View Rule
View EO 12866 Meetings | Printer-Friendly Version Download RIN Data in XML |
DOC/BIS | RIN: 0694-AJ56 | Publication ID: Fall 2024 |
Title: Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles | |
Abstract:
The Department of Commerce’s Bureau of Industry and Security (BIS) published an advance notice of proposed rulemaking (ANPRM) on March 1, 2024, to seek public comment on questions related to transactions involving information and communications technology and services integral to connected vehicles that are designed, developed, manufactured, or supplied by persons owned, controlled, or subject to the jurisdiction or direction of foreign governments or foreign non-government persons identified at 15 CFR 7.4, pursuant to Executive Order (E.O.) 13873. BIS is reviewing comments and working to implement a proposed rule to assist BIS in better determining the technologies and market participants most appropriate for regulation pursuant to E.O. 13873 regarding connected vehicles. |
|
Agency: Department of Commerce(DOC) | Priority: Other Significant |
RIN Status: Previously published in the Unified Agenda | Agenda Stage of Rulemaking: Proposed Rule Stage |
Major: Yes | Unfunded Mandates: No |
CFR Citation: 15 CFR 791 | |
Legal Authority: 50 U.S.C. 1701 50 U.S.C. 1601 3 U.S.C. 301 E.O. 13873 |
Legal Deadline:
None |
||||||||||||
Statement of Need: OICTS has identified an undue and unacceptable risk to U.S. national security or the security and safety of U.S. Persons from ICTS integral to connected vehicles that is designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China or Russia, which are each listed as foreign adversaries in 15 CFR Part 791.4(a). When such ICTS components are part of a Connected Vehicle, they may allow foreign adversaries to gain illicit access to the Connected Vehicle and this access could enable those foreign adversaries to exfiltrate sensitive data collected by Connected Vehicles and, potentially, allow remote access and manipulation of the vehicles. Pursuant to E.O. 13873, the Department proposes to identify the potential exfiltration of sensitive U.S. Person data and remote manipulation of Connected Vehicles as undue or unacceptable risks to U.S. national security and to the security and safety of U.S. Persons. |
||||||||||||
Summary of the Legal Basis: In E.O. 13873, the President delegated to the Secretary of Commerce, to the extent necessary to implement the order, the authority granted under the International Emergency Economic Powers Act (50 U.S.C. 1701, et seq.), to deal with any unusual and extraordinary foreign threat to the United States’ national security, foreign policy, or economy, if the President declares a national emergency with respect to such threat. In E.O. 13873, the President declared a national emergency with respect to the unusual and extraordinary foreign threat posed to the ICTS supply chain. This notice of proposed rulemaking aims to mitigate the risks to U.S. national security posed by ICTS integral to connected vehicles when those ICTS are designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary. |
||||||||||||
Alternatives: The Department has proposed what it believes to be the least restrictive means necessary [by] tailor[ing] the prohibition to address the undue or unacceptable risk while balancing the overall compliance costs of the rule and minimizing the impact on small entities. The Department also considered a no-action, and a more stringent alternative. The no-action alternative is not preferred because the risks presented by foreign adversary involvement in the U.S. CV market could lead to negative events for U.S. national security. The more stringent regulatory approaches, including regulating additional CV component systems under consideration that are not included in the proposed rule, were found to unacceptably increase the costs of the proposed rule due to the additional burden on industry while not substantially reducing national security risk. |
||||||||||||
Anticipated Costs and Benefits: The Department concludes that the majority of costs will be borne by entities responsible for compliance with the proposed rule: namely connected vehicle manufacturers and VCS hardware importers. The two major costs associated with connected vehicle manufactures and VCS hardware importers are 1) costs related to rule compliance (range of $30,964 to $38,554, which does not apply to firms that handle less than 1,000 vehicles) and 2) costs associated with substitute parts and services. The Department estimates that increased prices for consumers may reduce the number of vehicles sold in the U.S. by an estimated 0.01 percent to 0.16 percent (1,700 to 26,000 fewer vehicles). The Department estimates 1,700 to 26,000 fewer vehicles would be purchased by U.S. consumers per year as a result of the proposed rule and also estimates increased prices for consumers may reduce the number of vehicles sold in the U.S. by an estimated 0.01 percent or 0.16 percent. The primary expected benefit of implementing the proposed rule would be a reduction in the chance of a catastrophic attack due to the exfiltration of data and remote manipulation of connected vehicles. |
||||||||||||
Risks: The request for comments via the NPRM and subsequent engagement with the public and industry on connected vehicle systems will inform BIS considerations to further the national security and foreign policy of the United States. To not undergo this NPRM process would be to the detriment of the national security and foreign policy of the United States. |
||||||||||||
Timetable:
|
Regulatory Flexibility Analysis Required: No | Government Levels Affected: None |
Federalism: No | |
Included in the Regulatory Plan: Yes | |
International Impacts: This regulatory action will be likely to have international trade and investment effects, or otherwise be of international interest. | |
RIN Data Printed in the FR: No | |
Agency Contact: Marc Coldiron Department of Commerce Bureau of Industry and Security 1401 Constitution Avenue NW, Washington, DC 20230 Phone:202 482-3678 |