One Regulation Could Have Stopped a Nationwide Car Theft Wave. Why Don't We Have It?

None of this is happening in Canada, despite many of the same Kias and Hyundais being sold north of the border. This is because, in 2005, Canada enacted a simple regulation that made all cars harder to steal. 

As part of Motherboard's ongoing coverage of the Kia-Hyundai theft issue, involving more than 125 public information requests and interviews with victims and experts, I’ve been trying to answer what I hoped would be a simple question: Why doesn’t the United States have a similar regulation? Unfortunately, I didn’t find any satisfying answers. Instead, I found bigger questions about why the U.S. has no serious anti-theft regulations and how its regulatory agencies think about crime prevention—which is to say, in some cases, not at all.

The story of what is happening with Kia andHyundai thefts in the U.S., and what is not happening in Canada, is as clear a case you will find illustrating what good regulations can do and what intelligent, thoughtful crime prevention actually looks like when it involves a holistic government effort rather than a narrow and singular focus of policing and incarceration. A simple, straightforward regulation is working for one country, while the absence of that same regulation costs the citizens of another country dearly. 

It’s also a demonstration of one of the many lesser-noticed but important ways U.S. regulators are failing millions of Americans who have had their lives disrupted and have to spend thousands of dollars out of pocket to get their cars back for an entirely preventable crime, or are facing surging insurance premiums because they bought a car from the wrong brand. In a testament to the societal costs of not having these types of regulations, 17 cities are suing Kia and Hyundai for causing a public nuisance by failing to put immobilizers in their vehicles. 

It is also the story of a country with a government that increasingly feels like it is failing to function, and how that failure can manifest in ways both big and small, with the true costs often not revealing themselves until years later.

In 2005, Transport Canada, a federal agency, decided to do something about it. Starting in 2007, it declared, all passenger vehicles sold in Canada would require an engine immobilizer, a basic anti-theft device that uses an electronic signature in the key to unlock the engine. If the key isn’t present, the car can’t be started. This prevents hot wiring and other old-school, brute force methods of stealing cars.

Engine immobilizers don’t eliminate theft, but they drastically reduce it, especially the kinds of joyriding thefts Canada was seeing an increase in. A 2002 study in Australia—which required immobilizers as of July 2001—found cars with immobilizers were half as likely to be stolen than cars without one. And 80 percent of the cars in Canada already had immobilizers; the remaining 20 percent were being targeted by thieves. At a cost of less than $25 USD per vehicle, mandating immobilizers for all cars seemed like a no-brainer.

The wisdom of that regulation is all too clear now, thanks to the massive nationwide wave of auto thefts plaguing the U.S., which has to do entirely with some of the only vehicles left in the U.S. without engine immobilizers: low-end Kias and Hyundais. These cars are all stolen using the same technique, illustrated in videos posted across social media as part of the "Kia Boys" trend. First, the thief smashes the rear driver’s side window, because only the front driver window sets off the alarm. Second, they use a screwdriver to rip open the steering column. Third, they use a USB-A cord to create enough leverage to turn the exposed ignition switch, which starts the car.  

This method has proven shockingly effective. Motherboard has compiled detailed theft data from 59 cities as of this writing, which has revealed increases of orders of magnitude in Kia and Hyundai thefts across the nation. It was completely avoidable.

In 2016, the U.S. had a chance to require immobilizers, which would have mitigated the Kia Boys trend. In that year, U.S. regulators changed the rules around vehicle anti-theft technology to bring them more in line with Canada’s. Since many cars are imported and exported across the border, automakers generally prefer the regulations to be the same in both countries. But, for reasons that remain unclear, the U.S. didn’t mandate immobilizers in that 2016 rule change.

