,,ii #aaith ,,congress #b;d ,session ,s4 #ddbi ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #bi1 #bjbf,mr4 ,moreno 7for himself and ,ms4 ,slotkin7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to prohibit the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of connected vehicles and related software and hardware associated with foreign adversaries4 #a4 ,short title ,this ,act may be cited as the ,connected ,vehicle ,security ,act of #bjbf4 #b4 ,findings ,congress makes the following findings3 7#a7 ,the ,united ,states automotive industry is critical to the national economy1 supporting millions of jobs1 supply chains1 and advanced manufacturing4 ,the introduction of vehicles and components controlled by foreign adversaries threatens ,united ,states economic security1 industrial competitiveness1 and technological leadership4 7#b7 ,the ,people's ,republic of ,china has rapidly expanded its automotive manufacturing capacity and is increasingly targeting export markets4 ,despite having the largest market in the world1 the ,people's ,republic of ,china exports nearly #h1jjj1jjj vehicles annually1 approximately twice the volume exported by any other country1 demonstrating the scale at which vehicles and components controlled by a foreign adversary may enter global markets1 including the ,united ,states4 7#c7 ,connected vehicles incorporate advanced information and communications technologies that collect1 process1 and transmit vast amounts of sensitive data1 including geolocation1 operational1 and personal information1 and are capable of being remotely accessed and controlled4 7#d7 ,in ,executive ,order #achgc 7#ej ,u4,s4,c4 #agja note2 relating to securing the information and communications technology and services supply chain71 the ,president declared a national emergency with respect to the threat posed by foreign adversaries creating and exploiting vulnerabilities in information and communications technology and services4 7#e7 ,the access1 control1 or influence of vehicle connectivity systems or automated driving systems by foreign adversaries creates substantial economic and national security risks to the ,united ,states1 including risks of surveillance1 espionage1 cyber intrusion1 and disruption of critical infrastructure4 ,such risks fall within the scope of the national emergency described in ,executive ,order #achgc and pose an unacceptable threat to the security and resilience of the ,united ,states4 #c4 ,definitions ,in this ,act3 7#a7 ,automated driving system ,the term automated driving system means hardware and software that1 collectively1 are capable of performing the entire dynamic driving task for a connected vehicle on a sustained basis1 regardless of whether it is limited to a specific operational design domain4 7#b7 ,connected vehicle 7,a7 ,in general ,except as provided by subparagraph 7,b71 the term connected vehicle means a vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets1 roads1 and highways1 that-- 7i7 integrates onboard networked hardware with automotive software systems to communicate via dedicated short-range communication1 cellular telecommunications connectivity1 satellite communication1 or other wireless spectrum connectivity with any other network or device2 or 7ii7 is designed1 manufactured1 or originally equipped to communicate via such methods1 regardless of whether such capability is enabled1 disabled1 or removed at the time of importation1 manufacture1 sale1 resale1 or introduction of the vehicle into interstate commerce in the ,united ,states4 7,b7 ,exclusion ,the term connected vehicle does not include a vehicle operated only on a rail line4 7#c7 ,connected vehicle hardware ,the term connected vehicle hardware means-- 7,a7 a vehicle connectivity system2 and 7,b7 vehicle connectivity system hardware4 7#d7 ,country of origin ,the term country of origin1 with respect to an item1 means the country-- 7,a7 in which the item is manufactured2 or 7,b7 the government of which owns or controls1 or has jurisdiction or direction over-- 7i7 the entity manufacturing the item2 or 7ii7 the entity supplying the item4 7#e7 ,covered country ,the term covered country means-- 7,a7 the ,democratic ,people's ,republic of ,north ,korea2 7,b7 the ,people's ,republic of ,china2 7,c7 the ,russian ,federation2 and 7,d7 the ,islamic ,republic of ,iran4 7#f7 ,covered software ,the term covered software-- 7,a7 means the software-based components installed in or on a connected vehicle1 or designed to be installed in or on a connected vehicle1 including application1 middleware1 and system software1 executed by the primary processing unit or units of an item that directly enables the function of a vehicle connectivity system or automated driving system at the vehicle level2 and 7,b7 includes any machine-learning model or other artificial intelligence component that directly enables decision-making or control of an automated driving system at the vehicle level4 7#g7 ,electric vehicle ,the term electric vehicle has the meaning given that term in section #c of the ,electric and ,hybrid ,vehicle ,research1 ,development1 and ,demonstration ,act of #aigf 7#ae ,u4,s4,c4 #bejb74 7#h7 ,importation ,the term importation has the meaning given the term import in section #ajja of the ,controlled ,substances ,import and ,export ,act 7#ba ,u4,s4,c4 #iea74 7#i7 ,resale 7,a7 ,in general ,the term resale1 with respect to an item1 means the transfer of ownership of the item by an individual or entity that acquired the item for the purpose of transfer in the ordinary course of business1 and not for the use of or consumption by the individual or entity4 7,b7 ,exclusion ,the term resale does not include the transfer of a connected vehicle that was previously titled or registered to1 and used by1 a consumer or end-user or was acquired for bona fide use1 lease1 or operation by the individual or entity transferred the vehicle4 7#aj7 ,safety equipment ,the term safety equipment1 with respect to a vehicle1 means air bags1 air bag inflators1 and seatbelt systems4 7#aa7 ,secretary ,the term ,secretary means the ,secretary of ,commerce1 acting through the ,under ,secretary of ,commerce for ,industry and ,security4 7#ab7 ,transaction ,the term transaction-- 7,a7 means any acquisition1 importation1 transfer1 installation1 dealing in1 or use of any item subject to a prohibition under section #d7;a71 including ongoing activities1 such as managed services1 data transmission1 software updates1 repairs1 or the platforming or data hosting of applications for consumer download2 and 7,b7 includes-- 7i7 any other transaction1 the structure of which is designed or intended to evade or circumvent this ,act2 and 7ii7 a class of transactions4 7#ac7 ,vehicle connectivity system ,the term vehicle connectivity system means a vehicle connectivity system hardware or covered software item installed in or on a connected vehicle1 or designed to be installed in or on a connected vehicle1 that directly enables the function of transmission1 receipt1 conversion1 or processing of radio frequency communications at a frequency over #dej megahertz4 7#ad7 ,vehicle connectivity system hardware ,the term vehicle connectivity system hardware-- 7,a7 means software-enabled or programmable components that-- 7i7 are installed in or on a connected vehicle or designed to be installed in or on a connected vehicle2 7ii7 are directly connected to a vehicle connectivity system2 and 7iii7 directly enable the function of a vehicle connectivity system or are part of an item that directly enables the function of a vehicle connectivity system2 and 7,b7 includes-- 7i7 microcontrollers1 microcomputers or modules1 systems on a chip1 networking or telematics units1 cellular modem_/modules1 ,wi-,fi microcontrollers or modules1 ,bluetooth microcontrollers or modules1 satellite communication systems1 other wireless communication microcontrollers or modules1 external antennas1 digital signal processors1 and field-programmable gate arrays2 7ii7 electronic systems integrated into a battery that directly enable or control the monitoring1 management1 security1 or external communication of battery performance or operation1 including any transmitter or interface component that performs such functions2 and 7iii7 safety equipment4 #d4 ,prohibition on connected vehicles and other transactions that threaten economic or national security 7a7 ,prohibitions 7#a7 ,connected vehicles ,on and after ,january #a1 #bjbg1 the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of a connected vehicle is prohibited if-- 7,a7 the country of origin of the connected vehicle is a covered country or the connected vehicle is designed within a covered country1 without regard to whether-- 7i7 at the time of importation1 sale1 resale1 or introduction1 the vehicle is equipped with any covered software or connected vehicle hardware subject to a prohibition under paragraph 7#b7 or 7#c72 or 7ii7 any such covered software or connected vehicle hardware-- 7,i7 is removed from the vehicle before importation1 sale1 resale1 or introduction2 or 7,,ii7 will be installed after importation1 sale1 resale1 or introduction2 or 7,b7 the manufacturer of the connected vehicle is a joint venture1 subsidiary1 or other entity in which more than #ae percent of the equity interest1 voting interest1 board representation1 or other indicia of control1 whether directly or indirectly1 is owned or controlled by an entity1 or combination of entities1 organized under the laws of1 or with its principal place of business in1 a covered country4 7#b7 ,covered software ,on and after ,january #a1 #bjbg1 the integration of covered software into a connected vehicle that is imported1 manufactured1 sold1 resold1 or introduced into interstate commerce into the ,united ,states is prohibited if-- 7,a7 the country of origin of the covered software is a covered country2 or 7,b7 the developer of the software-- 7i7 is organized under the laws of1 or has its principal place of business in1 a covered country2 or 7ii7 is a joint venture1 subsidiary1 or other entity in which more than #be percent