Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define Its Role in Responding to a Real-world Attack
Released: 2016-04-25T00:00:00

Letter

Background

The number of annual fatalities and injuries due to motor vehicle crashes has declined from 42,836 fatalities and 2.8 million injuries in 2004 to 32,675 fatalities and 2.3 million injuries in 2014, although, according to NHTSA, the rate of decline has leveled off in recent years. The decline in fatalities and injuries over this time period is due in part to vehicle safety features, such as airbags. Automakers have also been installing a growing number of advanced technology features into vehicles to further improve passenger safety as well as to enhance driver and passenger convenience. For example, all vehicles manufactured starting in model year 2012 contain an electronic stability control feature that uses on- board sensors to detect and reduce skidding and automatically takes limited control from the driver to prevent the vehicle from leaving the roadway. Similarly, some new vehicles offer forward collision warning and automatic emergency-braking systems that use on-board sensors and cameras to provide warnings to the driver and in some cases assist the driver to prevent a crash from occurring. As NHTSA attributed 94 percent of highway crashes to human error in 2013, such technologies could help continue the overall decline in motor vehicle fatalities over the past decade. Driver and passenger convenience technologies include built-in navigation systems, keyless entry and ignition systems, and wireless Bluetooth capabilities, among other features.

To support these and other advancements in technology, modern vehicles contain a number of electronic systems and components that have grown in number and complexity since they were first introduced into vehicles in the late 1970s. For example, a vehicle manufactured in the late 1970s contained basic electronic components to meet federal emissions regulations, and by the 1980s, the engines in most new vehicles were electronically controlled. Over time, these electronic systems have begun to replace or control many of the traditional mechanical systems in vehicles. In 2009, NHTSA reported that a typical vehicle had around 50 embedded electronic control units (ECU) responsible for executing both core vehicle functions such as steering, as well as convenience and entertainment functions. By 2014 the agency estimated that a typical vehicle contained between 70 and 100 ECUs. In addition, over time, ECUs have evolved from controlling a single vehicle function and operating in isolation from other components, to controlling multiple vehicle functions and operating in conjunction with one another.

To facilitate communication among multiple ECUs without the need for complicated and extensive wiring systems, automakers began locating ECUs on in-vehicle communication networks, commonly referred to as buses or bus systems. According to NHTSA, the controller area network (CAN), which was first developed in 1985, has become the most commonly used in-vehicle communication network or bus; however, other types of networks are used by some automakers. The CAN was designed to ensure that ECUs within the vehicle could reliably and expediently send messages to one another. The specific configuration of CAN and other in-vehicle communication networks can vary widely across automakers and even across different models produced by a single automaker, depending on the number and types of features within the vehicle. For example, automakers may locate all ECUs on a single in- vehicle network or include one network to support safety-critical vehicle functions, such as steering and braking, and another network to support convenience and entertainment systems. Figure 1 illustrates how in- vehicle communications networks reduce the need for wiring while facilitating communication among ECUs.

While the shift from mechanical to electronically-controlled vehicle systems has helped improve the reliability and performance of certain vehicle features and allowed automakers to introduce new safety and “infotainment” features that are popular with consumers, it has also increased the potential for vehicles to be affected by cybersecurity breaches more commonly associated with the information technology (IT) and financial services industries. In particular, as the number of ECUs and electronic systems in vehicles has increased, the prevalence of software code in vehicles has also increased dramatically—and in some cases exponentially. DOT publications have indicated that a modern luxury vehicle could contain as much as 100 million lines of software code. In comparison, a Boeing 787 Dreamliner has about 6.5 million lines of software code (see fig. 2). According to researchers and others, the use of software in vehicles is likely to increase as more advanced vehicle technologies and connected vehicle technologies are incorporated. As the lines of software code in vehicles increases, so does the potential for software errors, such as coding errors, and related vulnerabilities.

According to NHTSA, in the context of motor vehicles, cybersecurity is the protection of automotive electronic systems, communication networks, control algorithms, software, users, and underlying data from malicious attacks, damage, unauthorized access, or manipulation. Although no vehicle cyberattacks impacting passenger safety have been reported outside of the research environment, our previous work has shown that the sources of cyber-threats vary in terms of the types and capabilities of the actors, their willingness to act, and their motives. For example, hackers break into networks for the thrill of the challenge, bragging rights in the hacker community, and monetary gain, among other reasons, whereas botnet operators use a network of compromised, remotely- controlled systems to, among other things, coordinate attacks, such as denial-of-service attacks that prevent the authorized use of networks, systems, or applications by exhausting resources. Still others, such as nations may use cyber tools for information-gathering and espionage activities, while terrorists may seek to cause harm or damage public morale and confidence.

Responsibility for ensuring the security of vehicle systems and components spans across the automotive supply chain and occurs throughout the vehicle development cycle. For example, automakers define core vehicle design requirements, including software system requirements, to automotive parts suppliers. In turn, automotive parts suppliers assemble vehicle systems and often rely on lower-level suppliers, such as chip manufacturers, to obtain the specific parts (i.e., hardware) for the vehicle systems. Each supplier is responsible for testing and validating its specific product and certifying that its product meets automaker specifications. Automakers may incorporate components from multiple suppliers to assemble the vehicle and are ultimately responsible for validating that safety-critical systems meet minimum performance requirements and operate as intended.

Within DOT, NHTSA is the primary agency responsible for vehicle safety. NHTSA’s mission is to save lives, prevent injuries, and reduce economic costs due to road traffic crashes. NHTSA developed Federal Motor Vehicle Safety Standards, which establish the minimum performance requirements for certain safety features, such as brakes and air bags, to which automakers must conform and certify compliance. NHTSA also conducts research in support of vehicle safety programs. The Office of Vehicle Safety Research conducts research in the areas of crashworthiness, crash avoidance, and electronic controls research. The electronic controls research—which includes research in the areas of electronics reliability, automated vehicles, and cybersecurity—is conducted by the Electronics Systems Safety Research Divisionand is also supported by VRTC, the agency’s in-house laboratory, in East Liberty, Ohio. In fiscal year 2015, the Office of Vehicle Safety Research had a budget of $29 million, of which $2.5 million was dedicated to electronics and vehicle cybersecurity research. According to NHTSA officials, as of July 2015, five full-time staff were dedicated to vehicle cybersecurity, automation, and electronics research. In addition, NHTSA has research under way related to cybersecurity for connected-vehicle technologies, which, as previously mentioned, are expected to provide safety benefits by deterring crashes.

