In a decisive move aimed at fortifying America’s critical infrastructure, President Biden on Monday unveiled stringent measures to shield U.S. connected vehicle supply chains from potential national security risks posed by China and Russia. The Biden administration’s latest policy underscores a commitment to securing the nation’s automotive industry against foreign cyber threats while ensuring the resilience of critical supply chains.

The Department of Commerce announced a final rule that will prohibit the import and sale of connected vehicle hardware, software systems, and fully assembled vehicles originating from the People’s Republic of China (PRC) and Russia. This action follows a year-long regulatory process initiated by President Biden, reflecting a comprehensive review of the risks associated with foreign adversaries’ involvement in the technology that underpins modern vehicles.

A Double-Edged Innovation

Connected vehicles, equipped with technologies like Wi-Fi, Bluetooth, cellular, and satellite connectivity, offer enhanced safety and convenience for drivers and passengers. Yet, these same features create potential vulnerabilities, enabling hostile actors to exploit the systems for espionage or cyberattacks. The PRC’s growing automotive footprint and documented Russian cyber intrusions have heightened the urgency to act.

“Foreign adversary-controlled supply chains pose an unacceptable risk to the safety and security of our critical infrastructure,” President Biden said. “This rule represents a significant step in safeguarding American technology and public safety.”

The rule also seeks to curb cyber-espionage campaigns linked to Chinese state-sponsored groups, such as Volt Typhoon, which have targeted U.S. infrastructure, as well as Russia’s documented history of cyberattacks.

Key Provisions of the Rule

The Department of Commerce’s final rule includes the following restrictions:

• Import Bans: Prohibition of vehicle connectivity systems (VCS) and automated driving systems (ADS) originating from the PRC and Russia.
• Phased Implementation: Restrictions on software will apply to Model Year 2027, while hardware restrictions will take effect in Model Year 2030.
• Market Exclusion: Connected vehicles from entities owned or controlled by the PRC or Russia, even if manufactured in the U.S., will be banned starting with Model Year 2027.

The rule also paves the way for future regulations targeting commercial vehicles weighing over 10,000 pounds, citing their heightened risk to national security.

Collaborative Approach

The administration emphasized a balanced approach to minimize market disruption while maximizing national security. Extensive consultations were held with industry leaders and international allies, including a multinational summit on connected vehicle cybersecurity in July 2024.

Challenging the global automotive sector’s reliance on foreign technology, the rule aims to establish robust cybersecurity standards and encourage domestic innovation.

Broader Implications

Beyond protecting against cyber threats, the administration highlighted the risks of mass data collection by foreign actors, including geolocation tracking and behavioral analysis. By addressing these concerns, the rule not only fortifies cybersecurity but also safeguards American privacy.

“The automotive industry is vital to our economy and way of life,” Secretary of Commerce Gina Raimondo stated. “These measures reflect our unwavering commitment to securing U.S. infrastructure against foreign threats.”

The Biden administration’s actions mark a pivotal moment in reshaping the future of connected vehicles, setting a precedent for safeguarding technology in an era of growing cyber threats. As implementation begins, the U.S. government and private sector will continue to collaborate to ensure the safety, security, and resilience of critical supply chains.