15066 Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 

to amend the current version of that 

order, FAA Order JO 7400.11H, dated 

August 11, 2023, and effective 

September 15, 2023. These updates 

would be published subsequently in the 

next update to FAA Order JO 7400.11. 

That order is publicly available as listed 

in the ADDRESSES section of this 

document. 

FAA Order JO 7400.11H lists Class A, 

B, C, D, and E airspace areas, air traffic 

service routes, and reporting points. 

The Proposal 

The FAA is proposing to amend 14 

CFR part 71 by establishing Class E 

airspace extending upward from 700 

feet above the surface to within a 6.4- 

mile radius of The Sigurd Anderson 

Airport, Webster, SD. 

The FAA is proposing this action due 

to the development of new public 

instrument procedures at this airport 

and to support IFR operations. 

Regulatory Notices and Analyses 

The FAA has determined that this 

proposed regulation only involves an 

established body of technical 

regulations for which frequent and 

routine amendments are necessary to 

keep them operationally current. It, 

therefore: (1) is not a ‘‘significant 

regulatory action’’ under Executive 

Order 12866; (2) is not a ‘‘significant 

rule’’ under DOT Regulatory Policies 

and Procedures (44 FR 11034; February 

26, 1979); and (3) does not warrant 

preparation of a regulatory evaluation as 

the anticipated impact is so minimal. 

Since this is a routine matter that will 

only affect air traffic procedures and air 

navigation, it is certified that this 

proposed rule, when promulgated, will 

not have a significant economic impact 

on a substantial number of small entities 

under the criteria of the Regulatory 

Flexibility Act. 

Environmental Review 

This proposal will be subject to an 

environmental analysis in accordance 

with FAA Order 1050.1F, 

‘‘Environmental Impacts: Policies and 

Procedures’’ prior to any FAA final 

regulatory action. 

List of Subjects in 14 CFR Part 71 

Airspace, Incorporation by reference, 

Navigation (air). 

The Proposed Amendment 

In consideration of the foregoing, the 

Federal Aviation Administration 

proposes to amend 14 CFR part 71 as 

follows: 

PART 71—DESIGNATION OF CLASS A, 

B, C, D, AND E AIRSPACE AREAS; AIR 

TRAFFIC SERVICE ROUTES; AND 

REPORTING POINTS 

■ 1. The authority citation for 14 CFR 

part 71 continues to read as follows: 

Authority: 49 U.S.C. 106(f), 106(g); 40103, 

40113, 40120; E.O. 10854, 24 FR 9565, 3 CFR, 

1959–1963 Comp., p. 389. 

§ 71.1 [Amended] 

■ 2. The incorporation by reference in 

14 CFR 71.1 of FAA Order JO 7400.11H, 

Airspace Designations and Reporting 

Points, dated August 11, 2023, and 

effective September 15, 2023, is 

amended as follows: 

Paragraph 6005 Class E Airspace Areas 

Extending Upward From 700 Feet or More 

Above the Surface of the Earth. 

* * * * * 

AGL SD E5 Webster, SD [Establish] 

The Sigurd Anderson Airport, SD 

(Lat 45°17′35′′ N, long 94°30′49′′ W) 

That airspace extending upward from 700 

feet above the surface within a 6.4-mile 

radius of The Sigurd Anderson Airport. 

* * * * * 

Issued in Fort Worth, Texas, on February 

27, 2024. 

Martin A. Skinner, 

Acting Manager, Operations Support Group, 

ATO Central Service Center. 

[FR Doc. 2024–04317 Filed 2–29–24; 8:45 am] 

BILLING CODE 4910–13–P 

DEPARTMENT OF COMMERCE 

Bureau of Industry and Security 

15 CFR Part 7 

[Docket No. 240227–0060] 

RIN 0694–AJ56 

Securing the Information and 

Communications Technology and 

Services Supply Chain: Connected 

Vehicles 

AGENCY: Bureau of Industry and 

Security, U.S. Department of Commerce. 

ACTION: Advance notice of proposed 

rulemaking. 

SUMMARY: In this advance notice of 

proposed rulemaking (ANPRM), the 

Department of Commerce’s 

(Department) Bureau of Industry and 

Security (BIS) seeks public comment on 

issues and questions related to 

transactions involving information and 

communications technology and 

services (ICTS) that are designed, 

developed, manufactured, or supplied 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

foreign countries or foreign nongovernment persons identified in the 

Department’s regulations, pursuant to 

the Executive Order (E.O.) entitled 

‘‘Securing the Information and 

Communications Technology and 

Services Supply Chain,’’ and that are 

integral to connected vehicles (CVs), as 

defined herein. This ANPRM will assist 

BIS in determining the technologies and 

market participants that may be most 

appropriate for regulation pursuant to 

the E.O. 

DATES: Comments must be received on 

or before April 30, 2024. 

ADDRESSES: All comments must be 

submitted by one of the following 

methods: 

• The Federal eRulemaking Portal: 

https://www.regulations.gov at docket 

number BIS–2024–0005. 

• Email directly to: connected

vehicles@bis.doc.gov. Include ‘‘RIN 

0694–AJ56’’ in the subject line. 

• Instructions: Comments sent by any 

other method, to any other address or 

individual, or received after the end of 

the comment period, may not be 

considered. For those seeking to submit 

confidential business information (CBI), 

please clearly mark such submissions as 

CBI and submit by email, as instructed 

above. Each CBI submission must also 

contain a summary of the CBI, clearly 

marked as public, in sufficient detail to 

permit a reasonable understanding of 

the substance of the information for 

public consumption. Such summary 

information will be posted on 

regulations.gov. 

FOR FURTHER INFORMATION CONTACT: 

Marc Coldiron, U.S. Department of 

Commerce, telephone: 202–482–3678. 

For media inquiries: Jeremy Horan, 

Office of Congressional and Public 

Affairs, Bureau of Industry and Security, 

U.S. Department of Commerce: OCPA@

bis.doc.gov. 

