,,ii #aaf? ,,congress #a/ ,session ,s4 #bahb ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,july #ah1 #bjai,mr4 ,m>key 7= himself & ,mr4 ,blum5?al7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to protect consum]s f security & privacy ?reats to _! motor vehicles1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,security & ,privacy 9 ,y\r ,c> ,act ( #bjai or ! ,,spy ,c> ,act ( #bjai4 #b4 ,cyb]security /&>ds = motor vehicles 7a7 ,9 g5]al ,*apt] #cja ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #cjabh ! foll[+3 #cjabi4 ,cyb]security /&>ds 7a7 ,def9itions ,9 ?is section3 7#a7 ,critical s(tw>e sy/ems ,! t]m critical s(tw>e sy/ems means s(tw>e sy/ems t c affect-- 7,a7 ! control by ! driv] ( ! vehicle movem5t2 or 7,b7 ! safety features ( ! vehicle4 7#b7 ,driv+ data ,! t]m driv+ data includes any electronic in=mation collect$ ab\t-- 7,a7 ! /atus ( a vehicle1 includ+ ! location & spe$ ( ! vehicle2 & 7,b7 any own]1 lessee1 driv]1 or pass5g] ( a vehicle4 7#c7 ,entry po9t ,! t]m entry po9t includes a means by :i*-- 7,a7 driv+ data may be access$1 directly or indirectly2 or 7,b7 a control signal may be s5t or receiv$ ei!r wirelessly or ?r\gh wir$ connections4 7#d7 ,hack+ ,! t]m hack+ means ! unau?oriz$ access to electronic controls1 critical s(tw>e sy/ems1 or driv+ data1 ei!r wirelessly or ?r\gh wir$ connections4 7b7 ,cyb]security /&>ds 7#a7 ,requirem5t ,all motor vehicles manufactur$ = sale 9 ! ,unit$ ,/ates on or aft] ! date t is #b ye>s aft] ! date on :i* regulations are promulgat$ pursuant to section #b7;c77#b7 ( ! ,,spy ,c> ,act ( #bjai %all comply ) ! cyb]security /&>ds "u p>agraphs 7#b7 ?r\gh 7#d74 7#b7 ,protection aga9/ hack+ 7,a7 ,9 g5]al ,all entry po9ts to ! electronic sy/ems ( ea* motor vehicle manufactur$ = sale 9 ! ,unit$ ,/ates %all be equipp$ ) reasonable measures to protect aga9/ hack+ attacks4 7,b7 ,isolation measures ,! measures ref]r$ to 9 subp>agraph 7,a7 %all incorporate isolation measures to sep>ate critical s(tw>e sy/ems f noncritical s(tw>e sy/ems4 7,c7 ,evaluation ,! measures ref]r$ to 9 subp>agraph 7,a7 %all be evaluat$ = security vuln]abilities foll[+ be/ security practices1 includ+ appropriate applications ( te*niques su* z p5etration te/+4 7,d7 ,adju/m5t ,! measures ref]r$ to 9 subp>agraph 7,a7 %all be adju/$ & updat$ bas$ on ! results ( ! evaluation "u subp>agraph 7,c74 7#c7 ,security ( collect$ in=mation ,all driv+ data collect$ by ! electronic sy/ems t are built into motor vehicles %all be reasonably secur$ to prev5t unau?oriz$ access-- 7,a7 :ile ! data is /or$ onbo>d ! vehicle2 7,b7 :ile ! data is 9 transit f ! vehicle to ano!r location2 & 7,c7 9 any subsequ5t (fbo>d /orage or use ( ! data4 7#d7 ,detection1 report+1 & respond+ to hack+ ,any motor vehicle manufactur$ = sale 9 ! ,unit$ ,/ates t pres5ts an entry po9t %all be equipp$ ) capabilities to imm$iately detect1 report1 & /op attempts to int]cept driv+ data or control ! vehicle4 4 7b7 ,civil p5alties ,section #cjafe7;a77#a7 ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ #cjabi1 aft] #cjabg14 7c7 ,rulemak+ 7#a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator ( ! ,national ,highway ,traffic ,safety ,adm9i/ration 7ref]r$ to 9 ?is subsection z ! ,adm9i/rator71 aft] consultation ) ! ,f$]al ,trade ,commission1 %all issue a notice ( propos$ rulemak+ to c>ry out section #cjabi ( title #di1 ,unit$ ,/ates ,code4 7#b7 ,f9al regulations ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator1 aft] consultation ) ! ,f$]al ,trade ,commission1 %all promulgate f9al regulations to c>ry out section #cjabi ( title #di1 ,unit$ ,/ates ,code4 7#c7 ,updates ,n lat] ?an #c ye>s aft] f9al regulations are promulgat$ pursuant to p>agraph 7#b7 & n less frequ5tly ?an once e #c ye>s !reaft]1 ! ,adm9i/rator1 aft] consultation ) ! ,f$]al ,trade ,commission1 %all-- 7,a7 review ! f9al