US to ban connected vehicle tech from China, Russia due to national security risks

The Biden administration is looking to ban the import of connected vehicles and associated technologies from China and Russia, calling them the “countries of security concerns.”

The prohibiting rule has been proposed by the Department of Commerce in favor of, as the proposal points out, protecting the US from the national security risks associated with connected vehicle technologies from these nations.

“The Department of Commerce is issuing a notice of proposed rulemaking (NPRM) that would, if finalized as proposed, prohibit the sale or import of connected vehicles that incorporate certain technology and the import of particular components themselves from countries of concern, specifically the People’s Republic of China (PRC) and Russia,” the department said in a statement issued on Monday.

The ban specifically aims to prohibit imported automobiles with vehicle connectivity systems (VCS) and automated driving systems (ADS) from these countries.

Why ban connected vehicles?

Connected vehicle technologies, which rely on internet connectivity, sensors, and data exchange for enhanced features such as autonomous driving, navigation, and vehicle-to-vehicle communication, pose several security concerns for importing nations, including unauthorized surveillance, espionage, mass vehicle immobilization, cyberattacks, and national security threats.

“As the Department of Commerce has found, vehicles’ increasing connectivity creates opportunities to collect and exploit sensitive information,” the department added. “Certain hardware and software in connected vehicles enable the capture of information about geographic areas or critical infrastructure, and present opportunities for malicious actors to disrupt the operations of infrastructure or the vehicles themselves.”

“The Biden Administration is committed to ensuring that our automotive supply chains are resilient and secure from foreign threats,” the statement added.

The regulation specifically addresses VCS, which encompasses technologies and components that link vehicles to external networks, such as Bluetooth, cellular, satellite, and Wi-Fi modules. It also covers ADS, enabling highly autonomous vehicles to function without a driver in control.

Targeting Chinese and Russian imports

Given historical attempts at sabotaging the US’s critical systems and conducting espionage operations remotely, the White House is looking to tighten up loose ends.

“Commerce has determined that certain technologies used in connected vehicles from the PRC and Russia present particularly acute threats,” the statement added. “These countries of concern could use critical technologies within our supply chains for surveillance and sabotage to undermine national security.”

According to the proposal, if finalized, the prohibition on software would take effect for Model Year 2027, and the prohibitions on hardware would take effect for Model Year 2030, or January 1, 2029, for units without a model year.

This is in line with other cybersecurity efforts the US has been making in connection with these countries. Earlier this year, the US banned Moscow-based cybersecurity company, Kaspersky Labs, over concerns of strong ties to Russia’s nation-state cyber offensives. To that end, US-based users are reportedly waking up to their Kaspersky antivirus subscription swapped, without notice, with a low-key software entity, “UltraAV”.