SUPPLEMENTARY INFORMATION: 

I. Authorities 

On May 15, 2019, the President issued 

E.O. 13873, ‘‘Securing the Information 

and Communications Technology and 

Services Supply Chain,’’ pursuant to the 

President’s authority under the 

Constitution and the laws of the United 

States, including the International 

Emergency Economic Powers Act 

(IEEPA), the National Emergencies Act 

(50 U.S.C. 1601, et seq.), and Section 

301 of Title 3, United States Code. E.O. 

13873 declares a national emergency 

regarding the ICTS supply chain, 

finding that ‘‘the unrestricted 

acquisition or use in the United States 

of information and communications 


ddrumheller on DSK120RN23PROD with PROPOSALS1
Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 15067 

technology or services designed, 

developed, manufactured, or supplied 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

foreign adversaries augments the ability 

of foreign adversaries to create and 

exploit vulnerabilities in information 

and communications technology or 

services, with potentially catastrophic 

effects, and thereby constitutes an 

unusual and extraordinary threat to the 

national security, foreign policy, and 

economy of the United States.’’ The E.O. 

further notes that ‘‘[t]his threat exists 

both in the case of individual 

acquisitions or uses of such technology 

or services, and when acquisitions or 

uses of such technologies are considered 

as a class.’’ 

In accordance with the National 

Emergencies Act, the President has 

declared each year since E.O. 13873 was 

published that the national emergency 

continues in effect. Continuation of the 

National Emergency With Respect to 

Securing the Information and 

Communications Technology and 

Services Supply Chain, 85 FR 29321 

(May 14, 2020); Continuation of the 

National Emergency With Respect to 

Securing the Information and 

Communications Technology and 

Services Supply Chain, 86 FR 26339 

(May 13, 2021); Continuation of the 

National Emergency With Respect to 

Securing the Information and 

Communications Technology and 

Services Supply Chain, 87 FR 29645 

(May 13, 2022); Continuation of the 

National Emergency With Respect to 

Securing the Information and 

Communications Technology and 

Services Supply Chain, 88 FR 30635 

(May 11, 2023). 

To address identified risks to national 

security from ICTS transactions, E.O. 

13873 grants the Secretary of Commerce 

(Secretary) (in consultation with other 

agency heads identified in the E.O.) the 

authority to review and, if necessary, 

impose mitigation measures on or 

prohibit any ICTS transaction, which 

includes any acquisition, importation, 

transfer, installation, dealing in, or use 

of any ICTS by any person, or with 

respect to any property, subject to 

United States jurisdiction, when the 

transaction involves any property in 

which a foreign country or national has 

any interest. In order to require 

mitigation for or to prohibit an ICTS 

transaction or class of transactions, the 

Secretary, in consultation with other 

agency heads, must first determine that 

the ICTS transaction or class of 

transactions at issue: (1) involves ICTS 

designed, developed, manufactured, or 

supplied by persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of a foreign 

adversary, which the E.O. defines as 

‘‘any foreign government or foreign nongovernment person engaged in a longterm pattern or serious instances of 

conduct significantly adverse to the 

national security of the United States or 

security and safety of United States 

persons;’’ and (2) poses: 

A. an undue risk of sabotage to or 

subversion of the design, integrity, 

manufacturing, production, distribution, 

installation, operation, or maintenance 

of information and communications 

technology or services in the United 

States; 

B. an undue risk of catastrophic 

effects on the security or resiliency of 

United States critical infrastructure or 

the digital economy of the United 

States; or 

C. otherwise poses an unacceptable 

risk to the national security of the 

United States or the security and safety 

of United States persons. 

These factors are collectively referred 

to as ‘‘undue or unacceptable risks.’’ 

E.O. 13873 additionally provides the 

Secretary with the authority to issue 

rules establishing criteria by which 

particular technologies or market 

participants may be categorically 

included in or categorically excluded 

from prohibitions established pursuant 

to the E.O. To date, the Department has 

not pursued or used this authority to 

regulate ICTS transactions on a 

category- or class-wide basis. 

Furthermore, E.O. 13873 grants the 

Secretary the authority to identify a 

mechanism and relevant factors for the 

negotiation of mitigation measures that 

would allow approval of an otherwise 

prohibited transaction. 

II. Background 

a. Purpose 

Pursuant to the authority delegated to 

the Secretary under E.O. 13873, BIS is 

considering proposing rules that would 

prohibit certain ICTS transactions or 

classes of ICTS transactions by or with 

persons who design, develop, 

manufacture, or supply ICTS integral to 

CVs and are owned by, controlled by, or 

subject to the jurisdiction or direction of 

foreign governments or foreign nongovernment persons identified at 15 

CFR 7.4 (hereinafter referred to as ‘‘15 

CFR 7.4 entities’’). BIS is also 

considering proposing measures that 

would allow market participants to 

engage in otherwise prohibited 

transactions or classes of transactions if 

the undue or unacceptable risks of those 

ICTS transactions can be sufficiently 

mitigated using measures that are 

monitorable. 

The purpose of this ANPRM is to 

gather information to support BIS’s 

potential development of a rule 

regarding ICTS integral to CVs. In 

particular, BIS seeks public input on 

certain definitions and its assessment of 

how a class of transactions involving 

ICTS integral to CVs, when designed, 

developed, manufactured, or supplied 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

a 15 CFR 7.4 entity, could present 

undue or unacceptable risks to U.S. 

national security. These include risks 

related to threats from 15 CFR 7.4 

entities, capabilities of CVs that may 

increase the likelihood of 

vulnerabilities, and consequences to 

U.S. persons and critical infrastructure 

if these vulnerabilities are exploited or 

intentionally inserted by 15 CFR 7.4 

entities. BIS solicits input on the ICTS 

most integral to CVs and most 

vulnerable to compromise, as well as 

input on mechanisms to address 

identified risks through potential 

design, implementation standards and 

protocols, manufacturing integrity 

protection systems and procedures, or 

prohibitions. 

