Cybersecurity Score – Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles

Bill Summary

This proposed rule establishes restrictions on the sale or import of connected vehicles using hardware or software from countries of concern—particularly China and Russia—to safeguard U.S. cybersecurity and national security.

Cybersecurity Score Rating

Rating: Cyber Positive. This proposed rule has potential to enhance the safety and security of information and communications technology and services (ICTS) used in connected vehicles by reducing U.S. reliance on foreign hardware and software from nation-state threat actors, thereby mitigating cybersecurity vulnerabilities.

Status

Latest draft updated Sept. 26, 2024, with public comments accepted by the Department of Commerce’s Bureau of Industry and Security (BIS) through Oct. 28, 2024. Possible adoption following the public comment review period, with the rule taking effect 60 days after publication in the Federal Register. (Last updated: Nov. 18, 2024)

Key Provisions

• Prohibits ICTS transactions involving vehicle connectivity system (VCS) hardware and automated driving system (ADS) software components designed, developed, manufactured, or supplied by entities controlled by or under the jurisdiction of China or Russia
• Requires companies to submit an annual Declaration of Conformity demonstrating that prohibited transactions have not occurred and documenting compliance with restrictions 
• Allows companies to apply for general or specific authorizations for certain restricted transactions if they can explain how any potential undue risks to U.S. national security can be reasonably managed based on established criteria
• Incentivizes connected vehicle manufacturers, VCS hardware importers, and related suppliers to voluntarily adopt more measures to help secure the U.S. ICTS supply chain for connected vehicles

Background

The continued growth of connected vehicles in the global market has introduced increasingly sophisticated software and hardware systems to enhance safety and convenience through features like light detection and ranging, advanced driver-assistance systems, and vehicle-to-everything communication. Despite the transformative benefits of these technological advancements, this expansion also presents significant challenges to U.S. national security and cybersecurity. Along with multiple points of connectivity, the sheer amount of data that connected vehicles collect creates an especially attractive target for cyberattacks. In particular, China’s ongoing ambitions to dominate the global connected vehicle market and Russia’s more recent push into the industry pose high risks. Both China and Russia have long used the private sector to support government-backed objectives, which could lead them to manipulate or exfiltrate data, disrupt operations, or even interfere with American vehicle control systems. 

Recognizing these growing cybersecurity and national security threats, the Biden administration released a fact sheet in February 2024 directing the Department of Commerce to “investigate the potential national security risks from connected vehicles that incorporate technology from countries of concern, including China, and consider regulations to address those risks.” This direction builds upon prior regulatory efforts, including President Donald J. Trump’s EO 13873 from 2019, which declared a national emergency concerning the ICTS supply chain and allowed for additional scrutiny and restrictions on foreign-sourced technology to safeguard U.S. national security. Together, these executive actions lay the foundation for stronger regulation of critical technologies.

Furthering the regulatory objectives and principles established by these actions, the BIS issued an advance notice of proposed rulemaking (ANPRM) in March 2024, seeking public comment on how to secure and minimize national security risks posed by ICTS used in connected vehicles. The BIS received 57 comments from original equipment manufacturers, component suppliers, nonprofit organizations, individuals, and two foreign governments. Stakeholder comments were pivotal in shaping the draft rule, reflecting consensus on the cybersecurity risks in connected vehicles and the need for stronger security measures. However, concerns emerged about balancing these measures with economic realities—particularly global supply chain dependencies and competitive pressures. 

The BIS revised the draft rule to incorporate stakeholder feedback, prioritizing mitigation of the most critical cybersecurity risks while addressing economic concerns. For example, the current draft of the proposed rule provides a delayed implementation timeline to accommodate industry stakeholders who need substantial lead time to identify new suppliers or source from alternative suppliers. Moreover, the BIS deliberately chose to exclude other technological systems highlighted in its initial ANPRM—such as vehicle operating systems, battery management systems, and ADS—unless they have VCS components and hardware. In doing so, the proposed rule targets the technological systems that most directly facilitate the transmission of data to and from the vehicle.

Submissions are currently under review. If adopted as written, the finalized regulation would take effect 60 days after publication in the Federal Register, representing a significant step toward securing connected vehicle technologies and safeguarding U.S. national security.

Key Takeaways

• The “cyber positive” rating reflects the proposed rule’s targeted approach: Ban high-risk ICTS components in connected vehicles, enhance supply chain security, and offer a phased timeline with tailored exemptions to mitigate economic disruptions while preserving U.S. national security.
• The proposed rule establishes an adaptable framework to curtail adversarial influence in the connected vehicle market, securing U.S. technologies and data while fostering a more resilient and trustworthy ICTS supply chain.
• Early regulatory action could disrupt China’s efforts to dominate the global connected vehicle market, reducing dependencies that pose military and diplomatic risks and making it easier for U.S. allies to isolate or impose effective sanctions on China during geopolitical tensions.