,,ii #aafth ,,congress #ast ,session ,s4 #bahb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ah1 #bjai,mr4 ,markey 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to protect consumers from security and privacy threats to their motor vehicles1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,security and ,privacy in ,your ,car ,act of #bjai or the ,,spy ,car ,act of #bjai4 #b4 ,cybersecurity standards for motor vehicles 7a7 ,in general ,chapter #cja of title #di1 ,united ,states ,code1 is amended by inserting after section #cjabh the following3 #cjabi4 ,cybersecurity standards 7a7 ,definitions ,in this section3 7#a7 ,critical software systems ,the term critical software systems means software systems that can affect-- 7,a7 the control by the driver of the vehicle movement2 or 7,b7 the safety features of the vehicle4 7#b7 ,driving data ,the term driving data includes any electronic information collected about-- 7,a7 the status of a vehicle1 including the location and speed of the vehicle2 and 7,b7 any owner1 lessee1 driver1 or passenger of a vehicle4 7#c7 ,entry point ,the term entry point includes a means by which-- 7,a7 driving data may be accessed1 directly or indirectly2 or 7,b7 a control signal may be sent or received either wirelessly or through wired connections4 7#d7 ,hacking ,the term hacking means the unauthorized access to electronic controls1 critical software systems1 or driving data1 either wirelessly or through wired connections4 7b7 ,cybersecurity standards 7#a7 ,requirement ,all motor vehicles manufactured for sale in the ,united ,states on or after the date that is #b years after the date on which regulations are promulgated pursuant to section #b7;c77#b7 of the ,,spy ,car ,act of #bjai shall comply with the cybersecurity standards under paragraphs 7#b7 through 7#d74 7#b7 ,protection against hacking 7,a7 ,in general ,all entry points to the electronic systems of each motor vehicle manufactured for sale in the ,united ,states shall be equipped with reasonable measures to protect against hacking attacks4 7,b7 ,isolation measures ,the measures referred to in subparagraph 7,a7 shall incorporate isolation measures to separate critical software systems from noncritical software systems4 7,c7 ,evaluation ,the measures referred to in subparagraph 7,a7 shall be evaluated for security vulnerabilities following best security practices1 including appropriate applications of techniques such as penetration testing4 7,d7 ,adjustment ,the measures referred to in subparagraph 7,a7 shall be adjusted and updated based on the results of the evaluation under subparagraph 7,c74 7#c7 ,security of collected information ,all driving data collected by the electronic systems that are built into motor vehicles shall be reasonably secured to prevent unauthorized access-- 7,a7 while the data is stored onboard the vehicle2 7,b7 while the data is in transit from the vehicle to another location2 and 7,c7 in any subsequent offboard storage or use of the data4 7#d7 ,detection1 reporting1 and responding to hacking ,any motor vehicle manufactured for sale in the ,united ,states that presents an entry point shall be equipped with capabilities to immediately detect1 report1 and stop attempts to intercept driving data or control the vehicle4 4 7b7 ,civil penalties ,section #cjafe7;a77#a7 of title #di1 ,united ,states ,code1 is amended by inserting #cjabi1 after #cjabg14 7c7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,administrator of the ,national ,highway ,traffic ,safety ,administration 7referred to in this subsection as the ,administrator71 after consultation with the ,federal ,trade ,commission1 shall issue a notice of proposed rulemaking to carry out section #cjabi of title #di1 ,united ,states ,code4 7#b7 ,final regulations ,not later than #c years after the date of enactment of this ,act1 the ,administrator1 after consultation with the ,federal ,trade ,commission1 shall promulgate final regulations to carry out section #cjabi of title #di1 ,united ,states ,code4 7#c7 ,updates ,not later than #c years after final regulations are promulgated pursuant to paragraph 7#b7 and not less frequently than once every #c years thereafter1 the ,administrator1 after consultation with the ,federal ,trade ,commission1 shall-- 7,a7 review the final regulations promulgated pursuant