BIS recognizes the benefits of CV 

technologies and does not imply 

through this ANPRM that technologies 

such as vehicle-to-everything (V2X) 

communications are generally unsafe for 

use in the United States. Indeed, these 

new vehicles often provide safer, more 

fuel-efficient travel. However, E.O. 

13873 is focused on risks that ICTS 

transactions might present to national 

security. Therefore, this ANPRM, which 

is being issued pursuant to the 

authorities granted under E.O. 13873, 

seeks public comment on potential 

means to narrowly address involvement 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

15 CFR 7.4 entities in the design, 

development, manufacture, or supply of 

ICTS integral to CVs where that 

involvement may create undue or 

unacceptable risk to U.S. national 

security. 

Additionally, BIS seeks comment on 

whether to create a process for the 

public to request approval to engage in 

an otherwise prohibited transaction by 

demonstrating that a particular 

transaction adequately addresses the 

risk to U.S. national security. BIS 

encourages public feedback to help 

inform the rulemaking process, 

particularly regarding transactions 

where ICTS supply chains may be 

impacted by any proposed rule. 

b. Definitions 

As an initial matter, BIS is interested 

in receiving comments on the applicable 


ddrumheller on DSK120RN23PROD with PROPOSALS1
15068 Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 

definition for connected vehicle or CV 

within the context of transactions 

involving ICTS incorporated into such 

vehicles. BIS could define a connected 

vehicle as an automotive vehicle that 

integrates onboard networked hardware 

with automotive software systems to 

communicate via dedicated short-range 

communication, cellular 

telecommunications connectivity, 

satellite communication, or other 

wireless spectrum connectivity with any 

other network or device. Such a 

definition would likely include 

automotive vehicles, whether personal 

or commercial, capable of global 

navigation satellite system (GNSS) 

communication for geolocation; 

communication with intelligent 

transportation systems; remote access or 

control; wireless software or firmware 

updates; or on-device roadside 

assistance. 

CVs also integrate hardware that 

enables connectivity within the vehicle 

and/or external connectivity with 

devices, networks, applications, and 

services outside the vehicle. CV safety 

applications are designed to increase 

situational awareness and reduce traffic 

accidents through vehicle-to-vehicle 

(V2V), vehicle-to-infrastructure (V2I), 

and increasingly, V2X communications, 

as contemplated in a series of 

Department of Transportation 

workshops focusing on V2X 

communications titled ‘‘Saving Lives 

with Connectivity.’’ See Bill Canis, 

Cong. Research Serv., R46398, Motor 

Vehicle Safety: Issues for Congress 8 

(2021), https://sgp.fas.org/crs/misc/ 

R46398.pdf; U.S. Dep’t of Transp., ITS 

V2X Communications Summit (2023), 

https://www.its.dot.gov/research_areas/ 

emerging_tech/htm/ITS_V2X_

CommunicationSummit.htm. 

BIS arrived at this definition by 

reviewing existing definitions for 

connected vehicles from trade 

associations and leading research 

publications including the Connected 

Vehicle Reference Implementation 

Architecture, U.S. Department of 

Transportation’s Intelligent 

Transportation Systems Joint Program 

Office, Institute of Electrical and 

Electronics Engineers research, and 

Society of Automotive Engineers 

standards. 

Various terms exist across industry 

and the U.S. Government to refer to 

vehicles that exhibit the connected 

features explained above. In addition to 

input on the term connected vehicle, 

BIS is seeking comment on alternative 

terminology that might better 

correspond to the definition of 

connected vehicle discussed above. 

Such terminology could include 

‘‘networked vehicles,’’ ‘‘intelligent 

connected vehicles,’’ ‘‘software-defined 

vehicles,’’ or ‘‘connected autonomous 

vehicles.’’ 

This ANPRM seeks comment on the 

definitions to use for a rule regarding 

transactions involving ICTS integral to 

CVs, and specifically: 

1. In what ways, if any, should BIS 

elaborate on or amend the potential 

definition of connected vehicle stated 

above? If amended, how will the revised 

definition enable BIS to better address 

national security risks arising from 

classes of transactions involving ICTS 

integral to CVs? 

2. Is the term connected vehicles 

broad enough to include autonomous 

vehicles and related equipment, electric 

vehicles, or other alternative power 

sources and related technologies? Does 

a better term exist to describe the 

broader scope? 

3. Are there other commonly used 

definitions for CVs that BIS should 

consider when defining a class of ICTS 

transactions, including definitions from 

industry, civil society, and foreign 

entities? If so, why would those 

definitions be more appropriate for the 

purposes of a rule? 

c. Risks Associated With Connected 

Vehicles 

The automotive industry is constantly 

undergoing innovation and change, and 

as communications and broadband 

technology advance, so do the 

technologies used in automobiles. 

Particularly relevant for the purposes of 

this ANPRM, new technology has fueled 

a rise in interconnectivity and 

autonomous capabilities in new 

vehicles. An automobile’s value is no 

longer determined only by the engine, 

steering system, and other traditional 

automotive parts. Increasingly, an 

automobile is a compilation of on-board 

computers; sensors; cameras; batteries; 

and various other categories of ICTS 

software or hardware tied together 

through automotive software systems. 

