Imagine half of the cars on the San Francisco Bay Bridge, in New York City’s Lincoln Tunnel, and on dozens of other major U.S. transit arteries suddenly break down, triggered by a bug in their software. Chaos ensues.
This is one of the types of potential attacks referenced in a sweeping new U.S. draft regulation that would ban the use of Chinese and Russian connectivity and automation technology in cars sold in the United States.
Biden administration officials argue that the proposed rule is a necessary national security measure. “While connected vehicles yield many benefits, the data security and cybersecurity risks posed by software and hardware components sourced from [China] and other countries of concern are equally clear, and we will continue to take necessary steps to mitigate these risks and get out ahead of the problem,” U.S. National Security Advisor Jake Sullivan said in a statement on Monday.
But the approach also comes with costs. The new rule would essentially amount to a full shutout of Chinese vehicles, electric and otherwise, from the United States. “Nowadays, every car has these systems—so this effectively bans any Chinese EV imports or Chinese EVs manufactured in the U.S. even by American firms and workers,” said Michael Davidson, an assistant professor at the University of California, San Diego who studies energy policy.
A senior administration official said in a written statement to Foreign Policy that while the rule would block Chinese vehicles from being imported into the United States, companies would be able to apply for exemptions. “If they are able to mitigate the national security risks, they would be allowed to sell here in accordance with the terms of the authorization,” the official said.
With the Biden administration restricting access to an increasingly wide array of Chinese technologies, it is walking a tightrope, balancing national and economic security against other key U.S. interests, including decarbonization, economic innovation, and avoiding runaway escalation with China. It is a high-wire act, and some experts warn that this new rule may leave the United States off-kilter.
Beginning under the Trump administration and continuing through the Biden administration, the U.S. government has been busy limiting U.S. technology flows to China as well as Chinese technology flows into the United States.
On the outbound side, the main focus has been preventing Beijing from gaining access to the most advanced semiconductors, which could give it a military advantage. On the inbound side, Washington started off by blocking Huawei equipment from use in U.S. communications networks and most recently passed legislation to ban or force the sale of TikTok.
The new connected car rule falls under a sweeping executive order issued by then-President Donald Trump in 2019 that empowers the Commerce Department to ban the sale of information and communications technologies made by foreign adversaries in the United States when the technologies pose an “undue risk.” This latest rule has been in the works since the Biden administration launched an investigation into the issue this February.
The proposed regulation specifically focuses on two types of technology: equipment that connects cars to outside digital networks, such as Bluetooth and Wi-Fi, and automated driving systems that are becoming increasingly prevalent. According to the draft rule, any car containing such technologies made by either China or Russia would be blocked from sale or import into the United States, as would the components themselves.
In some ways, the rule is a relatively easy starting point for implementing the executive order because it is largely preventative—very few Chinese cars are imported into the United States, and only a “limited number” of cars manufactured in the United States currently use these components, according to the senior administration official.
And if the rule is finalized as currently written, the Commerce Department would give companies a few years of lead time: For software, the ban would start in model year 2027, and for hardware, companies would have until model year 2030.
It is logical that increasingly smart cars come with an increasingly wide set of security risks. “[T]his is where multiple theories of harm converge,” said Reva Goujon, a director with Rhodium Group’s China corporate advisory team.
The draft rule ticks through the kind of damage Chinese- or Russian-controlled cars could inflict, including the apocalyptic scenario of a fleet of cars being weaponized all at once. Effectively, compromised technologies could turn ordinary cars into spy cars turned against their drivers.
One main category of threat centers on data security. U.S. Commerce Secretary Gina Raimondo has called connected vehicles “smartphones on wheels,” rich with data such as location and call history. Car sensors used for automated driving could also capture data on sensitive U.S. infrastructure, the draft regulation warns. All of the information collected by this supersized smartphone could be sent back to China or Russia for use by their governments; Commerce points to the Chinese government’s ability to compel companies to hand over data and comply with security and intelligence operations as rationale for this concern.