Several recent laws and legislative proposals have included provisions related to vehicle cybersecurity. For example, MAP-21—which was signed into law in July of 2012—directed NHTSA to, among other things, complete an examination of the need for safety standards with regard to electronic systems in passenger motor vehicles and to consider various topics, such as the security needs for those electronic components to prevent unauthorized access. The act also required NHTSA to seek public comment in conducting its examination and to issue a report to Congress on the highest priority areas for safety with regard to electronic systems. In addition, the Fixing America’s Surface Transportation Act (FAST Act), enacted in 2015, requires DOT to submit a report to Congress on the operations of the Council for Vehicle Electronics, Vehicle Software and Emerging Technologies (Electronics Council), which was established in MAP-21 to provide a forum for research, rulemaking, and enforcement officials to coordinate and share information internally on advanced vehicle electronics and new technologies. Legislative proposals related to ensuring vehicle cybersecurity have also been introduced by members of Congress. For example, if passed, the Security and Privacy in Your Car Act of 2015 would require NHTSA to establish a “cyber dashboard” that displays an evaluation of how well each automaker protects the security and privacy of vehicle owners and would require automakers to adhere to government standards for vehicle cybersecurity. The Security and Privacy in Your Car Study Act of 2015 would require NHTSA, along with some other federal agencies, to conduct a study to determine the appropriate standards for the regulation of vehicle cybersecurity.

Finally, other federal agencies and foreign governments have also conducted cybersecurity research, particularly as it relates to connected- vehicle technologies, which are expected to increase the need for security protections. For example, the European Union sponsored two major projects examining the security of connected-vehicle technology communications. These projects resulted in guidelines for the various security elements needed for the deployment of connected-vehicle technologies, such as message integrity, privacy protection, and misbehavior detection.

Remote Attacks Involving Safety- Critical Vehicle Systems Could Have the Greatest Impact on Passenger Safety

Cyberattacks through Direct and Remote Access Are Possible, but Remote Attacks Are of Most Concern to Stakeholders

Based on our analysis of research and industry stakeholder views, modern vehicles contain multiple interfaces—connections between the vehicle and external networks—that if not properly secured, can become entry points—or attack paths—for cyber attackers. Some of these interfaces can only be accessed through direct contact with the vehicle, while others can be accessed remotely through short- and long-range wireless channels.

Cyberattacks through Direct Access

Selected industry stakeholders we interviewed identified several vehicle interfaces that can be compromised through direct, physical access to a vehicle (see fig. 3). Of these potential direct interfaces, most of the selected industry stakeholders in our review (24 out of 32) expressed concerns about attacks exploiting cybersecurity vulnerabilities through the on-board diagnostics (OBD-II) port. This port is mandated in passenger vehicles by regulation for emissions-testing purposes and to facilitate diagnostic assessments by auto dealers, repair shops, and car owners. In addition to being prevalent in modern vehicles, this port also provides direct and largely unrestricted access to in-vehicle communication networks. Thus, it can provide an attacker with sufficient access to compromise the full range of a vehicle’s systems, including safety-critical systems, such as the brakes and steering wheel. However, because accessing the OBD-II port and other direct interfaces generally requires direct access to the vehicle, such attacks would require attackers to target one vehicle at a time, thereby limiting the impact of a successful attack.

Cyberattacks through Remote (Short- and Long-Range Wireless) Access

Selected industry stakeholders we interviewed identified several main interfaces that could be used to undertake a remote cyberattack through short- or long-range wireless channels, such as built-in Bluetooth and cellular-calling capabilities (see fig. 3). The majority of these industry stakeholders (23 out of 32) agreed that remote attacks are the most concerning for passenger safety. Such attacks could involve multiple vehicles and cause widespread impacts including passenger injuries or fatalities. For example, two stakeholders told us that through remote attacks, cyber attackers could theoretically achieve massive attacks of multiple vehicles simultaneously. Half of the selected industry stakeholders (16 out of 32) emphasized that long-range wireless interfaces, such as cellular connections on the telematics unit, are especially concerning. Through such interfaces, the cyber attacker could theoretically exploit vulnerabilities to access the target vehicles from anywhere in the world and take control over the vehicles’ safety-critical systems.

Researchers have played a key role in publicly demonstrating that remote vehicle cyberattacks that impact safety are possible, because of vulnerabilities in modern vehicles. For example, in a hacking demonstration first reported in 2011, researchers from the University of Washington and University of California San Diego first demonstrated the ability to remotely attack multiple vehicles’ safety-critical systems through short- and long-range wireless channels without physical access to the target vehicles. In this demonstration, the researchers studied two General Motors (GM) vehicles, gaining an in-depth understanding of the vehicles’ systems, including the software code underlying various vehicle components and the CAN messages used to send commands between the ECUs that control the vehicle’s systems. After gaining access to a target vehicle’s CAN bus by exploiting software vulnerabilities in multiple wireless interfaces—including GM’s OnStar telematics system and the Bluetooth unit—the researchers were able to inject messages onto the vehicle’s CAN bus to take physical control over the vehicle, such as controlling the display on the speedometer, shutting off the engine, and controlling the brakes.

The researchers also showed that by exploiting vulnerabilities in the implementation of a telematics system—which connects participating vehicles via a cellular connection to a backend server maintained by the automaker—it would be possible to compromise multiple vehicles simultaneously. In this demonstration, the researchers exploited vulnerabilities in the communication protocols of GM’s OnStar system in order to send commands to the CAN buses of their two test vehicles. For safety reasons, the researchers only sent commands to take control of their test vehicles and only when these vehicles were in secured environments. However, if carried out by a cyber attacker, such an attack could have safety impacts on multiple vehicles. The researchers also demonstrated vulnerabilities in several other interfaces—including the Bluetooth unit—that could be exploited to send messages on the CAN bus and thereby take control over the vehicle’s safety-critical systems (see fig. 4 for an overview of the researchers’ hacking demonstration involving the Bluetooth unit).

In another example—the aforementioned Jeep Cherokee hacking demonstration reported in 2015—researchers exploited several vulnerabilities that allowed them to remotely disable a vehicle’s engine and in some cases control the brakes and steering. Similar to the 2011 GM demonstration, the researchers closely studied a test vehicle to understand its systems—including the characteristics of its software code and CAN messages—and showed it would be possible to remotely attack target vehicles with the same vulnerabilities as the test vehicle. Also, the researchers showed that it would be possible to exploit vulnerabilities in the implementation of a telematics system to target multiple vehicles participating in the telematics service. This demonstration involved multiple steps and identified a chain of vulnerabilities related to the vehicle’s network architecture, the telematics unit, and the cellular provider’s implementation of the vehicle’s telematics service (see fig.5 for an overview of this hacking demonstration).

In addition, researchers have demonstrated that wireless telematics devices that consumers can plug into OBD-II ports to provide vehicle data to third parties, such as insurance companies, contain vulnerabilities that can be exploited remotely. By using these devices—often referred to as “dongles”—consumers may qualify for decreased insurance rates. Also, these dongles can provide older vehicles lacking built-in wireless interfaces with connectivity, allowing consumers to access telematics features—such as long-range cellular connectivity—that would otherwise only be available through purchasing a modern vehicle with a built-in telematics unit. Since, as previously mentioned, the OBD-II port connects directly to the key in-vehicle systems, an attack on such dongles could enable an attacker to take control of safety-critical systems and turn what was formerly a direct attack path into a remote attack path. For example, a recent demonstration showed that a particular manufacturer’s dongles can be discovered online and then compromised by a remote attacker. The researchers were able to exploit vulnerabilities of the dongle, allowing them to send messages to the vehicle’s CAN buses, including messages to remotely apply and disable the brakes. Other demonstrations have shown similar vulnerabilities in other dongles.

