Today, President Biden is announcing strong and decisive actions to safeguard America from national security risks associated with the exploitation of U.S. connected vehicle supply chains by the People's Republic of China (PRC) and Russian Federation (Russia). The Biden-Harris Administration is committed to ensuring that our automotive supply chains are resilient and secure from foreign adversary cyber threats.
The Department of Commerce has issued a final rule that will prohibit the sale and import of connected vehicle hardware and software systems, as well as completed connected vehicles, from the PRC and Russia. This final rule marks the conclusion of a rigorous factfinding and regulatory process that President Biden launched last year.
Connected vehicles are comprised of many connected components and systems - such as Wi-Fi, Bluetooth, cellular, and satellite connectivity - designed to provide consumers with greater convenience and increase safety for drivers, passengers, and pedestrians. At the same time, foreign adversary involvement in the supply chains of connected vehicles poses a significant threat in most cars on the road today, granting malign actors unfettered access to these connected systems and the data they collect. As PRC automakers aggressively seek to increase their presence in American and global automotive markets, through this final rule, President Biden is delivering on his commitment to secure critical American supply chains and protect our national security.
The Department of Commerce's rule will also help the United States defend against the PRC's cyber espionage and intrusion operations, which continue to pose a significant threat to U.S. critical infrastructure and public safety. Over the past several years, PRC state-sponsored cyber actors such as Volt Typhoon have engaged in an extensive hacking campaign aimed at pre-positioning on - and potentially launching disruptive cyberattacks targeting - U.S. critical infrastructure. Russia also remains a malign cyber actor, with a similar history of well-documented cyber attacks against U.S. systems. The American transportation system is vital to facilitating commerce, essential services, and daily life. This rule ensures that our critical infrastructure is not exposed to the risk of foreign adversary-controlled supply chains that could provide bad actors with the means to disrupt U.S. critical infrastructure.
Beyond risks to critical infrastructure, the Department of Commerce assesses that certain hardware and software used in connected vehicles could enable mass collection of sensitive information, including geolocation data, audio and video recordings, and other pattern-of-life analysis.
The final rule is the culmination of a year-long examination of these risks and extensive consultation with industry and international partners. It will prohibit the import or sale of certain connected vehicle systems designed, developed, manufactured, or supplied by entities with ties to the PRC or Russia. This includes vehicle connectivity systems (VCS), or systems and components that connect vehicles to the outside world - including via Bluetooth, cellular, satellite, and Wi-Fi modules - and automated driving systems (ADS), which allow highly autonomous vehicles to operate independently of a driver behind the wheel. The rule includes restrictions on the import or sale of connected vehicles using VCS and ADS software, as well as imports of VCS hardware equipment. Restrictions on software will take effect for Model Year 2027 and restrictions on hardware will take effect for Model Year 2030. The rule also includes a prohibition on the sale of connected vehicles in the United States by entities who are owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia - even if those vehicles were made in the United States. That prohibition will take effect with Model Year 2027.
While this final rule applies only to passenger vehicles, the Department of Commerce is also announcing today its intent to pursue a rulemaking to address foreign adversary involvement in the supply chain of commercial connected vehicles, or vehicles with a gross vehicle weight rating of over 10,000 pounds, given the significant and unique risks they pose to national security and public safety. The Department of Commerce will also continue to consider the use of its authorities to address individual entities that may pose a threat to the connected vehicles ICTS supply chain.
In developing this final rule, the Department consulted with industry to ensure any actions maximally protect U.S. national security, while minimizing unintended consequences or disruptions to the market. The Biden-Harris Administration also made extensive efforts to engage U.S. allies and partners, including through convening an inaugural multinational meeting to address connected vehicle risks in July 2024 of more than a dozen countries to advance affirmative cybersecurity standards and coordinate policy measures to mitigate risks. Commerce and other agencies will continue to work closely with industry and international partners as the final rule comes into effect.
