Imagine driving a car that knows your daily routine, can monitor nearby traffic, and even call for help in an emergency. Sounds great, right? But what if that same car could also reveal your location to someone else—or be remotely controlled by a foreign hacker?
The U.S. government is now proposing a ban on automotive software and hardware from China and Russia, focusing on connected vehicle components that could pose both security risks and privacy threats to American drivers.
As the Department of Commerce explains, this proposed rule targets foreign-made Vehicle Connectivity Systems (VCS) and Automated Driving Systems (ADS)—the very technologies that enable our cars to function as “smart devices” on wheels.
These systems provide meaningful conveniences, such as GPS, emergency braking and automated lane-keeping. But they also make vehicles vulnerable to cyberattacks that could allow hackers to control essential systems remotely, posing threats to both individual drivers and for national security if exploited on a large scale.
The Physical Safety Vs. Cybersecurity Tradeoff
Modern vehicles are equipped with connectivity systems like Wi-Fi, Bluetooth, cellular and satellite links. These technologies allow for real-time updates, navigation, and even life-saving features like collision avoidance and automated braking, which make driving safer by assisting drivers with crucial decisions.
Automated driving systems (ADS) take safety even further by handling complex driving tasks like adaptive cruise control, lane-keeping, and emergency braking. However, every connected feature also introduces what cybersecurity experts call “attack surfaces”—potential points where hackers can access the system.
Imagine if a hacker exploited a vehicle’s connectivity to interfere with braking or acceleration. This is the kind of risk the U.S. government aims to mitigate by focusing on vehicle connectivity and ADS components from countries like China and Russia.
As explained in a press release from the Bureau of Industry and Security, VCS or ADS components could theoretically allow these governments to monitor or disrupt U.S. roadways, a scenario with significant public safety implications.
Consumer Privacy: Your Car Knows More Than You Think
In addition to cyber risks, connected vehicles pose unique privacy challenges for consumers. These cars collect vast amounts of data on driving habits, location history, and even contact information when synced with smartphones.
As an expert in digital forensics, I have seen firsthand the vast amounts of data collected by connected vehicles. These systems, which manage everything from GPS navigation to music streaming and phone connectivity, continuously record details about drivers’ habits, routes and even personal communications.
When performing forensic analyses on these systems, it’s clear that they capture more than just “driving data”—smart car systems store call logs, text message data, location history and even Wi-Fi connections. This data can provide a comprehensive picture of a person’s daily activities, preferences and even social interactions.
This data can be helpful for personalizing the driving experience, but it also creates privacy vulnerabilities. When a connected car is resold, any leftover data could potentially be accessed by the new owner, as it often remains stored in cloud systems or within the vehicle’s internal systems.
Privacy advocates warn that if these systems rely on components from China or Russia, the data they collect could be accessible to foreign governments due to domestic data-sharing requirements in those countries. This is why the U.S. is emphasizing “trusted” suppliers for these components, seeking to secure consumer data from unauthorized access.
We Have Crash Safety Ratings, But What About Cyber?
The proposed rule to restrict Chinese and Russian automotive technology in U.S. vehicles could bring significant changes for consumers, affecting both vehicle prices and available features. Manufacturers are likely to face higher costs as they work to replace foreign-made components with alternatives that meet new compliance standards, as explained in an analysis by Foley and Lardner LLP. This adjustment could mean higher sticker prices or, in some cases, the removal of certain high-tech features to avoid potential vulnerabilities.
However, the proposal’s implications go beyond cost; it represents a shift in how we think about vehicle safety. Until now, consumers have mostly relied on traditional crash safety ratings to gauge a vehicle’s security. This new regulation underscores the growing importance of cybersecurity and data privacy as central to overall vehicle safety, particularly as vehicles become increasingly connected to external networks.
As a result, car buyers may soon need to weigh digital security as heavily as crash-test ratings. When it comes to selecting a car, understanding how well the vehicle’s data systems are protected could become as important as knowing how well it performs in a collision. This shift highlights a future where data protection is an integral part of vehicle safety, making it essential for consumers to consider both physical and digital safeguards.