Notably, each of the above hacking demonstrations illustrate that some overarching characteristics of the CAN bus make it more likely that a vehicle cyberattack launched through any interface—including non- safety-critical systems, such as the telematics unit—could impact safety. Specifically, these hacking demonstrations highlight a major security weakness of CAN: it assumes that any message on the bus is sent from a trusted sender, so messages are not secured or restricted in any way. In other words, these demonstrations help illustrate that because of the CAN’s design, there is no way to know whether a given message on the CAN bus originates from a legitimate source or from a cyber attacker. As previously noted, the CAN was designed in 1985, which was long before vehicles were connected to external networks and vehicle cybersecurity was an issue facing the auto industry. Despite its inherent security weaknesses, CAN is the most commonly used bus system in the auto industry today.

Stakeholders Acknowledge That Remote Attacks Are Difficult to Execute, but Expressed Concern about the Future Potential for Such Attacks

While the possibility that remote cyberattacks could occur outside the research environment is concerning, some of the selected industry stakeholders we spoke to (8 out of 32) have also pointed out that attacks comparable to the hacking demonstrations described above would be complex to execute. Specifically, most of these stakeholders noted that such attacks would likely require a high level of hacking sophistication, including specialized knowledge. For example, as previously mentioned, the researchers involved in the GM and Jeep hacking demonstrations had prolonged access to test vehicles, which they used to closely study the vehicles’ systems and key components. In another example, representatives from a cybersecurity firm noted that one very difficult step in such demonstrations is figuring out how to create authentic-looking messages that will be accepted and acted upon by the vehicle’s ECUs. In addition, one leading researcher predicted that those who would execute remote cyberattacks would be those with previous experience hacking into other computer systems; for someone with no such experience, hacking into a vehicle remotely would be very difficult.

To date, there have been no remote cyberattacks with safety impacts reported outside of the research environment. In addition, determining the risk that such a remote cyberattack will occur in the near future is challenging, especially because of the difficulty of predicting the actions of cyber attackers and since modern vehicles’ designs vary widely (with some vehicle makes and models more vulnerable than others to such an attack). However, most selected industry stakeholders we interviewed (26 out of 32) expressed concerns that real-world attacks with safety implications could occur in the near future, particularly as automakers begin deploying autonomous (i.e., self-driving) vehicles and connected- vehicle technologies. For instance, some stakeholders expressed concerns that as vehicles become increasingly autonomous–and assume control of more functions traditionally controlled by the driver such as steering and braking—it could become easier for remote cyberattacks to reach vehicles’ safety-critical systems. This is because autonomous vehicles’ systems will be tightly linked and highly responsive to inputs from external systems, such as sensors and the Global Positioning System, much more so than they currently are today. Also, DOT and the auto industry are planning to implement connected-vehicle technologies in coming years. These technologies are envisioned to further connect vehicles to one another and infrastructure, such as traffic signals, to increase safety overall. For example, vehicle-to-vehicle technologies would allow nearby vehicles to share data, such as information on vehicle speed and location, to warn drivers of and thereby help prevent imminent collisions. However, some stakeholders expressed concerns that cyber attackers could exploit vulnerabilities in the larger wireless networks used to facilitate these technologies to remotely cyberattack multiple vehicles simultaneously and take control over their safety-critical systems, which could result in accidents or other safety impacts.

A Variety of Key Practices and Technologies Are Available to Mitigate Vehicle Cybersecurity Vulnerabilities and the Impacts of Potential Attacks

Key Practices Used by Other Industries Are Available for Use in the Auto Industry

Selected industry stakeholders informed us that a range of key practices are available to identify and mitigate potential cybersecurity vulnerabilities in vehicles. For instance, stakeholders frequently cited key practices used by other industries with a longer history of cybersecurity concerns, such as the IT industry’s use of penetration testing and code reviews (see table 1). In addition, when NHTSA published A Summary of Cybersecurity Best Practices in 2014, it drew from existing practices used in other industries, including the IT, aviation, telecommunications, industrial control systems, energy, medical devices, and financial payments industries. Although the key practices identified by NHTSA were generally broader, higher-level practices than those identified by our selected industry stakeholders, there were some similarities. For example, both NHTSA and our selected industry stakeholders emphasized the importance of risk assessments in mitigating cybersecurity vulnerabilities.

According to some stakeholders we interviewed, the auto industry’s adoption of cybersecurity key practices varies by company and some companies are farther along with respect to following key practices than others. Some stakeholders pointed to the relative newness of cybersecurity in the automotive realm to explain why some companies are still building up their organizational capacity to address cybersecurity issues and developing or refining cybersecurity practices. In addition, some stakeholders also opined that until very recently some companies— primarily automakers—have been reluctant to accept vehicle cyberattacks as a real threat and take the necessary steps in response.

One of the key practices mentioned most frequently—by 23 of the 32 selected industry stakeholders we interviewed—related to developing capabilities to conduct remote, over-the-air (OTA) updates of vehicle software and firmware (see table 1). Some of these stakeholders pointed to OTA updates as an essential piece of automakers’ response capabilities as they would allow automakers to quickly and effectively respond to cybersecurity incidents if and when they occur. However, based on our interviews, only a few automakers have OTA update capabilities, and only one—Tesla—can update all systems, including safety-critical and non-safety critical systems, on a fleet-wide basis remotely. Representatives from one automaker explained that their company does not yet conduct OTA updates because this capability involves hiring new staff and developing a whole new IT infrastructure to ensure that these updates do not become a new remote attack path into their vehicles.

The concept of domain separation was also identified as a key practice by the majority of selected industry stakeholders we spoke with (22 out of 32). Several automakers informed us that their companies have been following this key practice for 7 or more years. For example, one German automaker informed us that the company adopted this practice in the late 1990s as more functions in the vehicle became electronically controlled and infotainment systems and telematics units were introduced into vehicles; however, company representatives explained that the company’s initial motivation was to ensure system stability, not to mitigate vehicle cyberattacks. In addition, several stakeholders suggested that the FCA hacking demonstration might not have had such significant safety impacts if the Jeep model involved had exhibited a greater degree of domain separation. Despite general agreement that domain separation can be a very effective mitigation strategy, some stakeholders pointed out that complete isolation or segregation is often not possible or practical because some limited communication will likely need to occur between safety-critical and non-safety-critical systems. For example, in some vehicles the infotainment system needs to receive information regarding the vehicle’s speed to keep the volume at a consistent level.

