OMB Approves NHTSA V2V NPRM

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) from the National Highway Transportation Safety Administration (NHTSA) on vehicle-to-vehicle (V2V)communications. The advance notice of proposed rulemaking (ANPRM) for this was published in August 2014.

The abstract for this rulemaking in the Fall 2016 Unified Agenda only provides a generic description of what V2V is, not how the agency plans to regulate those communications. It does note that V2V will form the backbone for future vehicle automation processes.

The ANPRM for this rulemaking was more about asking questions about V2V potential problems and solutions than proposing any actual regulatory language. We will have to wait and see the NPRM when it is published to find out what sort of requirements will be outlined in the new regulations. Hopefully, communications security and vulnerability reporting will be included in the NPRM.

There has been a long delay in the last six months between the OIRA approval of a rulemaking and publication of that rule in the Federal Register. This is undoubtedly due to Administration concerns with perceptions of midnight rulemaking, even with a rulemaking that has been in the works for as long as this one has.

Vehicle-to-Vehicle Communications Hearing

This afternoon the House Energy and Commerce Committee updated their web site for Thursday’s hearing on vehicle-to-vehicle (V2V) communications. The site now has a witness list, copies of the witnesses’ written testimony (NHTSA testimony is not yet available) and a Committee Staff document discussing the issues to be covered at the hearing.

The witness list includes:

∙ Nat Beuse, National Highway Transportation Safety Administration (NHTSA);
∙ Barry Einsig, Cisco;
∙ Harry Lightsey, General Motors;
∙ David St. Amant, Econolite Group, Inc; and
∙ Peter Sweatman, University of Michigan Transportation Research Institute

There are a number of issues that will be discussed during this hearing. According to the staff document those issues will include answering the following questions (pgs 6-7):

∙ How will a rulemaking requiring V2V communications in new vehicles impact used cars on the road today?

∙ What driver education is necessary to prepare drivers to operate vehicles equipped with V2V capability?

∙ How does the implementation of V2V technology foster the development of vehicle automation technologies?

∙ How is the auto industry preparing a rollout that will allow this technology to evolve? Will any technological evolution require ongoing government oversight?

∙ What is a realistic timeframe by which drivers will see the benefits of this technology?

Readers of this blog will quickly note that there is no specific mention of cybersecurity issues in the list above. The staff background document does note that NHTSA has made attempts to address the cybersecurity and personal information protection issues potentially associated with the V2V program. Following the comment period on their advance notice of proposed rulemaking (ANPRM) last year NHTSA issued a request for information (RFI) about the development and governance of a “Security Credential Management System” (SCMS) for the system.

There is at least a mention of these SCMS issues in the written testimony:

Einsig – “This network needs interoperability, standards-based technology, as well as a tested architecture for delivering a highly secure, mobile, and high availability solution.” (pg 3)

Lightsey – “National and international standards must be adopted to insure interoperability of V2V systems deployed by all auto makers and those deploying related V2I systems. A scaleable and operational security credential management system must be developed.” (pg 3)

St. Amant – “Efforts underway to create a Security Credential Management System (SCMS) for connected vehicles are critically important.” (pg 5)

Sweatman – “Current gaps requiring federal support include: Cyber-security solutions that suit both the vehicle and the infrastructure.” (pg 8)

In point of fact, these are the only significant mentions of cybersecurity issues in the four written testimonies submitted to the Committee. Of more concern is the fact that according to Sweatman Michigan has already constructed its first V2V/V2I enabled stretch of public road and Mr. Lightsey is announcing that GM will begin to sell its first V2V equipped vehicle, the 2017 Cadillac CTS, next year. Both of these have taken place before there is an established and accepted SCMS.