HR 3684 Preliminary Review - INVEST in America Act

Last week, Rep DeFazio (D,OR) introduced HR 3684, the Investing in a New Vision for the Environment and Surface Transportation (INVEST) in America Act. This is the FY 2022 surface transportation authorization bill. This is just the preliminary review of the 1249-page bill. We have three limited cybersecurity related provisions, two hazardous material transportation provisions and one slightly odd provision that may be of interest.

Cybersecurity Related Provisions

§5303 – National highly automated vehicle and mobility innovation clearinghouse (pg 960)

Adds new §5507 to 49 USC, National highly automated vehicle and mobility innovation clearinghouse.

§5304 – Study on safe interactions between automated vehicles and road users (pg 962)

Includes the phrase “a cybersecurity threat to the operation of the vehicle” in discussing the considerations of when a ‘driver’ needs to be able to resume manual control.

§9217 – Amtrak  cybersecurity enhancement and resiliency grant program (pg 1135)

Adds new §24325 to 49 USC, Amtrak cybersecurity enhancement and resiliency grant program.

HAZMAT Transportation Provisions

§8202 – Transportation of liquefied natural gas by rail tank car (pg 1035)

Provides for stay of authorization for transportation of liquefied natural gas by tank car pending additional studies.

§8203 – Hazardous materials training requirements and grants (pg 1041)

Adds new (j) to 49 USC  49 USC 5107, assistance with local emergency responder training

Other Provisions

§3012 – Electronic driver’s license (pg 808)

Amends Real ID Act of 2005 and 18 USC 1028 to add the words ‘digital driver’s license’ without any definition.

Commentary

I am only going to comment on the last provision described above. Comments on other provisions will be held until a later, more detailed post.

Section 3012 is a very brief, 10-line bit of legislative language. It simply adds the word ‘digital driver’s license’ to two separate bits of US Code. This potentially disruptive change in the most common government identification document in the United States is being made in the least complicated method possible. It will, in effect, authorize the development of an electronic identification document without providing any guidance on what the minimum requirement will be for that document, describing what data protection requirements will be required, or establishing even minimal cybersecurity requirements would be for the document.

In my opinion, this provision needs to be greatly expanded in the amount of detail provided or simply be removed. There is not even any discussion about the potential need for such a document. We need to discuss this before it gets shoved into the nether regions of a piece of legislation like this.