Over time, vehicle connections to the 

internet will evolve even further and 

new communication technology will 

advance vehicle capabilities. These 

technological advances will continue to 

rely on significant data collection not 

only about the vehicle and its myriad 

components, but also the driver, the 

occupants, the vehicle’s surroundings, 

and nearby infrastructure. Moreover, 

CVs allow for information to be gathered 

and shared to address both individual 

and societal transportation needs. These 

technologies may expose the vehicles, 

and the sectors they support, to new 

cyber-enabled attack vectors and 

vulnerabilities, with the potential to 

create novel and potentially profound 

risks to national security and public 

safety. Cyber-enabled vulnerabilities can 

be exacerbated if the ICTS integral to 

CVs is designed, developed, 

manufactured, or supplied, by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity. 

i. Threat From 15 CFR 7.4 Entities 

E.O. 13873 defines the term ‘‘foreign 

adversary’’ to mean any foreign 

government or foreign non-government 

person engaged in a long-term pattern or 

serious instances of conduct 

significantly adverse to the national 

security of the United States or security 

and safety of U.S. persons. In the rules 

implementing the E.O. at 15 CFR 7.4(a), 

the Secretary has identified the 

following as foreign adversaries: the 

People’s Republic of China, including 

the Hong Kong Special Administrative 

Region (PRC); Republic of Cuba; Islamic 

Republic of Iran; Democratic People’s 

Republic of Korea; Russian Federation; 

and Venezuelan politician Nicola ́s 

Maduro (Maduro Regime). 

The incorporation of ICTS products 

and services used in the United States 

from persons owned by, controlled by, 

or subject to the jurisdiction or direction 

of 15 CFR 7.4 entities’ can offer a direct 

entry point to sensitive U.S. technology 

and data and bypass measures intended 

to protect U.S. persons’ safety and 

security. This may allow actors with 

insider access to gain entry to the 

systems the ICTS connects to and 

ultimately engage in malicious cyber 

activity. Consequently, this exploitation 

may result in undue risks to ICTS and 

critical infrastructure in the United 

States and unacceptable risks to 

national security. 

The PRC presents a particularly acute 

and persistent threat to the United 

States ICTS supply chain. According to 

the Office of the Director of National 

Intelligence, the PRC likely represents 

the broadest, most active, and persistent 

cyber espionage threat to U.S. 

Government and private-sector 

networks. See Off. Of the Director of 

Nat’l Intelligence, Annual Threat 

Assessment of the U.S. Intelligence 

Community 10 (2023), https://

www.dni.gov/files/ODNI/documents/ 

assessments/ATA-2023-UnclassifiedReport.pdf. The PRC is almost certainly 

capable of launching cyber-attacks that 

could disrupt critical infrastructure 

services within the United States and 

has conducted cyber espionage 

operations that have compromised 

telecommunications firms, providers of 

managed services, and broadly used 

software. Id. At 10. In short, the PRC has 


ddrumheller on DSK120RN23PROD with PROPOSALS1
Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 15069 

engaged in a pattern of hacking and 

cyber intrusion that demonstrates the 

PRC’s intent to compromise and exploit 

U.S. ICTS supply chains and critical 

infrastructure, threatening U.S. national 

security. 

The PRC’s legal structure also gives 

broad authority to the state to co-opt 

private companies to pursue its 

objectives. A host of laws give the PRC 

government the authority to compel 

companies located in the PRC, 

including automakers and their 

suppliers, to cooperate with PRC 

intelligence and security services. The 

PRC’s 2021 Data Security Law, for 

example, makes all private data 

available to the PRC state when it is 

needed for ‘‘national security.’’ See 

National People’s Congress, Data 

Security Law of the People’s Republic of 

China, Art. 35, http://www.npc.gov.cn/ 

englishnpc/c2759/c23934/202112/ 

t20211209_385109.html. The PRC’s 

2017 National Intelligence Law imposes 

affirmative obligations on entities and 

persons subject to the PRC’s jurisdiction 

to cooperate with intelligence 

agencies—Article 17 allows PRC 

intelligence officials to take control of a 

private organization’s facilities, 

including its communications 

equipment. See National People’s 

Congress, National Intelligence Law (as 

amended, 2018), http://

www.npc.gov.cn/npc/c2/c30834/ 

201905/t20190521_281475.html. The 

PRC’s 2015 National Security Law 

obliges citizens and private companies 

to provide security and military 

agencies with all ‘‘necessary support 

and assistance.’’ See State Council of the 

People’s Republic of China, National 

Security Law, Art. 77(5), https://

www.gov.cn/zhengce/2015-07/01/ 

content_2893902.htm. Beyond legal 

obligations, companies established in 

the PRC may be required to create 

internal Chinese Communist Party 

(CCP) committees that can exercise 

influence over corporate decisions. See 

National People’s Congress, Company 

Law of the People’s Republic of China, 

Art. 19, https://www.npc.gov.cn/zgrdw/ 

npc/xinwen/2018-11/05/content_

2065671.htm. 

The combination of legal authorities 

and opaque CCP influence make private 

companies that are subject to the PRC’s 

jurisdiction susceptible to requests from 

intelligence and military officials. PRC 

officials can compel PRC firms to 

provide the PRC government with data, 

logical access, encryption keys, and 

other vital technical information, as 

well as to install backdoors or bugs in 

equipment which create security flaws 

easily exploitable by PRC authorities. 

U.S. Dep’t of Homeland Security, Data 

Security Business Advisory: Risks and 

Considerations for Businesses Using 

Data Services and Equipment from 

Firms Linked to the Peoples Republic of 

China 2 (2020), https://www.dhs.gov/ 

sites/default/files/publications/20_

1222_data-security-businessadvisory.pdf. Original equipment 

manufacturers (OEMs) for vehicles in 

the PRC, due to the vast amounts of data 

generated by their products, are notable 

targets for government access. 

According to open-source reporting, 

over 200 automakers that operate in the 

PRC are legally obligated to transmit 

real-time vehicle data, including 

geolocation information, to government 

monitoring centers. See Erika Kinetz, In 

China Your Car Could Be Talking To 

The Government, Associated Press 

News (Nov. 29, 2018), https://apnews.

com/article/4a749a42119047848

26b45e812cff4ca. This pervasive data 

sharing, which provides the PRC 

government with detailed information 

on the behaviors and habits of 

individuals, is indicative of a broader 

approach to co-opting private 

companies—one that raises significant 

concerns about how the PRC 

government might exploit the growing 

presence of PRC OEMs and 

manufacturers of ICTS integral to CVs in 

foreign markets. The combination of 

these factors uniquely elevates BIS’s 

concern regarding PRC participation in 

the ICTS supply chain for CVs in the 

United States. 