Other key practices that were mentioned by several selected industry stakeholders, but less frequently than those described in table 1, include having dedicated organizational resources specifically focused on cybersecurity, such as creating new cybersecurity divisions or high-level managerial positions, and developing responsible disclosure policies that facilitate communication and collaboration with researchers and other third parties who may identify vehicle cybersecurity vulnerabilities. For example, some stakeholders noted that responsible disclosure policies are used by large IT companies, such as Microsoft, to encourage researchers and others to report any software vulnerabilities that they identify in the company’s products.

Mitigation Technologies Can Be Incorporated at Multiple Vehicle Security Layers

Selected industry stakeholders informed us of several technologies that can help automakers and parts suppliers mitigate vehicle cybersecurity vulnerabilities and the impacts of potential cyberattacks (see table 2). As noted above, these stakeholders identified “implementing a layered approach to security” as a key practice. In other words, they noted that vehicle cybersecurity is enhanced as mitigation technologies are added at more layers, including the ECU layer, the in-vehicle network layer (e.g., CAN bus), and the external interfaces layer (e.g., telematics unit). In addition, in its white paper NHTSA and Vehicle Cybersecurity, NHTSA states that a layered approach to vehicle cybersecurity reduces the probability of attack and mitigates the potential ramifications of a successful intrusion.

Notably, most of the technologies identified by selected industry stakeholders we spoke with cannot be added on existing vehicles; rather, they must be incorporated into the vehicle design and production process, which as we describe later in this report, takes approximately 5 years to complete. The one exception is intrusion detection and prevention systems: several companies that are marketing these products for in- vehicle networks informed us that they have also developed aftermarket versions of their products that can be incorporated onto existing vehicles. In addition, most of the technologies identified by stakeholders serve to mitigate the inherent security weakness of CAN, which is that messages transmitted over a CAN bus are generally free flowing and not secured or restricted in any way. For example, a firewall placed between two in- vehicle networks can be set up to prevent the passage of any message that is not on a pre-determined list of approved messages (i.e., a “white list”). Figure 6 below depicts how firewalls and some of the other technologies listed in the table above can help mitigate vehicle cyberattacks.

Based on our interviews with selected industry stakeholders, automakers are still determining whether and how to implement some technologies that can help identify and mitigate vehicle cybersecurity vulnerabilities and reduce the impacts of potential cyberattacks. For example, several stakeholders expressed skepticism about the usefulness and effectiveness of intrusion detection and prevention systems—especially detection-only systems—and stated that these systems merit further testing before they are widely deployed on in-vehicle networks. In addition, as noted above, CAN has become the most commonly used in- vehicle network that facilitates communication among ECUs. However, one mitigation option—message authentication and encryption—cannot be easily incorporated onto CAN buses, as CAN does not provide sufficient bandwidth to host these protections. Some stakeholders informed us that this option is more feasible for higher-bandwidth networks, such as Ethernet, but noted that these networks are currently less prevalent than CAN and likely to remain less prevalent for some time given the costs associated with vehicle re-designs.

Stakeholders Face Challenges Related to Vehicle Cybersecurity, Some of Which May Be Addressed by Industry-Led Efforts

Stakeholders Identified Several Challenges Facing the Industry Related to Vehicle Cybersecurity

The most frequently cited set of challenges facing the industry in ensuring vehicle cybersecurity—mentioned by 15 of the 32 selected industry stakeholders we spoke with—was the lack of transparency, communication, and collaboration regarding vehicles’ cybersecurity among the various players in the automotive supply chain, as described in the following examples.

Several parts suppliers informed us that the security requirements they receive from automakers often lack sufficient context about the broader component or system. For example, one supplier stated that, ideally, automakers should provide specific security requirements (e.g., “encrypt data X using encryption mechanism Y”), as well as their higher-level system functionality, security, and protection goals, such as “ensure data confidentiality of function Z.” Suppliers stated that with sufficient information, they could more readily identify potential cybersecurity issues and recommend alternative protections and enhancements.

Some stakeholders also noted that it can be difficult for automakers to oversee and exert control over suppliers’ software code. They explained that because suppliers’ code is proprietary, the automakers do not have access to it and suppliers are reluctant to share it. One subject matter expert noted that as a result, all the automakers can really know about the code is how it performs when tested under certain conditions. In addition, one automaker noted that it can be especially challenging to exert control over third parties that manufacture dongles that plug into the OBD-II port for vehicle tracking and other purposes. They explained that while dongles have been shown to compromise vehicle cybersecurity, automakers are unable to set security requirements for these devices, as dongle manufacturers are not technically part of the automotive supply chain.

Highlighting the lack of transparency and collaboration that exists among the players in the automotive supply chain, one leading researcher we spoke with stated that “the most important and interesting commonality” with respect to the vulnerabilities identified in his research was that the vulnerabilities were located precisely at the interfaces where software code written by different supply chain players has to interact.

Another set of challenges cited by 13 of the 32 selected industry stakeholders was the cost of incorporating cybersecurity protections into vehicles. Some stakeholders informed us that profit margins for passenger vehicles are relatively narrow; as a result, even seemingly small modifications to enhance cybersecurity—such as using hardware with added security protections—can potentially be cost prohibitive to some automakers. Yet, according to some stakeholders, some automakers will likely have to pursue larger-scale changes—such as redesigning their in-vehicle communication networks—to significantly enhance the cybersecurity of their vehicles. Although many stakeholders declined to provide specific cost estimates, there was general agreement that these larger-scale changes would comprise a major upfront expense, which ultimately contributes to automakers’ continued reliance on legacy systems with inherent security weaknesses, such as CAN. In addition, stakeholders noted that automakers may not be able to pass the costs of cybersecurity protections onto consumers as they can with other features, such as connectivity and convenience features. As a result, automakers will have to balance the cost of cybersecurity protections against the risks facing vehicles and consumers’ willingness to pay.

Some stakeholders (13 of 32) also identified challenges related to the auto industry’s historical lack of cybersecurity expertise and companies’ efforts to build up their expertise in this area. According to stakeholders, the existing pool of candidates with the specific mix of knowledge and skills needed to design and validate secure vehicle systems is small. One automaker explained that due to the shortage of automotive cybersecurity professionals, the company often has to decide whether to hire hardware and software professionals and teach them cybersecurity or cybersecurity professionals and teach them hardware and software. In addition, one leading researcher mentioned that the lack of automotive cybersecurity professionals in particular—combined with a shortage of cybersecurity professionals more broadly—produces competition for top talent both within the industry and with major technology companies, such as Google. However, automakers are taking some steps to address these challenges. For example, several automakers informed us that they have begun partnering with colleges and universities to develop college curriculums that better meet their needs, and several U.S. and foreign automakers have opened technology and research and development centers in Silicon Valley, in part to be closer to the area’s high concentration of IT and cybersecurity professionals.