of the equity interest1 voting interest1 board representation1 or other indicia of control1 whether directly or indirectly1 is owned or controlled by an entity1 or combination of entities1 described in clause 7i74 7#c7 ,connected vehicle hardware 7,a7 ,in general ,on and after ,january #a1 #bjcj1 the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of any connected vehicle hardware is prohibited if-- 7i7 the country of origin of the hardware is a covered country2 or 7ii7 the manufacturer of the hardware-- 7,i7 is organized under the laws of1 or has its principal place of business in1 a covered country2 or 7,,ii7 is a joint venture1 subsidiary1 or other entity in which more than #be percent of the equity interest1 voting interest1 board representation1 or other indicia of control1 whether directly or indirectly1 is owned or controlled by an entity1 or combination of entities1 described in subclause 7,i74 7,b7 ,repair and warranty ,the prohibition under subparagraph 7,a7 shall not apply to connected vehicle hardware that is imported1 manufactured1 sold1 resold1 or introduced into interstate commerce in the ,united ,states for the purpose of repair or under warranty for a connected vehicle with a model year before model year #bjcj4 7#d7 ,additional items ,subject to an applicable ruling or advisory opinion issued under subsection 7d71 a prohibition under paragraph 7#a71 7#b71 or 7#c7 applies with respect to a connected vehicle1 covered software1 or connected vehicle hardware1 as the case may be1 that is renamed1 rebranded1 restructured1 or altered to circumvent the prohibition4 7#e7 ,exception ,the prohibitions under paragraphs 7#a71 7#b71 and 7#c7 shall not apply to the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of a connected vehicle1 covered software1 or connected vehicle hardware1 as the case may be1 for the sole purpose of testing and evaluation by an entity that-- 7,a7 is organized under the laws of a ,state in the ,united ,states2 7,b7 does not have its principal place of business in a covered country2 and 7,c7 is not #be percent or more1 whether directly or indirectly1 owned or controlled by an entity1 or combination of entities1 organized under the laws of1 or with its principal place of business in1 a covered country4 7b7 ,related transactions 7#a7 ,in general ,the ,secretary shall prescribe regulations1 pursuant to section #eec of title #e1 ,united ,states ,code1 to prohibit any specific transaction relating to connected vehicles1 including the importation1 sale1 distribution1 integration1 or use of a connected vehicle1 covered software1 connected vehicle hardware1 or any other item subject to a prohibition under subsection 7a71 that the ,secretary determines poses an undue or unacceptable threat to the economic or national security of the ,united ,states4 7#b7 ,notice ,if the ,secretary prohibits a transaction under paragraph 7#a71 the ,secretary shall deliver1 by certified ,united ,states mail1 to the parties to the transaction a notice of the prohibition that includes an identification1 by name1 of the specific item that the ,secretary determines poses an undue or unacceptable threat to the economic or national security of the ,united ,states4 7c7 ,authorizations 7#a7 ,issuance 7,a7 ,in general ,the ,secretary1 in consultation with the ,secretary of ,defense1 the ,secretary of ,transportation1 the ,secretary of ,state1 and the ,secretary of ,energy1 may issue a general or specific authorization for the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of an item that would otherwise be subject to the prohibitions under subsection 7a7 if-- 7i7 the ,secretary determines1 based on clear and convincing evidence and a written risk assessment1 that the importation1 manufacture1 sale1 resale1 or introduction of the item does not pose1 and is not reasonably likely to pose-- 7,i7 an undue risk of data exfiltration from1 or remote manipulation or operation of1 a connected vehicle2 7,,ii7 a risk to critical infrastructure or the integrity of the industrial base of the ,united ,states2 or 7,,iii7 any other risk to the national security of the ,united ,states2 7ii7 not less than #fj days before the authorization takes effect1 the ,secretary submits to ,congress a detailed written notification1 including the determination under clause 7i7 and underlying analysis1 including the written risk assessment2 and 7iii7 during the #fj-;day period described in clause 7ii71 there is not enacted into law a joint resolution of disapproval with respect to the authorization of the item4 7,b7 ,continued validity and modification and revocation of authorizations 7i7 ,continued validity of existing authorizations ,except as provided by clauses 7ii7 and 7iii71 any general or specific authorization issued under subparagraph 7,a7 or subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 before ,january #a1 #bjcj1 shall remain in effect until ,january #a1 #bjcb1 unless modified1 suspended or revoked under clause 7ii74 7ii7 ,modification or revocation of general or specific authorizations ,the ,secretary may1 at any time1 modify1 suspend1 or revoke a general or specific authorization described in clause 7i7 if the ,secretary-- 7,i7 determines that the authorization no longer satisfies the requirements of subparagraph 7,a77i72 and 7,,ii7 provides the public with an opportunity to comment before modifying1 suspending1 or revoking the authorization4 7#b7 ,publication of list of authorized items 7,a7 ,in general ,the ,secretary shall publish1 pursuant to section #eec of title #e1 ,united ,states ,code1 and maintain a list of the items the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of which is authorized under paragraph 7#a74 ,the initial such list shall be published not later than ,january #a1 #bjbg4 7,b7 ,inclusions 7i7 ,in general ,to the extent possible1 the ,secretary shall include1 in the list required by subparagraph 7,a71 the manufacturer and product name for each item on the list4 7ii7 ,other identifying characteristics ,when it is not possible to include1 in the list required by subparagraph 7,a71 the manufacturer and product name for an item1 the ,secretary shall provide technical criteria sufficient to enable the automotive industry and importers to determine without undue difficulty whether the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of an item is authorized under paragraph 7#a74 ,in carrying out this clause1 the ,secretary shall protect intellectual property to the extent practicable4 7iii7 ,risk assessment ,to the extent possible1 the ,secretary shall include1 in the list required by subparagraph 7,a71 a detailed explanation about why each item on the list does not pose an undue risk described in subparagraph 7,a7 or 7,b7 of paragraph 7#a74 7#c7 ,requests for authorization ,not later than ,january #a1 #bjbg1 the ,secretary shall establish a procedure pursuant to which an importer1 manufacturer1 supplier1 or seller or reseller may seek the authorization under paragraph 7#a7 of the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of an item described in subsection 7a7 that would otherwise be subject to the prohibitions under that subsection4 7d7 ,rulings and advisory opinions 7#a7 ,in general ,not later than ,january #a1 #bjbg1 the ,secretary shall establish a procedure pursuant to which an importer1 manufacturer1 or seller or reseller may seek a binding ruling or advisory opinion with respect to whether-- 7,a7 the importation1 manufacture1 sale1 resale1 or introduction into interstate commerce in the ,united ,states of an item is or is not prohibited under this section2 or 7,b7 a connected vehicle1 covered software1 or connected vehicle hardware has been renamed1 rebranded1 restructured1 or altered to circumvent the prohibitions under subsection 7a74 7#b7 ,timing ,the ,secretary shall issue a ruling or advisory opinion under paragraph 7#a7 with respect to an item not later than #de days after receiving an application supported by a reasonably clear description of the item4 7#c7 ,publication 7,a7 ,in general ,the ,secretary shall-- 7i7 publish a list of the items for which the ,secretary has issued rulings and advisory opinions under paragraph 7#a72 and 7ii7 update that list not less frequently than annually4 7,b7 ,prohibition on publication of identifying information ,the ,secretary shall not publish the name of1 or other information that might reasonably identify1 the party that requested the ruling or advisory opinion4 7#d7 ,continued validity of existing rulings and opinions ,except as provided by paragraph 7#e71 a ruling or advisory opinion issued under this subsection or subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 before ,january #a1 #bjbg1 shall remain in effect4 7#e7 ,modification or revocation ,the ,secretary may modify1 suspend1 or revoke any binding ruling or advisory opinion issued under paragraph 7#a7 or subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 with respect to an item at any time if the ,secretary determines that the circumstances that led to the ruling or opinion have changed4 7e7 ,declaration of conformity ,the ,secretary shall establish a process under which a person that imports1 manufactures1 sells1 resells1 or introduces into interstate commerce in the ,united ,states a connected vehicle or connected vehicle hardware is required to submit a declaration1 to be known as a declaration of conformity1 to the ,secretary before importing1 manufacturing1 selling1 reselling1 or introducing the vehicle or hardware that certifies that the vehicle or hardware is not subject to a prohibition under subsection 7a74 7f7 ,civil penalties 7#a7 ,in general ,the ,secretary shall assess a civil penalty for each transaction that is a violation of a prohibition under subsection 7a7 in an amount that is not less than the greater of-- 7,a7 #a1ejj1jjj2 or 7,b7 five times the value of the transaction4 7#b7 ,continuing violations ,in the case of a violation that occurs on more than one day1 each day on which the violation continues shall be treated as a separate violation4 7g7 ,classified information ,the ,secretary may rely on classified information in carrying out this section1 which may be submitted to a reviewing court ex parte and in camera4 7h7 ,petitions for review ,the filing in a court of a petition for review shall not stay the effectiveness of any action under this section unless ordered by the court4 #e4 ,use of existing advisory bodies2 interagency coordination 7a7 ,use of existing advisory bodies 7#a7 ,in general ,in carrying out this ,act1 the ,secretary may consult1 as appropriate1 with existing advisory committees of the ,department of ,transportation and other relevant ,federal agencies1 including the ,advisory ,committee on ,automation in ,transportation1 on matters relating to connected vehicles and associated national security risks4 7#b7 ,scope of consultation ,consultation under paragraph 7#a7 may include consideration of-- 7,a7 risks relating to data security1 cybersecurity1 and supply chain integrity associated with connected vehicles2 7,b7 the effectiveness of authorities and regulations issued under this ,act2 7,c7 emerging technologies and threat vectors relevant to connected vehicle ecosystems2 and 7,d7 recommendations made to the ,secretary with respect to regulatory1 enforcement1 and policy measures to mitigate risks described in subparagraph 7,a74 7b7 ,interagency coordination ,in carrying out this ,act1 the ,secretary may consult and coordinate1 as appropriate1 with the ,federal ,communications ,commission and other relevant ,federal agencies to ensure alignment with respect to the scope1 timeline1 and implementation of any prohibitions or restrictions issued under this ,act1 including to avoid duplicative1 inconsistent1 or conflicting regulatory requirements4 #f4 ,reports ,not later than one year after the date of the enactment of this ,act1 and annually thereafter1 the ,secretary shall submit to ,congress a report-- 7#a7 describing activities carried out to enforce the prohibitions under section #d1 including enforcement actions taken and resources utilized2 7#b7 providing a detailed accounting of items covered by such prohibitions during the #a-year period preceding submission of the report2 7#c7 explaining any exclusions1 exemptions1 or determinations made by the ,secretary1 including the rationale and criteria applied2 7#d7 assessing the effectiveness of such prohibitions in decreasing the threats to the economic and national security of the ,united ,states posed by connected vehicles2 7#e7 including metrics on enforcement1 compliance rates1 violations identified1 penalties assessed1 and any identified gaps or challenges2 and 7#f7 making recommendations with respect to further decreasing such threats4 #g4 ,severability2 regulatory continuity 7a7 ,severability ,if any provision of this ,act1 or the application of such provision to any person or circumstance1 is held to be invalid1 the remainder of this ,act1 and the application of the remaining provisions to any person or circumstance1 shall not be affected4 7b7 ,restoration of prior regulations ,if a court of competent jurisdiction enters a final judgment holding invalid or unenforceable a provision of this ,act and supersedes regulations prescribed to carry out section #d1 the ,secretary may1 notwithstanding any other provision of this ,act1 reissue or reinstate1 in whole or in part1 any similar regulations that were in effect on the day before the date of the enactment of this ,act4 #h4 ,interaction with regulations 7a7 ,rule of construction ,nothing in this ,act shall be construed to prohibit1 limit1 or otherwise affect the authority of the ,secretary of ,commerce to implement or administer subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 as added by the final rule of the ,bureau of ,industry and ,security entitled ,securing the ,information and ,communications ,technology and ,services ,supply ,chain3 ,connected ,vehicles 7#ij ,fed4 ,reg4 #ecfj74 7b7 ,delayed implementation for software and hardware not covered by regulations ,in the case of covered software and connected vehicle hardware that is subject to a prohibition under paragraph 7#b7 or 7#c7 of section #d7;a7 and is not subject to subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 as in effect on the day before the date of the enactment of this ,act1 the ,secretary shall implement the prohibition under section #d7;a7 after ,january #a1 #bjcj1 and before ,january #a1 #bjcb4 7c7 ,treatment of prior exclusions 7#a7 ,in general ,subject to paragraph 7#b71 any exclusion or exception to a prohibition under subpart ,d of part #gia of title #ae1 ,code of ,federal ,regulations1 as in effect on the day before the date of the enactment of this ,act1 shall remain valid and shall apply to the prohibitions under section #d7;a74 7#b7 ,rulemaking ,beginning ,january #a1 #bjcj1 the ,secretary shall conduct a rulemaking1 pursuant to section #eec of title #e1 ,united ,states ,code1 to determine whether exclusions or exceptions described in paragraph 7#a7 should be continued1 modified1 or terminated for the purposes of this ,act4