BIS seeks to better understand the role 

of persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

15 CFR 7.4 entities, particularly the 

PRC, in the ICTS supply chain for CVs, 

and the leverage these entities might 

exert as a result. In particular, the 

ANPRM seeks comments on the 

following issues: 

4. Please describe the ICTS supply 

chain for CVs in the United States. 

Particularly useful responses may 

include information regarding: 

a. categories of ICTS, such as software 

or hardware, that are integral to CVs 

operating in the United States; 

b. market leaders for each distinct 

phase of the supply chain for ICTS 

integral to CVs (such as design, 

development, manufacturing, or supply) 

including, but not limited to: OEMs, tier 

one, tier two, and tier three suppliers, 

and service providers; 

c. geographic locations where 

software (such as the vehicle operating 

system), hardware (such as light 

detection and ranging (LiDAR) sensors), 

or other ICTS components integral to 

CVs in use in the United States are 

designed, developed, manufactured, or 

supplied; 

d. involvement in any sector or subsector of the U.S. ICTS supply chain for 

CVs by persons owned by, controlled 

by, or subject to the jurisdiction or 

direction of a 15 CFR 7.4 entity; and 

e. geographic locations where data 

from CVs in use in the United States is 

transmitted, stored, or analyzed. 

5. Are there ICTS integral to CVs for 

which persons owned by, controlled by, 

or subject to the jurisdiction or direction 

of a 15 CFR 7.4 entity are sole source 

suppliers? To what extent do OEMs of 

CVs in use in the United States rely 

upon suppliers wholly or partially 

owned by a company based in or under 

the control of a 15 CFR 7.4 entity? 

6. In what ICTS hardware or software 

for CVs do persons owned by, 

controlled by, or subject to the 

jurisdiction or direction of a 15 CFR 7.4 

entity maintain a technological 

advantage over U.S. and other foreign 

counterparts and how may this dynamic 

evolve in the coming years? 

7. How, and to what degree, does CV 

automotive software connect to GNSS 

systems that are designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity? for geolocation and other 

functions? 

8. How might a disruption to the 

supply of ICTS components for CVs in 

use in the United States, including 

hardware and software, from persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity affect OEMs of CVs in use in 

the United States and ICTS suppliers? 

Where possible, please specify which 

disruptions to component supply would 

be particularly detrimental. 

9. To what extent can OEMs procure 

alternative sources of ICTS integral to 

CVs that do not constitute ICTS from 

persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

15 CFR 7.4 entities? 

10. Please describe the relationship 

between OEMs of CVs in use in the 

United States and their ICTS suppliers. 

Particularly useful responses may 

include the type of information that is 

shared between OEMs of CVs in use in 

the United States and their ICTS 

suppliers in the normal course of 

business, how this information is 

shared, what access or administrative 

privileges are typically granted, and if 

suppliers have any capability for remote 

access or ability to provide firmware or 

software updates. 

11. What risks might be posed by 

aftermarket ICTS integrated onboard 

CVs and interfaced with vehicle 

systems, such as tracking devices, 

cameras, and wireless-enabled 


ddrumheller on DSK120RN23PROD with PROPOSALS1
15070 Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 

diagnostic interfaces? Should 

aftermarket automotive systems or 

components be considered integral to 

CV operation? 

12. To what extent are ICTS 

components of CVs designed, 

developed, manufactured, or supplied 

by persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

a 15 CFR 7.4 entity present in critical 

infrastructure sectors? Are there 

instances of municipal, state, or federal 

funding for procurement of such 15 CFR 

7.4 entities’ ICTS integral to CVs for use 

in critical infrastructure sectors? 

13. What other instances exist where 

persons owned by, controlled by, or 

subject to the jurisdiction or direction of 

a 15 CFR 7.4 entity, are integrated into 

the ICTS supply chain for CVs? 

ii. Capabilities of Connected Vehicles 

May Increase the Likelihood of 

Vulnerabilities 15 CFR 7.4 Entities 

Could Exploit 

CVs and the components that enable 

their functionality present opportunities 

for exploitation by 15 CFR 7.4 entities 

via insider access, which could 

potentially result in severe 

consequences to U.S. persons and 

critical infrastructure. Increasing the 

number and scope of wireless connected 

components in a vehicle also increases 

the attack surfaces through which a 

malicious actor can gain initial entry. As 

CVs gain new and different connectivity 

capabilities, design, implementation, 

and operational protocols need to be 

added to address new attack surfaces 

and maintain the confidentiality, 

integrity, and availability of the data 

that traverse any one functional system. 

As demonstrated in controlled 

environments, attack vectors can be 

exploited and may provide access to 

other functional systems within a CV. 

Moreover, once one subsystem has been 

compromised, depending on the nature 

of the vulnerability and the design of 

the vehicle network architecture, the 

attacker might have the ability to move 

laterally and eventually gain access to 

other functional automotive systems. 

While integrated functionality may 

provide seamless communication, 

comfort, and operability for the 

consumer, it is possible that 

unauthorized remote access to a 

particular sensor system could be 

escalated to vehicle systems and 

operations, potentially resulting in 

injury, loss of life, and disruption to 

critical infrastructure networks. 