Finally, 12 of the 32 selected industry stakeholders we spoke with informed us that the auto industry’s long product development cycle creates challenges related to ensuring vehicle cybersecurity. According to some of these stakeholders, vehicles are designed approximately 5 years before they roll off of the assembly line. As a result, to the extent that automakers incorporated cybersecurity protections in their 2015 model year vehicles, these protections would have been based on technology— as well as threat information—available in 2010. One stakeholder suggested that this lag can make it easier for cyber attackers to understand and breach vehicles’ cyber protections and more difficult for automakers to ensure their vehicles are protected against the latest known threats. Other challenges that were mentioned by several selected industry stakeholders, but less frequently than those cited above, include identifying and assessing vehicle cybersecurity threats and risks and measuring the performance and effectiveness of cybersecurity protections. For example, stakeholders noted that there are no widely accepted cybersecurity performance metrics, and it is difficult to prove that a vehicle with up to 100 million lines of code is secure. According to one stakeholder, testing every line of code in a vehicle would take several months, which is not feasible or practical.

Several Industry-Led Efforts Are Under Way That Could Help Address Some Challenges Related to Vehicle Cybersecurity

Auto industry stakeholders pointed to several industry-led efforts that could potentially improve automakers’ and parts suppliers’ ability to identify and mitigate vehicle cybersecurity vulnerabilities, as described below. As noted above, the adoption of key practices to identify and mitigate vehicle cybersecurity vulnerabilities currently varies significantly across the auto industry. As a result, several stakeholders told us that the main benefit of these and other industry efforts will be to help level the playing field across the industry. However, in some cases, stakeholders identified more specific benefits and goals associated with the various efforts that may help to address some of the key challenges facing the industry described above. For instance, stakeholders noted that efforts focused on incorporating cybersecurity into vehicle-design and engineering processes could help facilitate more productive conversations between automakers and their suppliers by creating shared expectations and a common language for discussing vehicle cybersecurity issues and requirements.

Automotive Information Sharing and Analysis Center

The effort to establish an Information Sharing and Analysis Center (ISAC) for the auto industry is being led by two U.S. industry associations—the Alliance for Automobile Manufacturers and the Association of Global Automakers—and their members. Similar to ISACs created for other industries, such as the Financial Services ISAC, the Automotive ISAC is intended to serve as a central hub for intelligence collection and analysis and provide a forum for members to anonymously share threat and vulnerability information with one another. According to representatives from the Association of Global Automakers, the ISAC—a U.S. entity that supports members that operate globally—began operations at the end of 2015. They also informed us that the Automotive ISAC’s membership will initially be limited to automakers so that these companies, which are highly competitive, can acclimate to the new organization and establish and maintain the level of trust and cooperation necessary for a successful ISAC. However, the goal is to expand the ISAC’s membership to include other stakeholders, such as parts suppliers, as soon as practically possible.

Selected industry stakeholders we spoke with, as well as DOT officials, generally expressed positive views regarding the potential effectiveness of an Automotive ISAC. However, some expressed skepticism regarding the ISAC’s potential effectiveness. For example, one stakeholder stated that the ISAC’s effectiveness could be limited given the sensitivity of the information that will need to be shared among competitors and the significant heterogeneity in vehicles’ electronic architectures, parts, and components.

Society of Automotive Engineers’ Vehicle Cybersecurity Guidelines

SAE (Society of Automotive Engineers) International—a standards development organization for the auto industry comprised of engineers and other technical professionals—established two taskforces led by representatives from the U.S. automakers that have been working since 2012 to develop recommended practice documents related to vehicle cybersecurity. According to SAE representatives, the taskforce focused on vehicle hardware security is still in the process of developing its draft product; however, the taskforce that is focused on identifying and addressing cybersecurity risks during the vehicle’s design process has recently completed its draft of SAE J3061: Cybersecurity Guidebook for Cyber-Physical Vehicle Systems. This guidebook, which was issued in January 2016, provides an overarching framework and basic guiding principles for incorporating cybersecurity protections into the design of vehicle systems, among other things. Selected industry stakeholders we spoke with were generally supportive of SAE’s efforts to develop recommended practice documents.

Design and Engineering Process Standard for Cybersecurity

In July 2015, German automakers informed us that they were working with the International Organization for Standardization (ISO) to develop a voluntary design and engineering process standard, similar to ISO 26262, that is focused on vehicle cybersecurity. One stakeholder involved in this effort told us that the standard would help automakers and parts suppliers speak a common language and ensure that all stakeholders are asking themselves similar questions when designing their systems and determining appropriate levels of cybersecurity protections. Another stakeholder told us that a critically important aspect of this standard is that it would allow for variation and flexibility with respect to the types and methods of cybersecurity protections, as it would not mandate the use of specific technologies. Many selected industry stakeholders we spoke with indicated that they would support the development of this type of voluntary design and engineering process standard. Two German companies said that they have already incorporated elements of this proposed standard into their existing processes.

In November 2015, one German automaker involved in the ISO effort informed us that—given the similarities between the intent of SAE’s Cybersecurity Guidebook for Cyber-Physical Vehicle Systems and the proposed ISO standard—SAE and ISO have agreed to jointly develop a robust, international standard for cybersecurity that will build upon the work already completed by SAE. Despite widespread support for both the SAE and ISO efforts, some stakeholders mentioned that the standards development process can be slow and that it can often take several years to achieve consensus and finalize a standard.

AUTOSAR (Automotive Open System Architecture) Partnership

Since 2003 companies involved in the AUTOSAR (Automotive Open System Architecture) partnership—which was founded by German automotive companies and now includes 7 of the 8 automakers and 6 of the 8 parts suppliers we interviewed—have been working on a set of specifications to manage the growing complexities associated with the development of vehicle software. More specifically, the partnership aims to standardize the basic software functionality of automotive ECUs and increase the transferability and reuse of vehicle software across manufacturers and product lines, among other things. Although AUTOSAR’s goals are broader than ensuring vehicle cybersecurity, representatives informed us that the partnership has developed some specifications related to vehicle cybersecurity. For instance, AUTOSAR has several specifications that pertain to the use of message encryption and authentication techniques and recently issued a specification aimed at protecting the integrity of ECU messages transmitted across in-vehicle communication networks. According to AUTOSAR representatives, one of the main benefits of the partnership for automakers and parts suppliers is the reduction in costs associated with software development and testing. Other benefits of the partnership include the assurance that all applicable standards and requirements—including any future cybersecurity standards and requirements—have and will be incorporated into AUTOSAR specifications and the increase in product quality due to the use of standard specifications.