regulations promulgat$ pursuant to p>agraph 7#b72 & 7,b7 update ! f9al regulations1 z necess>y4 7d7 ,cl]ical am5dm5t ,! table ( sections = *apt] #cja ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] ! item relat+ to section #cjabh ! foll[+3 #cjabi4 ,cyb]security /&>ds4 4 #c4 ,cyb] da%bo>d 7a7 ,9 g5]al ,section #cbcjb ( title #di1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 7e7 ,cyb] da%bo>d 7#a7 ,9 g5]al ,all motor vehicles manufactur$ = sale 9 ! ,unit$ ,/ates on or aft] ! date t is #b ye>s aft] ! date on :i* f9al regulations are promulgat$ pursuant to section #c7;b77#b7 ( ! ,,spy ,c> ,act ( #bjai %all display a cyb] da%bo>d z a compon5t ( ! label requir$ to be affix$ to ea* motor vehicle "u section #c ( ! ,automobile ,in=mation ,disclosure ,act 7#ae ,u4,s4,c4 #abcb74 7#b7 ,features ,! cyb] da%bo>d requir$ "u p>agraph 7#a7 %all in=m consum]s1 ?r\gh an easy to und]/&1 /&>diz$ graphic1 ab\t ! ext5t to :i* ! motor vehicle protects ! cyb]security & privacy ( motor vehicle own]s1 lessees1 driv]s1 & pass5g]s beyond ! m9imum requirem5ts "u section #cjabi ( ?is title & 9 section #bg ( ! ,f$]al ,trade ,commission ,act4 4 7b7 ,rulemak+ 7#a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator ( ! ,national ,highway ,traffic ,safety ,adm9i/ration 7ref]r$ to 9 ?is subsection z ! ,adm9i/rator71 aft] consultation ) ! ,f$]al ,trade ,commission1 %all issue a notice ( propos$ rulemak+ = ! cyb]security & privacy in=mation requir$ to be display$ "u section #cbcjb7;e7 ( title #di1 ,unit$ ,/ates ,code4 7#b7 ,f9al regulations ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator1 aft] consultation ) ! ,f$]al ,trade ,commission1 %all promulgate f9al regulations to c>ry out section #cbcjb7;e7 ( title #di1 ,unit$ ,/ates ,code4 7#c7 ,updates ,n less frequ5tly ?an once e #c ye>s1 ! ,adm9i/rator1 aft] consultation ) ! ,f$]al ,trade ,commission1 %all-- 7,a7 review ! f9al regulations promulgat$ pursuant to p>agraph 7#b72 & 7,b7 update ! f9al regulations1 z necess>y4 #d4 ,privacy /&>ds = motor vehicles 7a7 ,9 g5]al ,! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 is am5d$ by ins]t+ aft] section #bf 7#ae ,u4,s4,c4 #eg;c-#b7 ! foll[+3 #bg4 ,privacy /&>ds = motor vehicles 7a7 ,def9itions ,9 ?is section3 7#a7 ,cov]$ motor vehicle ,! t]m cov]$ motor vehicle means a motor vehicle t-- 7,a7 is manufactur$ = sale 9 ! ,unit$ ,/ates on or aft] ! date t is #b ye>s aft] ! date on :i* f9al regulations are promulgat$ "u section #d7;b7 ( ! ,,spy ,c> ,act ( #bjai2 & 7,b7 collects driv+ data4 7#b7 ,driv+ data ,! t]m driv+ data has ! mean+ giv5 ! t]m 9 section #cjabi7;a7 ( title #di1 ,unit$ ,/ates ,code4 7b7 ,requirem5t ,ea* cov]$ motor vehicle %all comply ) ! requirem5ts describ$ 9 subsections 7c7 ?r\gh 7e74 7c7 ,transp>5cy ,ea* manufactur] ( a cov]$ motor vehicle %all provide to ea* own] & lessee ( ! cov]$ motor vehicle a cle> & conspicu\s notice1 9 cle> & pla9 language1 ( any collection1 transmission1 ret5tion1 or use ( driv+ data collect$ f ! cov]$ motor vehicle4 7d7 ,consum] control 7#a7 ,9 g5]al ,subject to p>agraphs 7#b7 & 7#c71 an own] or lessee ( a cov]$ motor vehicle may opt out ( ! collection & ret5tion ( driv+ data by ! cov]$ motor vehicle4 7#b7 ,access to navigation tools ,if an own] or lessee ( a cov]$ motor vehicle opts out ( ! collection & ret5tion ( driv+ data "u p>agraph 7#a71 ! own] or lessee %all n1 to ! ext5t te*nically possible1 lose access to any navigation tool or o!r feature or capability4 7#c7 ,exception ,p>agraph 7#a7 %all n apply to driv+ data /or$ z "p ( ! electronic data record] sy/em or o!r safety sy/ems on bo>d ! motor vehicle t are requir$ = po/-incid5t inve/igations1 emissions hi/ory *ecks1 cra% avoidance or mitigation1 or o!r regulatory compliance programs4 7e7 ,limitation on use ( p]sonal driv+ in=mation 7#a7 ,9 g5]al ,no manufactur]1 includ+ an orig9al equipm5t