SPY Car Study Act of 2017

To direct the Administrator of the National Highway Traffic Safety Administration to conduct a study to determine appropriate cybersecurity standards for motor vehicles, and for other purposes. 1. Short title This Act may be cited as the Security and Privacy in Your Car Study Act of 2017 SPY Car Study Act of 2017 2. Study on cybersecurity standards for motor vehicles (a) Study required The Administrator of the National Highway Traffic Safety Administration, in consultation with the Federal Trade Commission, the Director of the National Institute of Standards and Technology, the Secretary of Defense, the Automotive Information Sharing and Analysis Center, SAE International, manufacturers of motor vehicles, manufacturers of original motor vehicle equipment, and relevant academic institutions, shall conduct a study to determine appropriate standards for the regulation of the cybersecurity of motor vehicles manufactured or imported for sale in the United States that should be adopted by the Administration and any other appropriate Federal agencies. The study shall include an identification of— (1) the isolation measures that are necessary to separate critical software systems from other software systems; (2) the measures that are necessary to detect and prevent or minimize in the software systems of motor vehicles anomalous codes associated with malicious behavior; (3) the techniques that are necessary to detect and prevent, discourage, or mitigate intrusions into the software systems of motor vehicles and other cybersecurity risks in motor vehicles, such as continuous penetration testing and on-demand risk assessments; (4) best practices to secure driving data collected by the electronic systems of motor vehicles while such data are stored onboard the vehicle, in transit from the vehicle to another location, in offboard storage, and in long-term storage (whether onboard or offboard the vehicle); and (5) a timeline for implementing systems and software that reflect the measures, techniques, and best practices identified under paragraphs (1) through (4). (b) Reports to Congress (1) Preliminary report Not later than 1 year after the date of the enactment of this Act, the Administrator shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report containing the preliminary findings of the study conducted under subsection (a). (2) Final report Not later than 6 months after the submission of the report under paragraph (1), the Administrator shall submit to the committees described in such paragraph a report containing the complete findings of the study conducted under subsection (a), including recommended dates for the adoption and effectiveness of the standards determined to be appropriate in such study and recommendations for any legislation that may be necessary to authorize the adoption of such standards. (3) Form of report The report required by paragraph (2) shall be submitted in unclassified form but may contain a classified annex. (c) Definitions In this section: (1) Administrator The term Administrator (2) Critical software system The term critical software system (3) Driving data The term driving data (A) a vehicle’s status, including its location or speed; or (B) any owner, lessee, driver, or passenger of a vehicle.

Summary: Security and Privacy in Your Car Study Act of 2017 or the SPY Car Study Act of 2017 This bill requires the National Highway Traffic Safety Administration to conduct a study to determine and recommend standards for the regulation of the cybersecurity of motor vehicles manufactured or imported for sale in the United States. The study shall identify: isolation measures that are necessary to separate critical software systems that can affect the driver's control of the movement of the vehicle from other software systems; measures that are necessary to detect and prevent or minimize anomalous codes, in vehicle software systems, associated with malicious behavior; techniques that are necessary to detect and prevent, discourage, or mitigate intrusions into vehicle software systems and other cybersecurity risks in motor vehicles; and best practices to secure driving data about a vehicle's status or about the owner, lessee, driver, or passenger of a vehicle that is collected by the electronic systems of motor vehicles; and a timeline for implementing systems and software that reflect such measures, techniques, and best practices.