Friday, 08 September 2017 21:10

CCC Defends Shift to Secure Share, Faces Tough Questions from CIC Task Force

Written by
Dan Risley represented a CIC task force formed to address concerns related to CCC’s “Secure Share.” Dan Risley represented a CIC task force formed to address concerns related to CCC’s “Secure Share.”


This summer, CCC Information Services defended the dramatic changes that the shift to CCC’s “Secure Share” system will bring to the industry, calling it necessary for data security, a step forward for the industry, and reasonably priced.

“We’re a software company that builds software as a business,” CCC’s Mark Fincher said at the Collision Industry Conference (CIC) in Chicago in July, when asked about CCC’s projected profit from the 50-cent-per-work file fee that management system providers and other vendors will pay CCC when they receive a shop’s estimate data through Secure Share. “We think the price is fair and equitable for all the participants.”

Fincher’s presentation in Chicago was noteworthy because CCC wasn’t represented at two previous CIC meetings this year at which a task force was formed to address industry concerns about Secure Share. The new data-exchange system went live this past spring, and as of next April, CCC users will only be able to transfer estimate data to others through Secure Share.

That’s a change from the longstanding current method under which a CCC ONE user can transfer the data from an estimate---to a shop management system, a CSI provider, a rental car company, etc.---using a standardized “Estimate Management Standard (EMS)” file. In many cases, those third-parties have---with a shop’s permission---placed a “data pump” on the shop’s server to automatically pull the EMS files the shop has agreed to share.

CCC’s “Secure Share” changes this arrangement in several key ways. First, it transfers the data using a “Business Message Suite (BMS)” file, largely viewed as a positive change. The industry-developed BMS standard gives users more control over which portions of an estimate are transferred. It can limit a parts vendor’s access, for example, to only the portions of the estimate needed to accurately fill the parts order, rather than also including (as the EMS file does) information about the vehicle owner as well.

But the required use of Secure Share for the data transfer means that by next April, shops will need to ensure any vendors or systems (CCC refers to these as “apps”) with which they share estimate data has completed the CCC approval process to be part of the “Secure Share Network.” Those system providers will then pay the 50-cent toll per work file each time they receive data from the shop.

Fincher acknowledged CCC will recoup its development costs and profit from this arrangement, but declined to provide any of the company’s projections for the revenue Secure Share will generate.

He focused on why CCC sees Secure Share as a necessary improvement for data-sharing within the industry, saying that first and foremost it helps ensure the security of estimate information.

“We know this information is sitting on thousands of shop servers or PCs, [in some cases] unencrypted and accessible to third parties,” Fincher said. “In many cases, as a repairer you had no idea who was accessing that information. You may have known there was a data pump or two data pumps on your system, but you had no visibility to that.”

Instead, keeping this information encrypted “in the cloud” and under CCC’s control, he said, helps ensure only authorized parties have access to it, and the BMS file transfer “gives repair facilities the ability to send just the relevant information” to different apps.

“That app provider does not have the ability to share that information with anyone that they want to,” Fincher also noted. “You retain control of that information as a repairer, and know its only going to be used for the purpose for which you designated.”

If a shop chooses to terminate a relationship with an app provider, Secure Share ensures that a third party will no longer have access to the shop’s estimate data, Fincher said.

“I’ve heard these stories that there was a company you were working with five years ago, but you terminated the relationship and moved on to a different software solution, but meanwhile that [old] data pump is still residing on your server, tracking that data, and you might not have had any idea that it’s pulling it,” Fincher said. “Now you have complete transparency with Secure Share.”

Fincher faced some tough questioning from the CIC task force established in the wake of CCC’s announced plans for Secure Share last fall. That task force developed a position statement that is supportive of the shift to the BMS file transfer standard, but critical of other limits on a shop’s sharing of estimate data.

“Any third party that restricts or prevents industry stakeholders from accessing or using the data generated and permitted by the collision repair facility and industry stakeholders will adversely impact the industry,” the task force position statement reads. “In addition, it will inhibit advancements in technology, restrict competition and adds cost into the marketplace. Technological advances should enable sophisticated, secure and more collaborative data usage, not impede industry progress.”

It is the shop’s responsibility to protect the privacy and proper use of the data, the task force acknowledges, but “the repair facility is entitled to and must have the freedom and flexibility to utilize the data as they deem appropriate, [including] the ability to copy or export data to separate servers, trading partners or online data warehousing services, without approval from a third party.”


Dan Risley of the Automotive Service Association, one of three chairs of the CIC task force, asked Fincher if data security really has been a problem within the industry during the decades in which the current data exchange system has been used.

“There has not been a significant compromise from a security perspective,” Fincher acknowledged. “But we don’t want to be in a reactive mode. We are processing thousands of files per day, and there are thousands of collision repair facilities that are using this data that is sitting unencrypted. The last thing we want to do is be in a reactive mode.”

Shouldn’t a shop have the right to share its estimate data as it chooses, Risley asked Fincher.

“Unfortunately, it’s not just the shops that own that data,” Fincher said. “There are others who claim ownership of that data, and we have a commitment to secure the data of all of our customers and other providers we work with who provide us that source data.”

Risley said one alternative that he has heard is being worked on is a system in which the shop exports a PDF file of an estimate to a third party that then translates that file back into a data file the shop can share.

“We agree there are other alternatives that could exist to share this information,” Fincher said. “As long as it’s within the guidelines of the contractual agreement that the repair facility has with CCC, then absolutely… [But] it’s also important to understand other contractual relationships that as a repair facility you might have with insurance companies, and look at those DRP agreements to see what your limitations are. There is specific language about what and who you can share information with.”


Risley acknowledged CCC has been responding to some of the concerns raised by the industry about Secure Share, reviewing its contract language with app providers that some vendors found troubling, and potentially establishing an advisory board to allow for ongoing feedback.

Still, following Fincher’s presentation, 70 percent of CIC attendees in Chicago voted to not disband the task force, believing “there is additional work to be done.”

CIC Chairman Guy Bargnes praised the task force’s work.

“Regardless of your position, your thinking on this issue, the work done by this task force…absolutely exemplifies…CIC’s mission: To discuss issues, to enhance understanding, to find common ground,” Bargnes said. “That’s the objective of CIC, to bring more information.”

John Yoswick, a freelance writer based in Portland, Oregon, who has been writing about the automotive industry since 1988, is also the editor of the weekly CRASH Network bulletin (CrashNetwork.com). He can be contacted by email at john@CrashNetwork.com.

Read 2845 times