manufactur]1 may use any in=mation collect$ by a cov]$ motor vehicle = ! purpose ( adv]tis+ or m>ket+ )\t ! affirmative1 express cons5t ( ! own] or lessee ( ! cov]$ motor vehicle4 7#b7 ,reque/s ,any reque/ = ! cons5t "u p>agraph 7#a7 by a manufactur]-- 7,a7 %all be cle> & conspicu\s2 7,b7 %all be made 9 cle> & pla9 language2 & 7,c7 may n be a condition = ! use ( any nonm>ket+ feature1 capability1 or functionality ( ! cov]$ motor vehicle4 7f7 ,en=cem5t ,a violation ( ?is section %all be treat$ z a violation ( a rule def9+ an unfair or deceptive act or practice prescrib$ "u section #ah7;a77#a77;,b74 4 7b7 ,rulemak+ 7#a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,f$]al ,trade ,commission1 aft] consultation ) ! ,adm9i/rator ( ! ,national ,highway ,traffic ,safety ,adm9i/ration 7ref]r$ to 9 ?is subsection z ! ,adm9i/rator71 %all issue a notice ( propos$ rulemak+1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 to c>ry out section #bg ( ! ,f$]al ,trade ,commission ,act4 7#b7 ,f9al regulations ,n lat] ?an #c ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,f$]al ,trade ,commission1 aft] consultation ) ! ,adm9i/rator1 %all promulgate f9al regulations1 9 accordance ) section #eec ( title #e1 ,unit$ ,/ates ,code1 to c>ry out section #bg ( ! ,f$]al ,trade ,commission ,act4 7#c7 ,updates ,n less frequ5tly ?an once e #c ye>s1 ! ,f$]al ,trade ,commission1 aft] consultation ) ! ,adm9i/rator1 %all-- 7,a7 review ! f9al regulations promulgat$ "u p>agraph 7#b72 & 7,b7 update ! f9al regulations z necess>y4 #e4 ,cyb]security tools & cyb] coord9ator 7a7 ,def9itions ,9 ?is section3 7#a7 ,adm9i/rator ,! t]m ,adm9i/rator means ! ,adm9i/rator ( ! ,f$]al ,highway ,adm9i/ration4 7#b7 ,cyb] incid5t ,! t]m cyb] incid5t has ! mean+ giv5 ! t]m significant cyb] incid5t 9 ,presid5tial ,policy ,directive-#da 7,july #bf1 #bjaf1 relat+ to cyb] incid5t coord9ation74 7#c7 ,transportation au?ority ,! t]m transportation au?ority means-- 7,a7 a public au?ority 7z def9$ 9 section #aja7;a7 ( title #bc1 ,unit$ ,/ates ,code72 7,b7 an own] or op]ator ( a highway 7z def9$ 9 section #aja7;a7 ( title #bc1 ,unit$ ,/ates ,code72 7,c7 a manufactur] t manufactures a product relat$ to transportation2 & 7,d7 a division (fice ( ! ,f$]al ,highway ,adm9i/ration4 7b7 ,cyb]security tool 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator %all develop a tool to assi/ transportation au?orities 9 id5tify+1 detect+1 protect+ aga9/1 respond+ to1 & recov]+ f cyb] incid5ts4 7#b7 ,requirem5ts ,9 develop+ ! tool "u p>agraph 7#a71 ! ,adm9i/rator %all-- 7,a7 use ! cyb]security framework e/abli%$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology & requir$ by ,executive ,ord] #acfcf ( ,febru>y #ab1 #bjac 7#gh ,f$4 ,reg4 #aagci2 relat+ to improv+ critical infra/ructure cyb]security72 7,b7 e/abli% a /ructur$ cyb]security assessm5t & developm5t program2 7,c7 consult ) appropriate transportation au?orities1 op]at+ ag5cies1 indu/ry /akehold]s1 & cyb]security exp]ts2 & 7,d7 provide = a p]iod ( public comm5t & review on ! tool4 7c7 ,designation ( cyb] coord9ator 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,adm9i/rator %all designate an (fice z a cyb] coord9ator1 :i* %all be responsible = monitor+1 al]t+1 & advis+ transportation au?orities ( cyb] incid5ts4 7#b7 ,requirem5ts ,! (fice designat$ "u p>agraph 7#a7 %all-- 7,a7 provide to transportation au?orities a secure me?od ( notify+ a s+le ,f$]al entity ( cyb] incid5ts2 7,b7 monitor cyb] incid5ts t affect transportation au?orities2 7,c7 al]t transportation au?orities to cyb] incid5ts t affect ^? transportation au?orities2 7,d7 inve/igate unaddress$ cyb] incid5ts t affect transportation au?orities2 & 7,e7 provide to transportation au?orities educational res\rces1 outrea*1 & aw>5ess on fundam5tal pr9ciples & be/ practices 9 cyb]security = transportation sy/ems4