Preliminarily, BIS has identified the 

following capabilities associated with 

CVs that may increase the likelihood of 

vulnerabilities that 15 CFR 7.4 entities 

could exploit: 

Data Collection: CVs rely on the 

collection and integration of broad and 

varied data to improve the vehicle’s 

functionality and safety. This data, 

which can encompass vehicle-level data 

(e.g., driver behavior, vehicle status, 

geolocation, biometrics, driver mobile 

phone data) and environmental-level 

data (e.g., detailed mapping data, object 

detection, traffic patterns), are extracted 

through various onboard systems and 

sensors. The Advanced DriverAssistance System (ADAS) of a CV, for 

example, typically relies on a 

combination of sensors—radar, LiDAR, 

ultrasonic, audio, and video—that are 

constantly collecting and processing 

data. CVs now collect data inside the 

cockpit as well. Consumer and 

commercial CVs increasingly 

incorporate driver monitoring systems 

(DMS) to ensure the driver remains alert 

and fully able to take control of the car 

should autonomous systems fail, and to 

ensure commercial truck drivers remain 

on schedule. More sophisticated DMS 

feature driver-facing cameras— 

including eye tracking, facial 

recognition, and microphones—collect 

potentially sensitive information about 

drivers and passengers. This increases 

the sensitivity of the data that CVs 

collect, potentially providing 15 CFR 7.4 

entities with access to biometric 

information in addition to 

environmental data. 

Connectivity: CVs are connected to 

and can communicate with a range of 

external sources, including the OEM 

and third-party service providers, as 

well as in-car devices like smart phones. 

In an increasing subset of vehicles, 

telematics systems connect the vehicle 

with cloud-based services to provide 

onboard systems with external data 

streams (e.g., geolocation, streaming 

service, assistance service, emergency 

notification) and underlie many of a 

CV’s core functionalities. V2X systems, 

when widely implemented, will support 

the broadcast and reception of messages 

that enable safety alerts and mobility 

advisories. Providing broadcast (radio) 

communication capabilities that 

facilitate driver assistance capabilities 

may open cybersecurity vectors that 

need to be addressed to ensure 

broadcast message integrity and 

authenticity through design, standards, 

implementation and manufacturing 

protocols, and to prevent possible 

message and transmission misbehavior. 

Further, interconnectivity in the 

software or hardware components may 

amplify risks posed by ICTS integral to 

CVs that are designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity. For example, OEMs enable 

communication with their vehicle after 

sale even when a customer does not 

subscribe to services, including by 

providing software updates and 

refinements, as well as by enabling or 

disabling subscription-based features. 

This access by the OEM to the CV 

provides numerous opportunities for 15 

CFR 7.4 entities that own, control, or 

have the ability to exert jurisdiction or 

direction over the OEM, to insert 

vulnerabilities allowing for future 

backdoor attacks and other malicious 

behavior. Additionally, individually 

connected components and sensors are 

capable of transmitting data separately 

from the vehicle’s broader 

communications suite, including 

receiving over the air (OTA) updates 

without the knowledge or consent of the 

vehicle owner or OEM. BIS seeks to 

better understand the capabilities 

associated with technical trends—both 

current and future—in CV design and 

the ICTS components therein. In 

particular, the ANPRM seeks further 

comment on the following: 

14. What is the full scope of data 

collection capabilities in CVs and the 

aggregation and scale of data that CVs 

could collect on U.S persons, entities, 

geography, and infrastructure? Who has 

authorized access to, or control of, data 

collected by CVs? 

15. What types of remote access or 

control do OEMs have over their CVs? 

Please describe what software or other 

mechanisms allow for such remote 

access or control by the OEM to occur. 

16. What cybersecurity concerns may 

arise from linkages between sensors in 

CVs? To what extent can individual 

sensors and components communicate 

OTA independently from the CV’s 

Operating System (OS)? 

17. What standards, best practices, 

and industry norms are used to secure 

the interconnection between vehicles 

and charging infrastructure? How are 

battery management systems (BMS) 

integrated into a vehicle’s automotive 

software systems, and how are they 

protected from malware? 

18. How do manufacturers 

supplement existing cybersecurity 

standards and best practices such as the 

National Highway Traffic Safety 

Administration’s Cybersecurity Best 

Practices for the Safety of Modern 

Vehicles at each step of the CV supply 

chain, including design, manufacturing, 

and operation? 

a. Particularly useful responses will 

be specific about the types of programs 

and practices used such as test and 

verification, bug bounties, white hat 

programs, or end-to-end encryption to 

secure the link between vehicle and 


ddrumheller on DSK120RN23PROD with PROPOSALS1
Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 15071 

server. See Nat’l Highway Traffic Safety 

Admin., Cybersecurity Best Practices for 

the Safety of Modern Vehicles (2022), 

https://www.nhtsa.gov/sites/nhtsa.gov/ 

files/2022-09/cybersecurity-bestpractices-safety-modern-vehicles-2022- 

tag.pdf; see also Cybersecurity and 

Infrastructure Security Agency, 

Autonomous Ground Vehicle Security 

Guide: Transportation Systems Sector 

(2021), https://www.cisa.gov/resourcestools/resources/autonomous-groundvehicle-security-guide. 

19. Please describe the automotive

software development cycle. BIS is 

particularly interested in learning: 

a. The degree to which OEMs license

software, as opposed to developing it 

internally; 

b. The extent to which software is

developed outside the United States 

and, if so, where; 

c. What measures are taken to ensure

software security and integrity during 

the development cycle; 

d. If OEMs partner or co-develop

automotive software with any persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity; and 

e. The extent to which software that

is embedded in hardware (e.g., 

firmware) is subject to the development 

cycle described above. 

20. Please describe the relationship

between CV OEMs and cloud service 

providers (CSPs). Particularly useful 

responses may describe what access 

privileges, controls, and remote 

capabilities with respect to CV OEM 

systems are afforded to the CSP. 

Additionally, what are the common 

shared responsibility models between a 

CSP and a CV OEM and how are the 

communication and systems protected? 

21. How do CV OEMs verify the bill

of materials and software bill of 

materials as authentic for vendors and 

suppliers, specifically regarding OS, 

telematic systems, ADAS, Automated 

Driving Systems (ADS), satellite or 

cellular telecommunication systems, 

and BMS? If a software bill of materials 

is required, to what extent does it 

provide information regarding software 

vulnerabilities, and how is this 

information used, stored, and protected? 

