With automated driving (AD) and Advanced Driver Assistance Systems (ADAS) gaining traction in the industry, two U.S. Representatives are concerned about what this could mean for driver privacy and cybersecurity. 
Calif.-Representative Ted Lieu and S.C.-Representative Joe Wilson have proposed a bill to the administrator of the National Highway Traffic Safety Administration (NHTSA) to conduct a study to determine appropriate cybersecurity standards for the automotive market. The bill (H.R. 701) that the reps introduced is known as the Security and Privacy in Your Car Study Act of 2017, or the SPY Car Study.
According to the proposal, NHSTA, alongside other organizations, including the Federal Trade Commission, Director of National Institute of Standards and Technology, Secretary of Defense, Automotive Information Sharing Analysis Center, SAE International, automotive and OEM manufacturers, is to perform a study in order to “set standards that should be adopted by [NHTSA] and any other appropriate Federal agencies.”
The document states, “The study shall include an identification of:
(1) the isolation measures that are necessary to separate critical software systems from other software systems;
(2) the measures that are necessary to detect and prevent or minimize in the software systems of motor vehicles anomalous codes associated with malicious behavior;
(3) the techniques that are necessary to detect and prevent, discourage, or mitigate intrusions into the software systems of motor vehicles and other cybersecurity risks in motor vehicles, such as continuous penetration testing and on-demand risk assessments;
(4) best practices to secure driving data collected by the electronic systems of motor vehicles while such data are stored onboard the vehicle, in transit from the vehicle to another location, in offboard storage, and in long-term storage (whether onboard or offboard the vehicle); and
(5) a timeline for implementing systems and software that reflect the measures, techniques, and best practices identified under paragraphs (1) through (4).”
In the proposal, the representatives request a preliminary report of the study’s findings should be reported to Congress a year after the bill’s enactment, with a final report due six months following.
