The non-transponder equipped 1994 BMW 3 series had an identical column assembly/ignition lock as the transponder equipped 1995 3 series. The non-transponder equipped 1998 Ford F-150 had the identical column assembly/ignition lock as the transponder equipped 1999 F-150. If all of these stolen-recovered vehicles were found burned to completion, the forensic examination procedures would be exactly the same with the recovery, examination and analysis of the surviving steering column and ignition lock components and the transponder system having no impact on the final determination, other than knowing it was present on two of the four vehicles. I have heard self-proclaimed “experts” testify that the transponder system on a burned vehicle may not have been functioning properly (I have yet to find a system that failed) at the time of the reported theft or it had been compromised. This is not a valid argument. If the steering column and ignition lock components had not been physically defeated, the condition or even the presence of the transponder system is not a factor. One can not attempt to put the cart before the horse, so to speak. If the steering column components/ignition lock had not been attacked, damaged or defeated, any further arguments serve no purpose other than a desperate attempt to cloud the issue.
Some vehicle owners choose to install (or have installed) an aftermarket remote start system. These systems generally use a spare key with the programmed transponder installed in the vehicle along with the aftermarket components and an aftermarket ring antenna routed from the aftermarket control module to the OEM ring antenna at the ignition lock. This allows the transponder signal from the remotely placed key to be read by the OEM ring antenna when the vehicle is energized remotely. Some aftermarket systems attach the spare key directly on the OEM ring antenna. These aftermarket systems are “piggybacked” to existing OEM vehicle components and will neutralize the transponder system by having a programmed key on-board the vehicle at all times. Even with the transponder system “compromised” by the aftermarket remote start system, the physical protection provided by the steering column/ignition lock must still be defeated. The only exception to this is if a properly cut transponder key is used in the aftermarket system, the key can be removed and used to start and operate the vehicle. There are currently six manufacturers who utilize an Emergency Start Procedure for their transponder systems (Acura, Audi, Honda, Mitsubishi, Porsche and VW). These systems will permit the vehicle to be started with no transponder present. The procedure requires a vehicle specific code be obtained from the dealer. The code sequence can be programmed into the vehicle by depressing the brake pedal, using the odometer reset button or by using other manufacturer procedures. Of course, this procedure can only be used on an energized vehicle, which would require the column assembly/ignition lock be defeated or a properly cut mechanical key be present.
The automotive transponder system is a sophisticated electronic anti-theft package and transponder protected vehicles are not stolen by common street thieves or “joy riders”. They can be obtained by a professional thief with the required skill, knowledge and tools, with a professional thief being defined as one who makes a living from the theft of automobiles. Even with a professional, there will be identifiable damage, marks or scars present on the relevant physical components. Try it yourself. Attempt to rotate your ignition lock, unlock the gear selector or unlock the steering column on your own vehicle without your key and causing no damage. And, a professional thief will not generally abandon a vehicle or burn a vehicle without removing the parts the vehicle was stolen for in the first place.