For the last three months, I’ve been trying to find an answer to a basic question at the heart of this theft wave: Why didn’t the U.S. follow Canada’s lead and mandate immobilizers, too? If it had, either around the same time as Canada or when it considered new regulations in the mid-2010s, the method of stealing Kias and Hyundais widely popularized in online videos would not be possible, as evidenced by the fact that no similar theft wave is occurring north of the border. (Canada is experiencing its own problems with auto thefts, as explained below, but the trend is tied to organized crime and not centered around Kias and Hyundais or engine immobilizers). 

This has been a very difficult question to answer. I’ve asked the National Highway Traffic Safety Administration (NHTSA), the U.S. regulatory agency responsible for such regulations, which only responded to written questions on background—a stipulation Motherboard didn’t agree to—and declined repeated attempts to schedule an interview. I’ve tried to talk to former NHTSA employees familiar with the rulemaking process, most of whom wouldn’t agree to speak for this story, or would only do so off the record. There are also few to no experts on anti-vehicle theft regulations in the U.S., because there is almost nothing on the books to be an expert on. 

The best answer, for now, appears to be that it never occurred to anyone at NHTSA to require immobilizers.

When Canada amended its anti-theft regulations in 2005, it was responding to the very same types of thefts the U.S. is experiencing now. For example, an estimated 43 percent of vehicle thefts in Toronto in 1999 were perpetrated by youth using crude theft methods, according to a report that year prepared for Transport Canada. 

So when Canada enacted its immobilizer requirement, it added multiple sections outlining exactly what the immobilization system ought to be and how difficult it should be to dismantle. The regulations specify how many code variants the system must have so thieves couldn’t simply try all the different combinations and crack it on pure chance, specifying that trying to do so over 24 hours should have a probability of success of less than 4 percent. 

Importantly for what would come later, the regulations provide a list of “tools or equipment” that should be tested against the system to make sure it is robust enough to defend against. Those tools include scissors, wire strippers, wire cutters, hammers, slide hammers, chisels, wrenches, pliers, screwdrivers, steel rods and spikes, a hacksaw, battery-operated drills, angle grinders, and jigsaws. The regulations state it should not be possible to break through the immobilizer system with these tools in less than five minutes.

North of the border, all Kias and Hyundais have come with engine immobilizers for years, per the regulations in place since 2007. As a result, Kia and Hyundai cars are not present on Canada’s most stolen vehicles list, as opposed to the U.S. where in 2022 the Hyundai Sonata, Elantra, and Kia Optima were the fifth through seventh most stolen cars in the U.S. Before the “Kia Boys” trend, none had ever before been on the Top 10 list.

The immobilizers cost so little—an automaker told Canadian regulators in 2005 that they cost less than $30 CAD per vehicle—that automakers don’t even bother passing the costs onto consumers. In a 2005 Prince George Citizen story, Hyundai Canada spokesperson Tom McPherson told the publication the company would “likely absorb any related costs rather than raising the price of the vehicles.” Today, the Kia Forte starts at $23,183 CAD in Canada, which at current exchange rates is $3,000 USD cheaper than the starting price for the same car in the U.S. 

It’s probably surprising to most people that U.S. vehicle regulations have almost nothing to say about making cars hard to steal, but it's true. 

U.S. anti-theft regulations comprise of two different laws. The first falls under general motor vehicle safety rules and only require a key to prevent “normal activation” of the car, and that the car must beep if the key is left in the ignition. The second is the Motor Vehicle Theft Law Enforcement Act. First passed in 1982 and supplemented by Congress with the 1992 Anti Car Theft Act, it mandates marking car parts with unique identifier codes to discourage chop shopping, or stealing cars and then selling it off part by part.

The agency tasked with vehicle regulations, the National Highway Traffic Safety Administration, broadly considers vehicle theft to be a matter of law enforcement, not vehicle safety regulations, a spokesperson told me—a clear example of ideology being hardwired into the structure of government. It may be far easier to prevent laws being broken than to enforce them, but doing so is not in NHTSA’s mandate, as it understands it.  