DOT Has Made Progress in Addressing Vehicle Cybersecurity, but Has Not Yet Defined and Documented Its Roles and Responsibilities in Responding to a Vehicle Cyberattack

NHTSA Has Established a Vehicle Cybersecurity Research Program

According to NHTSA officials, efforts to specifically consider vehicle cybersecurity have been under way over the last 5 years. Specifically, the agency modified its Vehicle Safety Research organization in recognition that vehicle cybersecurity represents a safety concern. In January 2012, NHTSA created a new Electronic Systems Safety Research division— which conducts research on electronics reliability, automated vehicles, and cybersecurity—within the Vehicle Safety Research’s Office of Vehicle Crash Avoidance. Within this new division, NHTSA established a cybersecurity research program in 2012 and set goals for it, including: developing tools to enable applied research in this area, fostering industry’s development of new solutions, and gathering facts to inform potential future federal policy and regulatory decisions. Cybersecurity research has become one of NHTSA’s highest safety research priorities and falls into four main areas, as summarized in table 3. Some of this research is conducted by NHTSA’s staff. For example, its VRTC conducts NHTSA’s sensitive and quick turn-around cybersecurity research projects, according to officials. Other research is conducted through contracts with DOT’s Volpe Center and other research institutions. NHTSA officials informed us that the agency has used the results of its completed research to inform industry about its efforts and to form the basis for additional research currently under way or planned. The officials expect more reports to be issued in 2016 as additional research projects are completed.

Most selected industry stakeholders we spoke to (25 out of 32) were aware that NHTSA is conducting vehicle cybersecurity research, but their opinions differed about whether NHTSA is appropriately focusing and prioritizing its research. Of those stakeholders who discussed NHTSA’s research in this area, the majority (10 out of 18) told us that its research focus and prioritization are appropriate. For example, according to some stakeholders in our review, the research reports NHTSA issued in 2014 provide helpful background on the issue of vehicle cybersecurity. Specifically, representatives from one automaker told us that they use the report on characterizing vehicle cybersecurity threats to make their own determinations about how to respond to identified vulnerabilities. However, six selected industry stakeholders told us that NHTSA could improve its research prioritization in this area. For example, two stakeholders noted that NHTSA has not dedicated enough resources to this important issue. In another example, two other stakeholders stated that NHTSA’s efforts to recreate the Jeep Cherokee hacking demonstration are not useful since such efforts are more reactive than proactive. However, VRTC staff told us that recreating this hacking demonstration allowed them to determine that the initial steps that FCA took to mitigate the vulnerabilities were not successful and additional steps needed to be taken.

NHTSA officials told us that their ability to conduct additional research is in part dependent on funding and resources the agency receives for vehicle cybersecurity and other priority research areas. In recent years, the agency has requested an increase in funding to support additional staff in the Office of Vehicle Safety Research, in part to conduct additional cybersecurity research, but actual funding received was lower than requested. For example, in fiscal year 2015, NHTSA requested $36.8 million for the Office of Vehicle Safety Research but received $29 million; this sum was about a $4 million decrease from the $32.5 million the Office received for fiscal year 2014. NHTSA officials told us that due to the 2015’s funding being lower than requested, they had to make difficult decisions and forgo other planned projects in order to carve out the $2.5 million that was ultimately dedicated to electronics and vehicle cybersecurity research in fiscal year 2015. This amount was still a decrease from the $2.7 million dedicated to this area in fiscal year 2014. Despite lower funding levels, officials told us they have been able to leverage resources from other programs, such as by using test vehicles for the New Car Assessment Program for cybersecurity research. To build on its ongoing research, the agency’s fiscal year 2016 budget requested $1 million for additional space and new equipment at VRTC, as well as $4.1 million to enhance a program on vehicle electronics and emerging technologies. In addition to the applied research it conducts, officials also told us that they attend cybersecurity conferences where researchers present findings on vehicle cybersecurity vulnerabilities and participate in various working groups, such as serving as a liaison on SAE International committees, to enhance their understanding of vehicle cybersecurity issues. Finally, NHTSA collaborates in relevant research efforts led by other federal agencies. For example, it participates in two ongoing efforts by DHS: one effort involving seven major automakers which is focused on researching intrusion detection systems and secure over-the-air updates for vehicles, among other issues, and another effort focused on ensuring the cybersecurity of government-owned vehicles.

NHTSA Is Developing Guidance to Help Ensure Consistent Responses to Vulnerabilities

In November 2015, NHTSA officials informed us that they were developing guidance to help automakers understand the agency’s determinations—and to assist automakers in making their own determinations—regarding the types of vehicle cybersecurity vulnerabilities that would constitute a safety defect and, therefore, merit a recall. According to NHTSA officials, the differing conclusions reached by NHTSA and FCA regarding the need for a recall in the aftermath of the Jeep Cherokee hacking demonstration, underscored the need for this guidance. While the guidance is not yet complete, NHTSA officials informed us that they intend to create a document that provides a framework and educates the industry on the methodology NHTSA uses and the factors it considers when assessing risks associated with cybersecurity vulnerabilities in order to make safety defect and recall determinations. According to NHTSA officials, factors such as the number of affected vehicles, frequency of occurrence, likelihood of exploitation, and the resulting hazard level (i.e., impacts to safety-critical systems) can be important when assessing risk and making safety defect determinations; these and other factors will be explained in the guidance. For example, the officials noted that NHTSA would be particularly concerned with identified vulnerabilities that would enable a cyber attacker to manipulate the safety-critical systems of multiple vehicles. In January 2016, NHTSA officials informed us that they expect the guidance to be issued by March 31, 2016.

Several industry stakeholders we spoke with—including automakers and industry associations—told us that this type of guidance would be helpful and is needed. For example, representatives from one industry association told us that absent guidance, automakers could monitor NHTSA’s actions and recall decisions over time to get clarity on what factors NHTSA considers important in making safety defect determinations; however, conducting such monitoring of NHTSA’s actions is not efficient. In addition to being helpful to the industry, such guidance could also help NHTSA respond to identified vulnerabilities more consistently. For example, several stakeholders noted that while NHTSA requested that FCA conduct a recall in response to the 2015 Jeep Cherokee hacking demonstration, it did not request a recall in response to the GM hacking demonstration in 2011, despite the fact that both demonstrations revealed similar vulnerabilities that allowed researchers to remotely control the vehicle’s safety-critical functions. NHTSA officials informed us that due to staffing changes that have occurred since 2011, they could not confirm why the two similar hacking demonstrations were handled differently. However, they noted that the Jeep Cherokee researchers planned to publicly report more details about the identified vulnerabilities than the GM researchers had reported; and that the release of such details could have allowed cyber attackers to replicate the Jeep Cherokee demonstration.

NHTSA Has Established a Vehicle Electronics Council and Is Assessing the Need for Vehicle Cybersecurity Standards and Regulations

NHTSA is taking steps in response to the requirements set forth in MAP- 21, including establishing an Electronics Council and assessing the need for vehicle cybersecurity standards and regulations. As directed by MAP-21, NHTSA established an Electronics Council in 2012 to coordinate and share information on a broad array of topics related to vehicle electronics and emerging technologies, including cybersecurity. More specifically, NHTSA officials informed us that the Council’s mission is to broaden, leverage, and expand the agency’s expertise in vehicle electronics to continue ensuring that these technologies enhance vehicle safety. NHTSA officials told us that the Council’s membership includes staff from NHTSA’s Office of Vehicle Safety Research and other offices responsible for the agency’s vehicle safety work. However, NHTSA’s Chief Counsel was also designated as a member to ensure that the agency fully understands its rulemaking and oversight authority regarding electronics-related issues. According to NHTSA officials, the Council holds bimonthly meetings, which NHTSA Associate Administrators attend; the Council also periodically briefs NHTSA’s Administrator. NHTSA officials also informed us that the Council’s meetings can serve as a forum for collaboration between the agency and industry stakeholders. For example, they said that the Council sometimes invites outside subject matter experts to share information with NHTSA during its bimonthly meetings, or recommends other training by such experts that would be helpful for NHTSA staff to attend.

