I 

114TH CONGRESS 

1ST SESSION H. R. 3994 

To direct the Administrator of the National Highway Traffic Safety Administration to conduct a study to determine appropriate cybersecurity standards for motor vehicles, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

NOVEMBER 5, 2015 

Mr. WILSON of South Carolina (for himself and Mr. TED LIEU of California) 

introduced the following bill; which was referred to the Committee on Energy and Commerce 

A BILL 

To direct the Administrator of the National Highway Traffic 

Safety Administration to conduct a study to determine 

appropriate cybersecurity standards for motor vehicles, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Security and Privacy 

5 in Your Car Study Act of 2015’’ or the ‘‘SPY Car Study 

6 Act of 2015’’. 


smartinez on DSK4TPTVN1PROD with BILLS
2 

•HR 3994 IH

1 SEC. 2. STUDY ON CYBERSECURITY STANDARDS FOR 

2 MOTOR VEHICLES. 

3 (a) STUDY REQUIRED.—The Administrator of the 

4 National Highway Traffic Safety Administration, in con5 sultation with the Federal Trade Commission, the Direc6 tor of the National Institute of Standards and Technology, 

7 the Secretary of Defense, the Automotive Information 

8 Sharing and Analysis Center, SAE International, manu9 facturers of motor vehicles, manufacturers of original 

10 motor vehicle equipment, and relevant academic institu11 tions, shall conduct a study to determine appropriate 

12 standards for the regulation of the cybersecurity of motor 

13 vehicles manufactured or imported for sale in the United 

14 States that should be adopted by the Administration and 

15 any other appropriate Federal agencies. The study shall 

16 include an identification of— 

17 (1) the isolation measures that are necessary to 

18 separate critical software systems from other soft19 ware systems; 

20 (2) the measures that are necessary to detect 

21 and prevent or minimize in the software systems of 

22 motor vehicles anomalous codes associated with ma23 licious behavior; 

24 (3) the techniques that are necessary to detect 

25 and prevent, discourage, or mitigate intrusions into 

26 the software systems of motor vehicles and other cyVerDate Sep 11 2014 02:30 Nov 11, 2015 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3994.IH H3994

smartinez on DSK4TPTVN1PROD with BILLS
3 

•HR 3994 IH

1 bersecurity risks in motor vehicles, such as contin2 uous penetration testing and on-demand risk assess3 ments; and 

4 (4) best practices to secure driving data col5 lected by the electronic systems of motor vehicles 

6 while such data are stored onboard the vehicle, in 

7 transit from the vehicle to another location, and in 

8 offboard storage. 

9 (b) REPORTS TO CONGRESS.— 

10 (1) PRELIMINARY REPORT.—Not later than 1 

11 year after the date of the enactment of this Act, the 

12 Administrator shall submit to the Committee on En13 ergy and Commerce of the House of Representatives 

14 and the Committee on Commerce, Science, and 

15 Transportation of the Senate a report containing the 

16 preliminary findings of the study conducted under 

17 subsection (a). 

18 (2) FINAL REPORT.—Not later than 6 months 

19 after the submission of the report under paragraph 

20 (1), the Administrator shall submit to the commit21 tees described in such paragraph a report containing 

22 the complete findings of the study conducted under 

23 subsection (a), including recommended dates for the 

24 adoption and effectiveness of the standards deter25 mined to be appropriate in such study and recVerDate Sep 11 2014 02:30 Nov 11, 2015 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3994.IH H3994

smartinez on DSK4TPTVN1PROD with BILLS
4 

•HR 3994 IH

1 ommendations for any legislation that may be nec2 essary to authorize the adoption of such standards. 

3 (3) FORM OF REPORT.—The report required by 

4 paragraph (2) shall be submitted in unclassified 

5 form but may contain a classified annex. 

6 (c) DEFINITIONS.—In this section: 

7 (1) ADMINISTRATOR.—The term ‘‘Adminis8 trator’’ means the Administrator of the National 

9 Highway Traffic Safety Administration. 

10 (2) CRITICAL SOFTWARE SYSTEM.—The term 

11 ‘‘critical software system’’ means a software system 

12 of a motor vehicle that can affect the driver’s control 

13 of the movement of the vehicle. 

14 (3) DRIVING DATA.—The term ‘‘driving data’’ 

15 includes any electronic information collected about— 

16 (A) a vehicle’s status, including its location 

17 or speed; or 

18 (B) any owner, lessee, driver, or passenger 

19 of a vehicle. 

Æ 


smartinez on DSK4TPTVN1PROD with BILLS