to paragraph 7#b72 and 7,b7 update the final regulations1 as necessary4 7d7 ,clerical amendment ,the table of sections for chapter #cja of title #di1 ,united ,states ,code1 is amended by inserting after the item relating to section #cjabh the following3 #cjabi4 ,cybersecurity standards4 4 #c4 ,cyber dashboard 7a7 ,in general ,section #cbcjb of title #di1 ,united ,states ,code1 is amended by adding at the end the following3 7e7 ,cyber dashboard 7#a7 ,in general ,all motor vehicles manufactured for sale in the ,united ,states on or after the date that is #b years after the date on which final regulations are promulgated pursuant to section #c7;b77#b7 of the ,,spy ,car ,act of #bjai shall display a cyber dashboard as a component of the label required to be affixed to each motor vehicle under section #c of the ,automobile ,information ,disclosure ,act 7#ae ,u4,s4,c4 #abcb74 7#b7 ,features ,the cyber dashboard required under paragraph 7#a7 shall inform consumers1 through an easy to understand1 standardized graphic1 about the extent to which the motor vehicle protects the cybersecurity and privacy of motor vehicle owners1 lessees1 drivers1 and passengers beyond the minimum requirements under section #cjabi of this title and in section #bg of the ,federal ,trade ,commission ,act4 4 7b7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,administrator of the ,national ,highway ,traffic ,safety ,administration 7referred to in this subsection as the ,administrator71 after consultation with the ,federal ,trade ,commission1 shall issue a notice of proposed rulemaking for the cybersecurity and privacy information required to be displayed under section #cbcjb7;e7 of title #di1 ,united ,states ,code4 7#b7 ,final regulations ,not later than #c years after the date of enactment of this ,act1 the ,administrator1 after consultation with the ,federal ,trade ,commission1 shall promulgate final regulations to carry out section #cbcjb7;e7 of title #di1 ,united ,states ,code4 7#c7 ,updates ,not less frequently than once every #c years1 the ,administrator1 after consultation with the ,federal ,trade ,commission1 shall-- 7,a7 review the final regulations promulgated pursuant to paragraph 7#b72 and 7,b7 update the final regulations1 as necessary4 #d4 ,privacy standards for motor vehicles 7a7 ,in general ,the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 is amended by inserting after section #bf 7#ae ,u4,s4,c4 #eg;c-#b7 the following3 #bg4 ,privacy standards for motor vehicles 7a7 ,definitions ,in this section3 7#a7 ,covered motor vehicle ,the term covered motor vehicle means a motor vehicle that-- 7,a7 is manufactured for sale in the ,united ,states on or after the date that is #b years after the date on which final regulations are promulgated under section #d7;b7 of the ,,spy ,car ,act of #bjai2 and 7,b7 collects driving data4 7#b7 ,driving data ,the term driving data has the meaning given the term in section #cjabi7;a7 of title #di1 ,united ,states ,code4 7b7 ,requirement ,each covered motor vehicle shall comply with the requirements described in subsections 7c7 through 7e74 7c7 ,transparency ,each manufacturer of a covered motor vehicle shall provide to each owner and lessee of the covered motor vehicle a clear and conspicuous notice1 in clear and plain language1 of any collection1 transmission1 retention1 or use of driving data collected from the covered motor vehicle4 7d7 ,consumer control 7#a7 ,in general ,subject to paragraphs 7#b7 and 7#c71 an owner or lessee of a covered motor vehicle may opt out of the collection and retention of driving data by the covered motor vehicle4 7#b7 ,access to navigation tools ,if an owner or lessee of a covered motor vehicle opts out of the collection and retention of driving data under paragraph 7#a71 the owner or lessee shall not1 to the extent technically possible1 lose access to any navigation tool or other feature or capability4 7#c7 ,exception ,paragraph 7#a7 shall not apply to driving data stored as part of the electronic data recorder system or other safety systems on board the motor vehicle that are required for post-incident investigations1 emissions history checks1 crash avoidance or mitigation1 or other regulatory compliance programs4 7e7 ,limitation on use of personal driving information 7#a7 ,in general ,no manufacturer1 including an