The Commerce Department has issued a final rule that will block the import and sale in the United States of connected vehicle technologies produced in Russia and China. The new rule will phase in between 2027 and 2030.
The new Commerce rule aims to safeguard the U.S. from “national security risks associated with the exploitation of U.S. connected vehicle supply chains” by those adversarial nations, particularly in the area of cybersecurity, the White House said today.
The new rule falls in line with numerous government efforts in recent years to protect U.S. critical infrastructure and supply chains from Chinese cyber interference.
The import restrictions will cover connected vehicles themselves, but also the technology underlying vehicle connectivity systems, which provide access to Bluetooth, Wi-Fi, cellular, and satellite connectivity.
The restrictions also will block automated driving systems which allow vehicles to operate independently of a driver. In a press release, the White House said these connected devices can give bad actors access to user data.
“Certain hardware and software used in connected vehicles could enable mass collection of sensitive information, including geolocation data, audio and video recordings, and other pattern-of-life analysis,” the White House said.
Restrictions on connected vehicle software are expected to begin in model year 2027, and restrictions on hardware will begin in model year 2030.
Another restriction beginning in 2027 will block imports of vehicles that are owned by, sold, or under the jurisdiction of China and Russia, even if the vehicles were made in the United States.
The Commerce Department will also pursue import blocking rules against commercial connected vehicles – or vehicles with a gross weight rating over 10,000 pounds. The department said it aims to address commercial connected vehicles “given the significant risk they pose to national security and public safety.”
The Biden administration first began research on adversary security threats from connected vehicles in July 2024, joined by the Department of Commerce.
“In developing this final rule, the Department consulted with industry to ensure any actions maximally protect U.S. national security, while minimizing unintended consequences or disruptions to the market,” the White House said.
The new rule, the White House said, will help the U.S. defend against Chinese government “cyber espionage and intrusion operations, which continue to pose a significant threat to U.S. critical infrastructure and public safety.”
“Over the past several years, PRC state-sponsored cyber actors such as Volt Typhoon have engaged in an extensive hacking campaign aimed at pre-positioning on – and potentially launching disruptive cyberattacks targeting – U.S. critical infrastructure,” the White House said.
“Russia also remains a malign cyber actor, with a similar history of well-documented cyber attacks against U.S. systems,” it added.
