Catching a device that has valid credentials and is lying.
Signature verification answers one question: was this sender allowed to speak? It says nothing about whether what they said was true. A vehicle with an unmodified secure element and perfectly valid certificates can still broadcast a fabricated position, a phantom hard-braking event or a non-existent emergency vehicle — because its GNSS was spoofed, its firmware was modified, or its owner wanted the lane. Misbehaviour detection is the layer that handles that.
ETSI TS 103 759 V2.2.1, published January 2026.
The Misbehaviour Reporting Service, Release 2, superseding V2.1.1 of January 2023. This is current, and worth reading in full.
Its scope is the reporting of local misbehaviour detections to a central authority. The Misbehaviour Authority takes reports and determines what response actions — for example, revocation of a certificate — should be taken within the PKI. Where to download it, free →
From a single implausible field to a contradiction with your own sensors.
| Class | Detects |
|---|---|
| 1 | Implausible values within a single message |
| 2 | Inconsistency with prior messages from the same sender |
| 3 | Inconsistency with local environment knowledge |
| 4 | Inconsistency with the receiver's own onboard sensor perception |
| 5 | Inconsistency across different message types or across senders |
Class 1 is where the 2026 GNSS-spoofing demonstration would have been caught: a 20 m/s² acceleration is physically implausible for a road vehicle regardless of what else is going on. Class 4 is the most powerful and the most expensive — comparing a received message against what your own camera and radar see is exactly the fusion problem, run in reverse.
Concrete detectors are specified in the annexes: CAM detectors for position plausibility, heading consistency, speed validation and acceleration checks; DENM detectors for environmental, data-consistency, behavioural and trust-based anomalies.
Signed, then encrypted to the Misbehaviour Authority.
A misbehaviour report is an EtsiTs103759Mbr inside an EtsiTs103759Data, COER-encoded per ITU-T X.696, with normative ASN.1 in the standard's Annex A.
The container is signed then encrypted — an EtsiTs103097Data-Signed wrapping the report, wrapped in an EtsiTs103097Data-Encrypted addressed to the Misbehaviour Authority's public encryption key. Transport is HTTP POST over TLS 1.2 or 1.3 to a configurable URL, with four endpoints defined: /uploadMR-v1, /SignedAndEncrypted, /Signed and /Plain. The MA's certificate must carry the report's ITS-AID in its service-specific permissions.
This is where the design gets genuinely hard.
The SCMS design assumption is that all OEMs will provide at least enough storage for 10,000 CRL entries, around 400 KB. That is not a lot for a national fleet, and it is why linkage values matter so much: one CRL entry revokes every future pseudonym of one device rather than one certificate.
Three further mechanisms in the design:
- CRL series partitioning — Series 1 for vehicle pseudonym certificates, Series 2 for most SCMS components, Series 3 for vehicle identification and roadside application certificates, Series 4 for enrolment certificates, Series 256 for Root-CA-managed entities. Different authorities, different revocation cadences: daily for end entities, monthly for components.
- Prioritisation hints — tagging CRL entries with location, severity of misbehaviour, or a “private keys made public” flag so constrained devices can decide what to keep.
- Epidemic distribution — devices that have received a CRL become distributors in turn. Modelling in the SCMS design showed a city the size of Zurich covered from a single roadside unit within hours.
Europe sidesteps most of it. ETSI zeroes the cracaId and crlSeries fields and relies instead on short authorisation-ticket validity — a week or less — plus the Enrolment Authority simply refusing to reissue. A compromised station is stopped by revoking its enrolment credential, and its existing tickets expire on their own. This is a substantially simpler operational model and a good argument for the European approach in a greenfield deployment. The two models compared →
For reference on cadence, AutoCrypt's published Root CA Certification Practice Statement specifies CRL validity up to 90 days, publication within one business day of revocation, and security-incident revocation processed within 24 hours.
Questions this page answers.
What is misbehaviour detection in V2X?
The set of techniques that identify a device sending false information despite holding valid credentials — by checking messages for internal implausibility, inconsistency with the sender's own history, inconsistency with the environment, or contradiction of the receiver's own sensors.
What is a Misbehaviour Authority?
The PKI entity that receives misbehaviour reports from vehicles and roadside units, investigates them, and decides whether to revoke a device's credentials. In a well-designed national deployment it should sit in a separate organisation from the Enrolment and Authorisation Authorities, and unmasking a credential should require a defined legal process rather than being available as an operational convenience.
How is a compromised vehicle removed from the system?
In the US model, the Misbehaviour Authority publishes the device's linkage seeds on a certificate revocation list, which lets every receiver compute all of that device's future pseudonyms and reject them — while leaving its past messages unlinkable. In the European model, the Enrolment Authority revokes the enrolment credential so the Authorisation Authority issues nothing further, and the device's remaining short-lived tickets simply expire.