original equipment manufacturer1 may use any information collected by a covered motor vehicle for the purpose of advertising or marketing without the affirmative1 express consent of the owner or lessee of the covered motor vehicle4 7#b7 ,requests ,any request for the consent under paragraph 7#a7 by a manufacturer-- 7,a7 shall be clear and conspicuous2 7,b7 shall be made in clear and plain language2 and 7,c7 may not be a condition for the use of any nonmarketing feature1 capability1 or functionality of the covered motor vehicle4 7f7 ,enforcement ,a violation of this section shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b74 4 7b7 ,rulemaking 7#a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,federal ,trade ,commission1 after consultation with the ,administrator of the ,national ,highway ,traffic ,safety ,administration 7referred to in this subsection as the ,administrator71 shall issue a notice of proposed rulemaking1 in accordance with section #eec of title #e1 ,united ,states ,code1 to carry out section #bg of the ,federal ,trade ,commission ,act4 7#b7 ,final regulations ,not later than #c years after the date of enactment of this ,act1 the ,federal ,trade ,commission1 after consultation with the ,administrator1 shall promulgate final regulations1 in accordance with section #eec of title #e1 ,united ,states ,code1 to carry out section #bg of the ,federal ,trade ,commission ,act4 7#c7 ,updates ,not less frequently than once every #c years1 the ,federal ,trade ,commission1 after consultation with the ,administrator1 shall-- 7,a7 review the final regulations promulgated under paragraph 7#b72 and 7,b7 update the final regulations as necessary4 #e4 ,cybersecurity tools and cyber coordinator 7a7 ,definitions ,in this section3 7#a7 ,administrator ,the term ,administrator means the ,administrator of the ,federal ,highway ,administration4 7#b7 ,cyber incident ,the term cyber incident has the meaning given the term significant cyber incident in ,presidential ,policy ,directive-#da 7,july #bf1 #bjaf1 relating to cyber incident coordination74 7#c7 ,transportation authority ,the term transportation authority means-- 7,a7 a public authority 7as defined in section #aja7;a7 of title #bc1 ,united ,states ,code72 7,b7 an owner or operator of a highway 7as defined in section #aja7;a7 of title #bc1 ,united ,states ,code72 7,c7 a manufacturer that manufactures a product related to transportation2 and 7,d7 a division office of the ,federal ,highway ,administration4 7b7 ,cybersecurity tool 7#a7 ,in general ,not later than #b years after the date of enactment of this ,act1 the ,administrator shall develop a tool to assist transportation authorities in identifying1 detecting1 protecting against1 responding to1 and recovering from cyber incidents4 7#b7 ,requirements ,in developing the tool under paragraph 7#a71 the ,administrator shall-- 7,a7 use the cybersecurity framework established by the ,national ,institute of ,standards and ,technology and required by ,executive ,order #acfcf of ,february #ab1 #bjac 7#gh ,fed4 ,reg4 #aagci2 relating to improving critical infrastructure cybersecurity72 7,b7 establish a structured cybersecurity assessment and development program2 7,c7 consult with appropriate transportation authorities1 operating agencies1 industry stakeholders1 and cybersecurity experts2 and 7,d7 provide for a period of public comment and review on the tool4 7c7 ,designation of cyber coordinator 7#a7 ,in general ,not later than #b years after the date of enactment of this ,act1 the ,administrator shall designate an office as a cyber coordinator1 which shall be responsible for monitoring1 alerting1 and advising transportation authorities of cyber incidents4 7#b7 ,requirements ,the office designated under paragraph 7#a7 shall-- 7,a7 provide to transportation authorities a secure method of notifying a single ,federal entity of cyber incidents2 7,b7 monitor cyber incidents that affect transportation authorities2 7,c7 alert transportation authorities to cyber incidents that affect those transportation authorities2 7,d7 investigate unaddressed cyber incidents that affect transportation authorities2 and 7,e7 provide to transportation authorities educational resources1 outreach1 and awareness on fundamental principles and best practices in cybersecurity for transportation systems4