The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) published a proposed rule to address the national security risks associated with connected vehicles. This rule would prohibit the sale or import of connected vehicles that incorporate certain information and communication technology and services (ICTS) that are designed, developed, manufactured, or supplied, by persons owned by, controlled by, or subject to the jurisdiction or direction of China or Russia. A brief summary is provided below.
Connected Vehicles Definition
“Connected vehicle” is defined in the proposed rule as “a vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets, roads, and highways, that integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication, cellular telecommunications connectivity, satellite communication, or other wireless spectrum connectivity with any other network or device.” BIS believes that, with few exceptions, all new vehicles sold in the United States will be captured by this definition, which covers passenger vehicles, motorcycles, buses, small and medium trucks, commercial trucks, and recreational vehicles.
Given the prevalence of connected vehicles on U.S. roads, the ICTS found in these vehicles is likely to present undue or unacceptable risks to national security if exploited by foreign adversaries. This rule specifically addresses China and Russia, both of which are able to compel carmakers and suppliers subject to their jurisdiction to cooperate with security and intelligence services and therefore potentially gain access to connected vehicles in the United States. This could allow remote access and manipulation of connected vehicles through their components and software, resulting in the blocking of critical transportation arteries, collisions that damage U.S. infrastructure, and widespread vehicle impairment. Along with physical harm to U.S. persons, there is also the risk of improper access to driver mobile devices to collect and exploit personally identifiable information or even protected health information.
Proposed Restrictions
To most effectively address these national security risks, the proposed rule focuses only on systems that most directly facilitate the transmission of data both into and from a vehicle. Therefore, BIS is proposing to regulate transactions involving two systems of ICTS integral to connected vehicles: (1) Vehicle Connectivity System (VCS), which includes any hardware or software item for a completed connected vehicle that has the function of enabling the transmission, receipt, conversion, or processing of radio frequency communications at a frequency over 450 megahertz (e.g., Bluetooth, Wi-Fi, cellular, and satellite); and (2) Automated Driving System (ADS), which includes hardware and software that, collectively, are capable of performing the entire dynamic driving task for a completed connected vehicle on a sustained basis, regardless of whether it is limited to a specific operational design domain. BIS is proposing regulations that would:
- Prohibit the knowing importation into the United States of certain hardware for VCS (“VCS Hardware”);
- Prohibit connected vehicle manufacturers from knowingly importing into the United States completed connected vehicles incorporating certain software that supports the function of VCS or ADS (“covered software”);
- Prohibit connected vehicle manufacturers from knowingly selling within the United States completed connected vehicles that incorporate covered software; and
- Prohibit connected vehicle manufacturers who are owned by, controlled by, or subject to the jurisdiction or direction of China or Russia from knowingly selling in the United States completed connected vehicles that incorporate VCS hardware or covered software.
The prohibitions on software would take effect for Model Year 2027, and the prohibitions for hardware would take effect for Model Year 2030 (January 1, 2029, for units without a model year).
BIS is also proposing to implement several mechanisms to facilitate compliance with these prohibitions, including the following:
- Declarations of Conformity submitted to BIS by VCS hardware importers and connected vehicle manufacturers to confirm that they are not engaging in prohibited transactions involving VCS hardware or covered software;
- Advisory opinions to allow VCS hardware importers and connected vehicle manufacturers to seek guidance from BIS on whether a prospective transaction may be prohibited;
- General authorizations to allow certain VCS hardware importers and connected vehicle manufacturers to engage in otherwise prohibited transactions without the need to notify BIS prior to the prohibited activity if they qualify under stated conditions;
- Specific authorizations which, following an application to and approval by BIS, grant VCS hardware importers and connected vehicle manufacturers the ability to engage in otherwise prohibited transactions, including because the associated undue or unacceptable risks have been, or can be, mitigated; and
- A process to inform VCS hardware importers and connected vehicle manufacturers that a specific authorization may be required because an activity could constitute a prohibited transaction.
Solicitation for Comments
BIS is soliciting comments on all aspects of the proposed rule, including the following:
- Whether the definition of “connected vehicles” will capture all new vehicles sold in the United States;
- Whether the prohibitions should apply to additional countries besides China and Russia;
- The determination that VCS and ADS are automotive ICTS integral to connected vehicles and pose the greatest and most addressable national security risk;
- The decision to focus the proposed rule on VCS and ACS and whether risks posed by other connected vehicle ICTS should also be addressed in this rule; and
- The nature of foreign interests in transactions related to the connected vehicle supply chain.
Comments are due no later than October 28, 2024, and may be submitted via the Federal rulemaking portal at regulations.gov, docket number BIS-2024-0005.
Conclusion
The proposed rule will have a significant impact on connected vehicle manufacturers (including OEMs and importers of completed connected vehicles), importers of VCS hardware, and Tier 1 and Tier 2 suppliers of VCS Hardware. The prohibitions in the rule will require these entities to scrutinize their supply chains for items with a nexus to China and Russia, and will also require businesses to implement new procedures in line with the proposed compliance mechanisms.
Contact us if you have questions about these new developments or are interested in submitting comments on this proposed rule.