Although NHTSA has taken some steps to examine the need for safety standards for electronic control systems as required by MAP-21, which could include government standards related to vehicle cybersecurity, officials informed us the agency’s examination is still ongoing. As part of its examination, NHTSA is considering establishing process standards, which would prescribe specific processes for developing vehicle electronic systems. This step would be a departure from NHTSA’s current approach of developing performance standards, such as the Federal Motor Vehicle Safety Standards, which set a specific level of performance but do not prescribe specific methods that must be used to meet a given standard. In October 2014, NHTSA issued a request for public comment to help inform its examination of the need for safety standards for electronic control systems, including the need for cybersecurity standards. Among other things, NHTSA requested comments on available performance standards and process standards, such as ISO 26262, that could potentially be adapted and incorporated into government standards to address vehicle cybersecurity. In January 2016, NHTSA issued a report that summarized its analysis of the public comments it received, including industry stakeholders’ thoughts on the need for voluntary industry standards as well as government standards pertaining to vehicle cybersecurity. In this report, NHTSA noted that most of the 40 stakeholders that submitted comments agreed that vehicle cybersecurity is a dynamic, complex problem that may not be effectively addressed with the use of “static” or “prescriptive” government standards.

Half of the selected industry stakeholders we spoke with (16 out of 32) also expressed doubts about the effectiveness of “static” or “prescriptive” government standards to address vehicle cybersecurity, since threats are constantly changing and such standards could become outdated quickly. In addition, some stakeholders expressed concerns that regulations could result in unintended negative consequences for cybersecurity, similar to several existing laws and regulations. For example, as noted above, the OBD-II port—which many stakeholders identified as a key entry point for vehicle cyberattacks—is mandated by regulation for diagnostic and testing purposes. As a result, several automakers told us that they have limited ability to restrict access to in-vehicle networks and systems provided by the port; however, one informed us that it was exploring what types of OBD-II port restrictions and protections would be legally allowed. Two automakers also expressed concerns about potential negative impacts for vehicle cybersecurity that could stem from recent changes to regulations implementing the Digital Millennium Copyright Act. In general, this act prohibits access to and circumvention of protections associated with digital copyrighted materials; however, in 2015, the act’s regulations were amended to include exemptions for vehicle software accessed for diagnostic and repair purposes and “good faith” research. For example, one industry association that opposed the change stated that increasing access to vehicle software will make it harder for automakers to develop effective protections for their vehicles’ cyber systems. However, two leading researchers we interviewed opined that these changes will help mitigate cybersecurity vulnerabilities, as they will allow more researchers to identify vulnerabilities without fear of legal action.

On the other hand, some selected industry stakeholders (13 out of 32) told us that voluntary industry standards alone would be insufficient for ensuring vehicle cybersecurity and that thus some government standards and federal oversight will be needed. For example, one subject matter expert suggested that—contrary to current self-certification practices that are common in the auto industry—NHTSA should establish an oversight body to evaluate automakers’ compliance with any cybersecurity-related standards it issues and verify that these standards are being met. In addition, another expert noted that this kind of oversight process could help promote the use of best practices while also providing NHTSA with additional assurance that the automotive supply chain is secure. Both experts noted that as part of this process, NHTSA could turn to qualified independent third parties to assess whether automakers are taking the proper steps for vehicle cybersecurity.

According to NHTSA officials and the agency’s Priority Plan for Vehicle Safety and Fuel Economy, 2015-2017, the agency plans to complete its initial research on vehicle cybersecurity in 2016 and also announce an agency decision about next steps pertaining to vehicle cybersecurity and other issues related to electronic control systems. The decision could be to conduct more research, initiate a rulemaking, issue guidance, or some combination thereof. As of July 2015, officials estimated that the agency was about 3 years away from making a final determination about the need for additional government standards or regulation in this area; thus, such a final determination is not expected until at least 2018. NHTSA officials explained that this time frame is necessary in part, because they expect several research projects that are planned and under way to help inform their decision. In addition, NHTSA officials informed us that as they determine the need for regulations, they want to better understand alternative steps such as the development of voluntary industry standards that could be taken to address this issue.

NHTSA Has Not Yet Defined and Documented Its Roles and Responsibilities in Responding to a Vehicle Cyberattack

In its whitepaper NHTSA and Vehicle Cybersecurity, NHTSA states that its goal is to “be ahead of potential vehicle cybersecurity challenges, and seek ways to address or avoid them altogether.” As described above, NHTSA has made progress in many areas in an effort to proactively address potential cybersecurity threats to vehicle safety-critical systems; however, NHTSA has not yet formally defined and documented the agency’s role and responsibilities in the event of a real-world vehicle cyberattack and how the agency’s response actions would be coordinated with other federal agencies. Given that NHTSA and selected industry stakeholders we spoke with generally agreed that the threat of a vehicle cyberattack will increase as autonomous and connected-vehicle technologies are deployed in the coming years, such a response plan may be particularly important for NHTSA to develop proactively, before the threat environment significantly changes. Until such a plan is developed, NHTSA’s response efforts—regardless of the threat environment in which an attack is carried out—could be slowed as agency staff and other stakeholders may not be able to quickly identify the appropriate actions that NHTSA should take. In addition, the lack of such a response plan is inconsistent with federal standards for internal control, which—among other things—are intended to help agencies in managing change associated with shifting environments and evolving demands and priorities. Under these federal standards, agencies are required to appropriately and clearly document their internal controls, which include the policies, plans, methods, and procedures used to meet agency missions, goals, and objectives; and assess risks.

NHTSA officials offered several roles and responsibilities they believe the agency would have in response to a vehicle cyberattack involving safety- critical systems, including quickly contacting the appropriate industry personnel and determining what actions need to be taken, such as regulatory or enforcement action, a Direct Final Rule, or other action. In addition, NHTSA officials told us that the agency would also validate the feasibility of the cybersecurity threat or event at its VRTC and take steps to ensure that any new information regarding threats and vulnerabilities is reflected in NHTSA’s research program. However, NHTSA officials told us that these roles have not been outlined in a formal response plan yet, in part because the agency currently lacks clarity regarding other roles and responsibilities it may have to fulfill in the event of an attack. For example, according to NHTSA officials, it is currently unclear whether NHTSA or DHS would be “the responsible agency” in charge of the government’s response if a large-scale vehicle cyberattack on safety- critical systems were to occur.

