Smartphones on Wheels: Commerce Proposes Regulations to Address National Security Risk from Connected Vehicles

On September 23, 2024, the US Department of Commerce’s Bureau of Industry and Security (BIS) published a notice of proposed rulemaking (NPRM) outlining new proposed rules to address national security risks associated with information and communications technology and services integral to connected vehicles that are designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of certain foreign countries.

This rulemaking highlights the US government’s concerns that user data collected by connected vehicles—including but not limited to sensitive data such as geolocation—could be exploited by certain countries for national security gain, similar to how smartphones and other connected devices are potential intelligence targets.

The NPRM follows BIS’s March 2024 advanced notice of proposed rulemaking (ANPRM) issued under Executive Order 13873, “Securing the Information and Communications Technology and Services Supply Chain.” The ANPRM received 57 comments from original equipment manufacturers, component suppliers, foreign governments, nonprofit organizations, and individuals. After BIS reviews additional comments submitted in response to the new NPRM, we expect BIS to finalize the rules, which will take effect 60 days after publication of the final rules in the Federal Register. The NPRM builds on the ANPRM, which we previously summarized in a March 2024 Insight and LawFlash.

The draft rules were published in the Federal Register on September 26, 2024, with the comment period closing on October 26, 2024 (since October 26 falls on a Saturday, comments can actually be submitted until the following Monday, October 28, 2024). 

In this report we summarize some of the main elements of the NPRM as well as analyze the key implications for various stakeholders.