0694-AJ56 202410 The Regulatory Plan and the Unified Agenda of Federal Regulatory and Deregulatory Actions 0694 Bureau of Industry and Security BIS 0600 Department of Commerce DOC Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles

The Department of Commerce’s Bureau of Industry and Security (BIS) published an advance notice of proposed rulemaking (ANPRM) on March 1, 2024, to seek public comment on questions related to transactions involving information and communications technology and services integral to connected vehicles that are designed, developed, manufactured, or supplied by persons owned, controlled, or subject to the jurisdiction or direction of foreign governments or foreign non-government persons identified at 15 CFR 7.4, pursuant to Executive Order (E.O.) 13873. BIS is reviewing comments and working to implement a proposed rule to assist BIS in better determining the technologies and market participants most appropriate for regulation pursuant to E.O. 13873 regarding connected vehicles.

]]> Other Significant Previously Published in The Unified Agenda Proposed Rule Stage Yes No 15 CFR 791 50 U.S.C. 1701 50 U.S.C. 1601 3 U.S.C. 301 E.O. 13873 Yes

OICTS has identified an undue and unacceptable risk to U.S. national security or the security and safety of U.S. Persons from ICTS integral to connected vehicles that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China or Russia, which are each listed as foreign adversaries in 15 CFR Part 791.4(a). When such ICTS components are part of a Connected Vehicle, they may allow foreign adversaries to gain illicit access to the Connected Vehicle and this access could enable those foreign adversaries to exfiltrate sensitive data collected by Connected Vehicles and, potentially, allow remote access and manipulation of the vehicles. Pursuant to E.O. 13873, the Department proposes to identify the potential exfiltration of sensitive U.S. Person data and remote manipulation of Connected Vehicles as undue or unacceptable risks to U.S. national security and to the security and safety of U.S. Persons.

]]>

In E.O. 13873, the President delegated to the Secretary of Commerce, to the extent necessary to implement the order, the authority granted under the International Emergency Economic Powers Act (50 U.S.C. 1701, et seq.), to deal with any unusual and extraordinary foreign threat to the United States’ national security, foreign policy, or economy, if the President declares a national emergency with respect to such threat. In E.O. 13873, the President declared a national emergency with respect to the unusual and extraordinary foreign threat posed to the ICTS supply chain. This notice of proposed rulemaking aims to mitigate the risks to U.S. national security posed by ICTS integral to connected vehicles when those ICTS are designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary.

]]>

The Department has proposed what it believes to be the least restrictive means necessary [by] tailor[ing] the prohibition to address the undue or unacceptable risk while balancing the overall compliance costs of the rule and minimizing the impact on small entities. The Department also considered a no-action, and a more stringent alternative. The no-action alternative is not preferred because the risks presented by foreign adversary involvement in the U.S. CV market could lead to negative events for U.S. national security. The more stringent regulatory approaches, including regulating additional CV component systems under consideration that are not included in the proposed rule, were found to unacceptably increase the costs of the proposed rule due to the additional burden on industry while not substantially reducing national security risk.

]]>

The Department concludes that the majority of costs will be borne by entities responsible for compliance with the proposed rule: namely connected vehicle manufacturers and VCS hardware importers. The two major costs associated with connected vehicle manufactures and VCS hardware importers are 1) costs related to rule compliance (range of $30,964 to $38,554, which does not apply to firms that handle less than 1,000 vehicles) and 2) costs associated with substitute parts and services. The Department estimates that increased prices for consumers may reduce the number of vehicles sold in the U.S. by an estimated 0.01 percent to 0.16 percent (1,700 to 26,000 fewer vehicles). The Department estimates 1,700 to 26,000 fewer vehicles would be purchased by U.S. consumers per year as a result of the proposed rule and also estimates increased prices for consumers may reduce the number of vehicles sold in the U.S. by an estimated 0.01 percent or 0.16 percent. The primary expected benefit of implementing the proposed rule would be a reduction in the chance of a catastrophic attack due to the exfiltration of data and remote manipulation of connected vehicles.

]]>

The request for comments via the NPRM and subsequent engagement with the public and industry on connected vehicle systems will inform BIS considerations to further the national security and foreign policy of the United States. To not undergo this NPRM process would be to the detriment of the national security and foreign policy of the United States.

]]> ANPRM 03/01/2024 89 FR 15066 ANPRM Comment Period End 04/30/2024 NPRM 12/00/2024 No None No No Yes Marc Coldiron 0694 Bureau of Industry and Security BIS 202 482-3678 marc.coldiron@bis.doc.gov 1401 Constitution Avenue NW, Washington DC 20230