“In the past, the No. 1 data security risk was espionage, and it was malicious cyberactors gaining access to networks,” said Samm Sacks, a senior fellow at Yale Law School’s Paul Tsai China Center. “Now, I think the concern is more data that may be collected through open commercial channels.”
The draft rule also warns that compromised automated driving technology could serve as a “node,” or a critical access point, through which to breach U.S. transportation infrastructure and communication networks at a much larger scale. These fears aren’t unfounded. The draft references a recent cybercampaign, which U.S. officials and tech companies including Microsoft have attributed to China, as an example of China’s strategic “pre-positioning” to corrupt U.S. infrastructure in the event of a conflict.
The hacking campaign, known as Volt Typhoon, has targeted water, power, and communications infrastructure in the United States and Guam, a U.S. territory in the northern Pacific that hosts military bases key to any U.S. effort to defend Taiwan. U.S. officials announced that they dismantled a network of infected routers late last year, but the officials have disclosed information about other similar campaigns, called Flax Typhoon and Salt Typhoon, in recent weeks.
The Chinese government has routinely denied any link to these hacking efforts. The Chinese Foreign Ministry has also dismissed the idea that Chinese smart car technologies pose a national security risk to the United States. “What the U.S. needs to do is to stop bringing down and containing other countries in the name of national security and create an open, fair, transparent, and nondiscriminatory business environment for companies from all countries,” ministry spokesperson Lin Jian said on Tuesday.
The rule is now in the final 30-day comment period before being finalized, so it may yet change. Some might argue that it isn’t comprehensive enough to protect U.S. national security since administration officials initially signaled that the restrictions might include other car technologies such as batteries and LiDAR, lasers used in some autonomous vehicles for navigation.
At the same time, some experts have made the case that the Biden administration’s overall approach to Chinese vehicles has downsides that deserve more attention.
On the climate front, most Chinese-owned EV companies, with the exception of Polestar and Volvo, have been avoiding the U.S. market due to 25 percent tariffs already in place, which will soon ratchet up to 100 percent. That tariff increase, announced in May, already dimmed the prospects of Chinese automakers such as BYD trying to compete in the United States, but this new rule would make that impossible, so long as the companies used Chinese components.
That means U.S. customers would miss out on the low-cost, high-quality Chinese EVs rapidly dominating the rest of the world. Some clean energy experts warn that this could slow decarbonization while also stifling innovation domestically.
“If you’re just creating a protected market, the danger is that you’ll just get companies that have no incentive to actually innovate and make the transition,” said Ilaria Mazzocco, a senior fellow at the Center for Strategic and International Studies.
Beijing let Tesla into the Chinese market to force the country’s own companies to compete at the leading edge. Currently, U.S. automakers are largely insulated from Chinese competition; without the extra pressure, some of the companies have slowed their transition to EVs, pushing back their investments in new electric car models and factories. The rate of EV uptake in the United States has also slowed this year, in part because their prices remain higher than for conventional vehicles.
“If you take China out of the equation, I think then we need to have a policy that’s much more well thought through about how you replace the China factor,” Mazzocco said. “If the direction of national security is that you cannot engage with China on clean tech, then there’s a problem in the innovation ecosystem that needs to be addressed.”
Other countries offer different models. The European Union is planning to introduce more modest tariffs on Chinese EVs while welcoming Chinese companies to move their factories to Europe. In China, due to data security concerns, Tesla agreed to store its China-based drivers’ data locally in 2021.
But in the U.S. approach to Chinese technology, national security remains front and center. The administration has pledged to follow a “small yard, high fence” framework focused on a certain set of higher-risk technologies, but the yard is expanding. More restrictions are expected—next perhaps on Chinese drones—as the administration races to close off vulnerabilities.
Geoffrey Gertz, a senior fellow at the Center for a New American Security who previously served as director for international economics in the Biden White House, said, “The big question to me is, how can we more effectively put guardrails on these national security restrictions to credibly signal that the yard is not going to get so big to swallow the entire relationship?”
The post Biden’s High-Wire Balancing Act on Chinese Tech appeared first on Foreign Policy.