22. To what extent is software from

vendors and suppliers tested and 

verified to comply with OEM 

requirements? 

23. What vendor-vetting and supply

chain security practices do OEMs 

employ when procuring ICTS integral to 

CVs? 

iii. Consequences

The ability of a 15 CFR 7.4 entity to

compel private companies through 

applicable legal frameworks, combined 

with the exploitation of vulnerabilities 

created by the increase in capabilities of 

the ICTS integral to CVs, has the 

potential to create severe and, in certain 

instances, catastrophic consequences for 

U.S. persons and critical infrastructure. 

Through ICTS designed, developed, 

manufactured, or supplied by persons 

subject to the ownership, control, 

jurisdiction, or direction of a 15 CFR 7.4 

entity, the intelligence agencies of that 

entity could obtain access to a wide 

range of information from companies in 

the CV ICTS supply chain to exfiltrate, 

collect, and aggregate sensitive data on 

U.S. persons. These data include 

location, traffic patterns, audio and 

video recordings of the inside and 

outside of the car, as well as information 

about the driver’s identity, finances, 

contacts, and home address, which can 

be collected by CVs themselves or by a 

passenger’s mobile device connected to 

a CV. 

In addition, backdoors embedded in a 

CV’s software could enable a 15 CFR 7.4 

entity under certain conditions to obtain 

control over various vehicle functions 

that could include the ability to disable 

the vehicle completely. A group of 

researchers were able to demonstrate a 

vulnerability in an OEM’s Bluetooth 

software that allowed access to some 

vehicle control systems, initiating 

remote actions such as activating the 

brakes and turning the steering wheel. 

See Consumer Watchdog, Kill Switch: 

Why Connected Cars Can Be Killing 

Machines and How to Turn Them Off 

37–40 (2019), https://consumer

watchdog.org/sites/default/files/2019- 

07/KILL%20SWITCH%20%207-29- 

19.pdf. A similar ability in the hands of

a 15 CFR 7.4 entity that can control or

direct an OEM could allow that entity

to disable the controls on an individual

vehicle while it was being driven or to

sabotage entire fleets without having

physical access to the vehicles. Finally,

because of CVs’ connectivity, they could

be used to access multiple critical

infrastructure systems with which they

interact, including telecommunications

networks, transportation systems, and

the electrical grid. As CV technology

advances, vehicles and charging

infrastructure may increasingly

communicate with these systems to

manage traffic flows and grid load. As

such, the proliferation of CVs containing

vulnerable ICTS from persons owned

by, controlled by, or subject to the

jurisdiction or direction of a 15 CFR 7.4

entity could provide that entity with a

platform for launching distributed

denial of service attacks against

intelligent transportation systems,

satellite or cellular communications 

hardware, or other critical 

infrastructure. See Mohammad Ali 

Sayed, et al., Electric Vehicle Attack 

Impact on Power Grid Operation, 137 

Int’l J. Electrical Power & Energy Sys. 

107784 (2022), https://www.science

direct.com/science/article/abs/pii/ 

S0142061521010048; Numaan Huq, et 

al., Cybersecurity for Connected Cars: 

Exploring Risks in 5G, Cloud, and Other 

Connected Technologies, Trend Micro 

Res. (2021), https://documents.trend

micro.com/assets/white_papers/wpcybersecurity-for-connected-carsexploring-risks-in-5g-cloud-and-otherconnected-technologies.pdf; Anastasios 

Giannaros, et al., Autonomous Vehicles: 

Sophisticated Attacks, Safety Issues, 

Challenges, Open Topics, Blockchain, 

and Future Directions, 3 J. of 

Cybersecurity and Privacy 493 (2023). 

Given these threats, vulnerabilities, and 

potential consequences, BIS is 

considering identifying the following 

automotive software systems as the 

ICTS integral to CVs most likely to 

present undue or unacceptable risks if 

exploited by 15 CFR 7.4 entities: (i) 

vehicle OS; (ii) telematics systems; (iii) 

ADAS; (iv) ADS; (v) satellite or cellular 

telecommunication systems; and (vi) 

BMS. 

As BIS considers whether and how to 

regulate these software systems, it seeks 

additional information, including: 

24. Are there ICTS integral to CVs

other than those identified in this 

ANPRM that could present material 

risks if they were designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction of a 15 CFR 7.4 entity? 

If so, please discuss how the ICTS could 

be exploited to pose such a risk. 

25. Of the ICTS integral to CVs

identified in this ANPRM, which 

present the greatest risk to safety or 

security if they are designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of a 15 CFR 

7.4 entity? 

26. As ADS systems evolve and

developers rely on cellular systems to 

communicate with ADS-enabled 

vehicles to support overall operational 

capability (e.g., communications to a 

fleet management office), what should 

the U.S. government consider in order 

to support the development of this 

technology securely from 15 CFR 7.4 

entity malign activity? 

III. Additional Questions for Comment

This ANPRM seeks comment on

processes and mechanisms that BIS 

could implement in a potential rule to 

authorize an otherwise prohibited ICTS 


ddrumheller on DSK120RN23PROD with PROPOSALS1
15072 Federal Register / Vol. 89, No. 42 / Friday, March 1, 2024 / Proposed Rules 

transaction with the adoption of 

mitigation measures. 

Authorizations and Mitigations 

27. In what instances would granting 

a temporary authorization to engage in 

an otherwise prohibited transaction 

under a proposed rule be necessary and 

in the interest of the United States to 

avoid supply chain disruptions or other 

unintended consequences? 

28. What review criteria should BIS 

implement when considering an 

application for a temporary 

authorization? 

29. What specific standards, 

mitigation measures, or cybersecurity 

best practices should BIS consider when 

evaluating the appropriateness of a 

requested authorization? 

30. Are there any U.S. government 

models, such as the Office of Foreign 

Assets Control’s sanctions programs or 

the Export Administration Regulations, 

that this program should consider 

emulating in granting authorizations? 