Since the introduction of the transponder electronic anti-theft system to the U.S. market in 1995, it has proven to be reliable, durable and very effective as a theft deterrent. Ford Motor Company has stated that their SecuriLock (transponder) system “makes conventional theft methods such as hot-wiring or attacking the ignition lock cylinder ineffective and virtually eliminates drive-away thefts”. To support this claim, Ford stated that since the transponder system was installed on the Mustang GT in 1996 and the entire Mustang line in 1997, the 1997 Mustang with the transponder system showed a 70% reduction in reported theft compared to the 1995 model year. In 2005 The National Highway Traffic Safety Administration granted Ford a full exemption for the 2006 Ford Thunderbird from the parts marking requirements of the Federal Motor Vehicle Theft Prevention Standard (Federal Register, September 1, 2006, Volume 71, Number 170). The exemption was granted based on the effectiveness and reliability of the Ford SecuriLock (transponder) system installed on the vehicles. As another example of the transponder system effectiveness, for model year 2002 the NHTSA Final Theft Data report revealed that out of a production of 28,639 transponder equipped 2002 Thunderbirds, only fourteen thefts were reported (Federal Register, March 15, 2005, Volume 70, Number 49). In the final analysis, not only has the transponder system proven
to be extremely effective as electronic vehicle protection, but in order to start and operate a vehicle without the properly
cut mechanical key with a vehicle specific programmed transponder, the ignition lock/column assembly must first be physically
defeated prior to even considering an attempt to by-pass or compromise the vehicle electronic protection. Note: The various manufacturers utilize different transponder hardware configurations and programming. As an example, some use “rolling’ codes, others do not. Some keys can be “cloned” (provided an existing vehicle specific programmed key is present), some can not be “cloned”. Certain vehicles use an emergency start procedure, most do not. There are selected vehicles that require a specific code to reprogram the system or program in a new key. What is important is that all of the transponder electronic anti-theft systems operate on the same basic principles and all are separate and independent of the physical anti-theft protection. This article is intended to provide the reader with an overall working knowledge of the electronic systems and their value. A qualified expert should be contacted to obtain the required information and specific details for the year, make and model of vehicle under consideration.
Transponder Terms/Definitions Fixed Code: The code that is required to start the vehicle does not change. Rolling Code: When the ignition is turned “ON” and the engine started, the transponder code is checked by the on-board computer module and a new random code is generated. The new code is now required for the next vehicle start cycle. Encrypted (Challenging Response Code): Communication between the key and vehicle on-board computer module is encrypted in both directions (bi-directional encryption of data) and the code changes during every use. Transponder: Radio Frequency Transmitter Responder that reacts to an electrical impulse. Ring Antenna (or Induction Coil): The Ring Antenna serves a duel function. It transmits the carrier frequency from the Transceiver to the Transponder as well as receiving a coded identification signal back from the Transponder. Transceiver (or Control Module): A Transmitter and Receiver. The Transceiver communicates with both the key embedded Transponder through the Ring Antenna and the vehicle on-board computer module via hard wire. The Transceiver sends a carrier frequency by way of the Ring Antenna and a fixed number of codes are contained in the memory and the Transceiver (control module) verifies that the correct code is being sent.
Texas Instruments: Produces both glass capsule and plastic wedge chips. Used in vehicles including Ford, Mercury, Chrysler, Jeep, Dodge, and Lincoln LS. Megamos: Produces both glass capsule and plastic wedge chips. Can be found in vehicles including Chevrolet, Cadillac, Pontiac, Buick, Honda, Porsche and Jaguar. Phillips: Primary domestic applications include Cadillac Catera, Pontiac, BMW, Infiniti, Mazda, Nissan, Mercedes and Volvo. Motorola: Used in the Lincoln Temic: This chip is used mostly in European applications. (Some vehicle manufacturers use several different chips) 2007 NorthAmerican Technical & Forensic Services, LLC All Rights Reserved The information contained in this article has been peer reviewed and approved by the below listed experts and members of the Coalition Network of Forensic Examiners: Rick Pacheco, North Eastern Technical Services / Ken Vitty, Vice President, Auto & Technical Div., Sterling Investigative Services / Glenn Hennings, Sterling Investigative Services / Stanley Paluski, Sterling Investigative Services / Tom Ware, ACE Security, Inc. / Dave Drew, CFL / Herb Miller, Arc Forensics / Tom Seroogy, VIN Security Forensics / Timothy Romine, Blaze Investigative Services, Inc., / Chad Tredway, NorthAmerican Technical & Forensic / Robert Vogel, NorthAmerican Technical & Forensic / Timothy Rosenberger, NorthAmerican Technical & Forensic / Andy Morton, NorthAmerican Technical & Forensic / Christopher Arnold, NorthAmerican Technical & Forensic. |