This mindset was most apparent in 2016, when NHTSA passed a federal rule that, on first glance, would seemingly have enacted an immobilizer requirement. The summary specifically talks about bringing immobilizer rules and performance to “closely follow” the “anti-theft standard of Canada.” But, on closer reading, NHTSA declined to require vehicles to have immobilizers like Canada does. Instead, the regulatory change had to do with the standards immobilizers must meet in order for manufacturers to be exempt from parts marking, a costly and laborious process of inscribing unique ID numbers on the parts in the car to discourage chop shops from dismantling stolen cars for sale of individual parts. Being aligned with Canada did not mean enacting the requirement to have an immobilizer, but rather establishing the standard immobilizers must meet to exempt a model from parts marking.

Even lawyers and lawmakers seem surprised the regulations have so little to say about theft prevention beyond parts marking. In April, 18 state attorneys general sent a letter to NHTSA acting administrator Ann Carlson asking for a recall of the Kia and Hyundai vehicles getting stolen, essentially saying surely something in the federal regulations ought to prevent a theft wave like this. Carlson’s response in June said the agency “has not determined that this issue constitutes either a safety defect or noncompliance requiring a recall” because “the safety risk arises from unsafe use of a motor vehicle by an unauthorized person after taking significant destructive actions to parts of the vehicle.” 

Essentially, because the Kia Boys method doesn’t involve the “normal activation” of the car, the cars are still in compliance with the existing anti-theft regulations despite being trivially easy to steal in under a minute with a screwdriver and USB cord. 

The biggest difference between the U.S. regulations and Canada’s is that Canada anticipates the potential actions a criminal might take to steal a car, while the U.S. “does not contemplate actions taken by criminal actors,” according to a NHTSA spokesperson.

I have asked NHTSA directly why, if the 2016 rule change was intended to align U.S. regulations with Canada’s, NHTSA didn’t require immobilizers like Canada does, instead of tweaking the standards on parts marking. I did not receive a reply that addressed this question. A NHTSA spokesperson said the Theft Act only provides “express authority for parts-marking” and setting standards relating to immobilizers as exemptions from parts-marking, not for requiring immobilizers to begin with.

Due to the lack of regulations, the U.S. vehicle market predictably resembled Canada’s before 2007. The vast majority of cars have immobilizers because they are cheap, useful anti-theft devices. According to the Insurance Institute for Highway Safety, less than half of Kias and Hyundais in the U.S. had immobilizers prior to 2020, but greater than 96 percent of all other cars sold in the U.S. did. In other words, this wasn’t an industry-wide problem. It was a Kia-Hyundai problem.

As a result, an IIHS spokesperson told Motherboard, “theft claim frequency for 2003–23 Hyundai and Kia models in the second half of 2022 was seven times as high as in the first half of 2020. Theft claim frequency for Hyundai and Kia vehicles was nearly 4 times as high as other makes during July-December 2022.”  

There's no question the Kia Boys theft trend cannot happen in Canada because of the immobilizer requirement, but another theft trend has taken hold in Canada in recent years. In 2022, the number of stolen cars almost doubled in Ontario and Quebec. The trend seems to be rooted in sophisticated crime rings and the mob stealing valuable cars and flipping them for cash. 

Ironically, experts in Canada are laying blame on the very same regulations that took effect in 2007 and required engine immobilizers, saying they didn’t do enough to require standards on key fobs and push-to-start systems. They say savvy thieves can exploit those systems by, among other methods, intercepting the signal, copying it, then unlocking and starting the car later.

Still, it’s worth noting even Canada’s theft surge is mild compared to what some American cities are facing. For example, Toronto and Chicago have similar populations, but Chicago had 8.05 vehicle thefts per 1,000 people in 2022, whereas Toronto had 3.5. 

And because the U.S.’s surge is targeted so narrowly towards specific models, it leaves those people feeling victimized and targeted by something they are powerless to prevent. All of this could have been prevented with trivial ease; it was just that no one wanted to do so.