Key points included increased reporting requirements for the National Highway Traffic Safety Administration (NHTSA), a comprehensive plan to improve recall completion rates and a series of directives to the automakers, designed to better protect consumer privacy and prevent vehicle hacking.
Mark Rosekind, NHTSA administrator, and Maneesha Mithal, associate director of the Division of Privacy and Identity Protection at the Federal Trade Commission (FTC), served as the hearing’s key witnesses. They were joined by a panel of select automotive industry representatives.
In her testimony, Mithal expressed her concern with some of the provisions in the discussion draft, specifically noting potential research complications that could arise from prohibiting all unauthorized access of electronic vehicle data. She explained that security researchers help hold automakers responsible to produce the best product by informing them of system vulnerabilities. Mithal also warned against an overrepresentation of automakers in the proposed “Automotive Cybersecurity Advisory Council,” saying, “Because any best practices approved by the Council will be ‘by a simple majority of members,’ manufacturers alone could decide what best practices would be adopted...The proposed legislation, as drafted, could substantially weaken the security and privacy protections that consumers have today.”
Rosekind’s testimony took a similar route, highlighting NHTSA’s responsibility to the public to set safety standards. He also acknowledged concerns with the draft and said, “The Committee’s discussion draft includes an important focus on cybersecurity, privacy, and technology innovations, but the current proposals may have the opposite of their intended effect. By providing regulated entities majority representation on committees to establish appropriate practices and standards ... the proposals could seriously undermine NHTSA’s efforts to ensure safety.”
Rosekind also noted that the discussion draft included a requirement that state departments of motor vehicles (DMV) notify vehicle owners of recalled vehicles when they register their vehicle or renew their registration with the state DMV. He said in his testimony, “State agencies are one potential touch-point for owners, especially second or third owners of used vehicles. But the costs to establish or maintain such a system are unknown and the technology is not yet in place, which is why Grow America proposed a pilot program to work through these issues.”
At the Automotive Service Association’s Vehicle Safety Forum last year in Philadelphia, repairers discussed the option of state DMV’s informing vehicle owners about recalls and including this as part of the state vehicle inspection process for those states that have vehicle safety inspection programs.