Economic Impact 

31. What economic impacts to U.S. 

businesses or the public, if any, might 

be associated with the regulation of 

ICTS integral to CVs contemplated by 

this ANPRM? If responding from 

outside the United States, what 

economic impacts to local businesses 

and the public, if any, might be 

associated with regulations of ICTS 

integral to CVs? 

32. What, if any, anticompetitive 

effects may result from regulation of 

ICTS that is integral to CVs as 

contemplated by this ANPRM? And 

what, if anything, can be done to 

mitigate the anticompetitive effects of 

regulation of ICTS? 

33. What types of U.S. businesses or 

firms (e.g., small businesses) would 

likely be most impacted by the program 

contemplated in this ANPRM? If 

responding from outside the United 

States, what types of local businesses or 

firms (e.g., small businesses) would 

likely be most impacted by the program 

contemplated in this ANPRM? 

34. What actions can BIS take, or 

provisions could it add to any proposed 

regulations, to minimize potential costs 

borne by U.S. businesses or the public? 

If responding from outside the United 

States, what actions can BIS take, or 

what provisions could it add to any 

proposed regulations, to minimize 

potential costs borne by local businesses 

or the public? 

35. What new due diligence, 

compliance, and recordkeeping controls 

will U.S. persons anticipate needing to 

undertake to comply with any proposed 

regulations regarding ICTS integral to 

CVs that are designed, developed, 

manufactured, or supplied by persons 

owned by, controlled by, or subject to 

the jurisdiction or direction of 15 CFR 

7.4 entities? 

Elizabeth L.D. Cannon, 

Executive Director, Office of Information and 

Communications Technology and Services. 

[FR Doc. 2024–04382 Filed 2–29–24; 8:45 am] 

BILLING CODE 3510–33–P 

FEDERAL TRADE COMMISSION 

16 CFR Part 461 

RIN 3084–AB71 

Trade Regulation Rule on 

Impersonation of Government and 

Businesses 

AGENCY: Federal Trade Commission. 

ACTION: Supplemental notice of 

proposed rulemaking; request for public 

comment. 

SUMMARY: The Federal Trade 

Commission (FTC or Commission) 

requests public comment on its proposal 

to amend the trade regulation rule 

entitled Rule on Impersonation of 

Government and Businesses 

(Impersonation Rule or Rule) to revise 

the title of the Rule, add a prohibition 

on the impersonation of individuals, 

and extend liability for violations of the 

Rule to parties who provide goods and 

services with knowledge or reason to 

know that those goods or services will 

be used in impersonations of the kind 

that are themselves unlawful under the 

Rule. The Commission believes these 

changes are necessary and such 

impersonation is prevalent, based on all 

comments it received on the Rule and 

other information discussed in this 

document. The Commission now 

solicits written comment, data, and 

arguments concerning the utility and 

scope of the proposed revisions to the 

Impersonation Rule. 

DATES: Comments must be received on 

or before April 30, 2024. 

ADDRESSES: Interested parties may file a 

comment online or on paper by 

following the instructions in the 

Comment Submissions part of the 

SUPPLEMENTARY INFORMATION section 

below. Write ‘‘Impersonation SNPRM, 

R207000’’ on your comment and file 

your comment online at https://

www.regulations.gov. If you prefer to 

file your comment on paper, mail your 

comment to the following address: 

Federal Trade Commission, Office of the 

Secretary, 600 Pennsylvania Avenue 

NW, Mail Stop H–144 (Annex I), 

Washington, DC 20580. 

FOR FURTHER INFORMATION CONTACT: 

Claire Wack, cwack@ftc.gov, (202–326– 

2836). 

SUPPLEMENTARY INFORMATION: The 

Commission invites interested parties to 

submit data, views, and arguments on 

the proposed amendments to the 

Impersonation Rule and, specifically, on 

the questions set forth in Section VIII of 

this supplementary notice of proposed 

rulemaking (‘‘SNPRM’’). The comment 

period will remain open until April 30, 

2024. To the extent practicable, all 

comments will be available on the 

public record and posted at the docket 

for this rulemaking on https://

www.regulations.gov. If interested 

parties request to present their position 

orally, the Commission will hold an 

informal hearing, as specified in section 

18(c) of the FTC Act, 15 U.S.C. 57a(c). 

Any request for an informal hearing 

must be submitted as a written comment 

within the comment period and must 

include: (1) a request to make an oral 

submission, if desired; (2) a statement 

identifying the person’s interests in the 

proceeding; and (3) any proposals to 

add disputed issues of material fact that 

need to be resolved during the hearing. 

See 16 CFR 1.11(e). Any comment 

requesting an informal hearing should 

also include a statement explaining why 

an informal hearing is warranted and a 

summary of any anticipated oral or 

documentary testimony. If the comment 

identifies disputed issues of material 

fact, the comment should include 

evidence supporting such assertions. If 

the Commission schedules an informal 

hearing, either on its own initiative or 

in response to request by an interested 

party, the FTC will publish a separate 

document notifying the public pursuant 

to 16 CFR 1.12(a) (‘‘initial notice of 

informal hearing’’). 

I. Background 

A. Trade Regulation Rule on 

Impersonation of Government and 

Business 

Published elsewhere in this issue of 

the Federal Register is the 

Commission’s final Trade Regulation 

Rule entitled ‘‘Rule on Impersonation of 

Government and Business,’’ 

promulgated under the authority of 

section 18 of the FTC Act, 15 U.S.C. 

57a(b)(2); the provisions of Part 1, 

Subpart B, of the Commission’s Rules of 

Practice, 16 CFR 1.7–1.20; and the 

Administrative Procedure Act 

(‘‘Impersonation Rule’’ or ‘‘Rule’’). This 

authority permits the Commission to 

promulgate, modify, or repeal trade 

regulation rules that define with 

specificity acts or practices that are 

unfair or deceptive in or affecting 


ddrumheller on DSK120RN23PROD with PROPOSALS1