The White House bluntly identified China and Russia by name as threats to American roads and drivers this week.
Specifically, the brief highlighted a proposed rule change within the Department of Commerce set to ban all sale and import of ‘connected’ vehicles from these two countries, as well as components and hardware made within them even if used in other carmaker’s products.
A shadow ban on all Chinese cars?
The list of to-be-outlawed technology and components is extensive. While the full report can be found on the Department of Commerce notice, the breakdown by the White House highlighted systems which could control or correct vehicle movement, any data collection on driver and/or passengers, all cameras, sensors, autonomous driving software, and anything which could record and/or send information about American infrastructure.
That’s a lot of wiggle room.
Whether or not the intention is to ban all Chinese cars outright, it certainly could be the outcome, depending on how these terms are interpreted. Are rear back-up cameras, a staple on almost every vehicle manufactured in the last decade, included? Are in-build GPS and navigation softwares included? Does saving a seat and mirror preset constitute ‘recording information’ about drivers and passengers?
Whack-a-mole could meet mission creep
Laws don’t, as a general rule, change minds and objectives, just behavior. Often, unexpected and unintended adaptations occur in the face of a law to achieve as-near the same outcome as was possible before.
Muddy language like this can invite bare-minimum compliance and shell games and semantic compliance with the letter, but not the spirit of the law. This in turn forces even more clarification and delineation of the rules, with even more side-stepping. Consider just one quoted portion of the proposal, which defines the scope of who and what could be affected:
“Systems… designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary.”
Who exactly is that meant to cover, and more importantly, who will it come to encompass as the rule matures?
‘Made in China’ may become a liability
Right out the gate, it is probably safe to assume that, on purpose or as a ‘happy accident’, most of the state-owned Chinese companies and domestic start-ups heavily dependent on CCP subsidies and beholden to its good graces will be implicated on sight.
Questions for Volvo, Polestar, and more
There is also the question, however, of non-Chinese origins companies which have either been bought out, like Volvo and Polestar, or are publicly traded and cannot know for sure some or even a large amount of those shares are not owned by China or Russia in a way that subjects them to this rule.
Even more confusing, pretty much any manufacturer doing business in China needs to accept 50% ownership of the business, at least the part that is in the country proper, by the CCP. While there has already been a quiet shift away from investing more into China by automakers feeling the squeeze from strict Covid-19 lockdowns and increased consternation from governments and consumers alike back home, rules like this could hasten capital flight of the investments already made.
Not even The Big 3 are safe
Take Ford Chengen, for example. As far as the automotive business goes, it doesn’t get more American than Ford.
But Ford partners with Chinese company Chengen to export some of their models to China in a joint venture. That could be construed to mean, to some degree, that Ford is somewhat beholden to the jurisdiction of China.
Perhaps this argument will never be used, as it is somewhat frivolously extreme, but it paints a picture of the kinds of questions such a broad framework banning software and hardware in any way connected with China poses.
Targeting China’s encroachments could be a sincere effort while also being a calculated election ploy
The timing of this announcement could be seen by the more cynical as part of an effort to shore up UAW support and win over the rust belt in general as the nation nears another divisive presidential election.
With the war in Ukraine proving what networking and ingenuity are capable of to turn off-the-shelf products into weapons of war, and the recent coordinated explosion of thousands of Hezbollah pagers and radios in Lebanon proving that even highly outdated communication and integration technologies could be an avenue of attack by a clever adversary, the Biden Administration might be doing what needs to be done and also benefiting from loudly announcing the steps taken at a politically opportune moment.
Final thoughts
Protecting consumers from cyber attacks is absolutely within the purview and duty of the American government. However, this announcement comes out of the executive branch and not Congress, meaning it is an enforcement of a rule that’s not really a law, and lacks the funding and coordination of effort that could come with being one.
This effort may limit access to some systems by some entities who wish to do harm, or at least make it more difficult by placing obstacles in the way, but perhaps this misses the bigger question; is our data being protected against all threats foreign AND domestic? Are we building technology that is too exploitable in general and only focusing on those most likely to catastrophically abuse that vulnerability, instead of asking whether we are comfortable with those vulnerabilities existing in the first place?
I don’t know.
What I do know is that, when Skynet or ChatGPT hacks into my car and sends it careening off a bridge, I doubt I’ll breathe a sigh of relief knowing that at least it wasn’t Xi Jinping or Putin who gave the order.
