Review - BIS Publishes Connected Vehicle Supply Chain Security ANPRM

Today, DOC’s Bureau of Industry and Security (BIS) published an advanced notice of proposed rulemaking (ANPRM) in the Federal Register (89 FR 15066-15072) on “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles”. BIS is looking for public comments on the potential impacts of EO 13873, Securing the Information and Communications Technology and Services Supply Chain, on connected automotive vehicles.

Public Comments

The purpose of this ANPRM is to solicit a wide range of public input into the topics discussed above. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # BIS–2024–0005). Comments should be submitted by April 30^th, 2024.

Commentary

While there is certainly some amount of justification at specifically looking at the vulnerabilities associated with devices and equipment manufactured by Chinese companies associated with ICTS, this should be viewed within the larger construct of vulnerabilities in ICTS in general. This is especially true since various Chinese government and governmentally influenced APT groups have shown a propensity and capability to compromise vulnerabilities in American and allied ICTS products. Targeting Chinese ICTS components cannot be viewed as a solution to the vulnerability of ICTS products, but only as a small part of the necessary efforts to secure those supply chains.

 

For more details about the provisions of this ANPRM, including a look at some of the questions for which BIS is seeking public comment, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bis-publishes-connected-vehicle-supply - subscription required.

BIS Sends Connected Vehicle Supply Chain ANPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an advanced notice of proposed rulemaking from the DOC’s Bureau of Industry and Standards (BIS) on “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles”. This rulemaking was not listed in the Fall 2023 Unified Agenda, so it is not clear what this rule making intends to accomplish. Given that it is a BIS ANPRM I suspect that it deals with export/import controls on select items of connected vehicle technology. 

DOT Announces Connected Vehicle Meeting – 1-16-14

The DOT’s Intelligent Transportation System Joint Program Office (ITS JPO) published a meeting notice in today’s Federal Register (78 FR 78467) concerning a public meeting on January 16^th, 2014, to address the needs for guidelines, tools, resources, and policies that will support the successful implementation and operations of connected vehicle technologies.

The meeting is open to the public and DOT will web cast this meeting. Participants are encouraged to register in advance for participation at this meeting (either in person or via the webinar) at the following web site: http://www.itsa.org/policy2014. More information can be found at the meeting web site.

There is no specific mention of cybersecurity measures to be addressed at this meeting, but that is certainly one of the areas that this program will have to address.