According to NHTSA officials, the agency is working with other federal agencies, such as DHS, to clarify the roles and responsibilities of the various agencies that would be involved in responding to a vehicle cyberattack. NHTSA officials informed us that these interagency discussions are still ongoing and could not provide a time frame as to when they expect the discussions—and subsequently, a plan outlining NHTSA’s roles and responsibilities in the event of an attack—to be completed. However, NHTSA officials stated that obtaining clarification on its roles and responsibilities in the event of a cyberattack on safety-critical vehicle systems is a priority for the agency, and in their view, a response plan would be a useful tool for the agency to develop.

Conclusions

In recent years, researchers have played an instrumental role in demonstrating that remote vehicle cyberattacks with safety implications are possible and increasing overall awareness about vehicle cybersecurity issues among consumers, the media, and the general public. Despite awareness of risks related to vehicle cybersecurity since at least 2011, the auto industry and NHTSA have only recently sharpened their focus on this issue. As this report describes, NHTSA has taken several important steps since 2012 to address vehicle cybersecurity, including establishing a vehicle-cybersecurity research program and soliciting industry input on the need for government and voluntary industry standards. However, NHTSA does not anticipate making a final determination on the need for government standards until 2018 when additional cybersecurity research is expected to be completed. In addition, several industry efforts to address vehicle cybersecurity—such as the development of an Automotive ISAC and a voluntary design and engineering process standard for cybersecurity—are still in their early stages. As such, some of these government and industry efforts to address vehicle cybersecurity are unlikely to provide many benefits for vehicles already operating on the roads today or those currently in the design and production stages.

Given that NHTSA and industry stakeholders expect the threat of a vehicle cyberattack to increase in the coming years as autonomous and connected-vehicle technologies are deployed, it will be important for NHTSA to continue to take proactive steps in the interim to ensure that it is meeting the agency’s goal of being ahead of vehicle cybersecurity challenges. The agency’s planned guidance outlining when cybersecurity vulnerabilities constitute safety defects should help ensure consistent responses when cybersecurity vulnerabilities are identified. However, until NHTSA defines and documents the agency’s role and responsibilities in the event of a real-world vehicle cyberattack affecting safety-critical systems, it may not be in a position to quickly and effectively respond should a threat materialize.

Recommendation

To enhance the agency’s ability to effectively respond in the event of a real-world vehicle cyberattack, the Secretary of Transportation should direct NHTSA to: work expeditiously to finish defining and then to document the agency’s roles and responsibilities in response to a vehicle cyberattack involving safety-critical systems, including how NHTSA would coordinate with other federal agencies and stakeholders involved in the response.

Agency Comments

We provided a draft of this report to the Departments of Transportation (DOT), Homeland Security, Defense, and Commerce for review and comment. We received written comments from DOT, which are reprinted in appendix II.

DOT concurred with our recommendation to define and document NHTSA’s roles and responsibilities in response to a vehicle cyberattack involving safety-critical systems. DOT also noted that the agency has been actively involved in research and collaborative efforts to address vehicle cybersecurity issues. DOT cited some recent actions by NHTSA to address vehicle cybersecurity vulnerabilities, including convening a public roundtable on vehicle cybersecurity and finalizing the Proactive Safety Principles agreement in January 2016. Through this agreement, NHTSA and 18 automakers committed to work together to develop a collaborative, data-driven process to advance safety objectives, including mitigating cybersecurity threats.

The Departments of Homeland Security, Defense, and Commerce reviewed our report, but did not have any comments.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretaries of Transportation, Homeland Security, Defense, and Commerce, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to examine: (1) available information about the key cybersecurity vulnerabilities in modern vehicles that could impact passenger safety; (2) key practices and technologies, if any, available to mitigate vehicle cybersecurity vulnerabilities and the impacts of potential attacks; (3) views of selected stakeholders on the challenges they face related to vehicle cybersecurity and industry-led efforts to address vehicle cybersecurity; and (4) the Department of Transportation’s (DOT) efforts to address vehicle cybersecurity.

To address all of our objectives, we reviewed technical papers, reports, and other documentation relevant to the cybersecurity of modern vehicles published by DOT’s National Highway Traffic Safety Administration (NHTSA). For example, we reviewed a series of reports on vehicle cybersecurity published by NHTSA in October 2014. We also interviewed officials from several NHTSA offices, including the Office of Vehicle Safety Research and Office of Enforcement and the Volpe National Transportation Systems Center. In addition, we reviewed previous GAO reports related to connected-vehicle technologies, information technology (IT), and cybersecurity, and identified and reviewed relevant research papers and publications. The reviewed citations were located through searches in bibliographic databases, including Transport Research International Documentation and SciSearch, or relevant industry conferences. We used three research papers to inform our findings regarding the potential for remote vehicle cyberattacks to impact passenger safety. We reviewed and summarized these research papers to identify the main steps of the hacking demonstrations and discussed them with the researchers to obtain additional information and clarification about the demonstrations.

In addition, we conducted semi-structured interviews with 32 selected industry stakeholders, including 8 automakers, 8 automotive parts suppliers, 3 automotive cybersecurity firms offering vehicle cybersecurity products, and 13 subject matter experts, including 7 leading researchers (see table 4). These interviews informed all four of our objectives. Automakers were selected to ensure we had representation from each of the 3 major auto-producing regions of the world (the U.S., Europe, and Asia) and the two U.S. industry associations (the Alliance of Automobile Manufacturers and the Association of Global Automakers) that were jointly pursuing several efforts related to vehicle cybersecurity, such as the formation of an Automotive Information Sharing and Analysis Center (ISAC). We also sought to include automakers that were considered leaders in vehicle cybersecurity as well as those that had been the subjects of cybersecurity hacking demonstrations. We selected the top 5 automotive parts suppliers based on global sales in 2013 and other suppliers based on stakeholder recommendations. We also interviewed 3 automotive cybersecurity firms that are offering vehicle cybersecurity products for new and existing vehicles based on stakeholder recommendations. The subject matter experts were identified through our literature search, relevant industry conferences, stakeholder recommendations, and our prior work on connected-vehicle technologies, and were considered subject matter experts based on their job titles and experience, technical papers and publications, contributions to relevant industry conferences (e.g., speeches, presentations, and organizing roles), and other significant contributions related to vehicle cybersecurity (e.g., contracted to conduct vehicle cybersecurity research for federal agencies). We identified leading researchers from the group of subject matter experts as those with extensive applied research experience in vehicle cybersecurity. After conducting our interviews with selected industry stakeholders, we summarized and analyzed their responses to identify themes relevant to each of our research objectives, such as themes regarding the main vehicle interfaces that could be used to undertake vehicle cyberattacks. The viewpoints gathered through our interviews with selected industry stakeholders represent the viewpoints of the individuals interviewed and cannot be generalized to a broader population.

To identify the key vehicle cybersecurity vulnerabilities in modern vehicles that could impact passenger safety and key practices and technologies that could mitigate these vulnerabilities, we interviewed officials from other federal agencies involved in vehicle cybersecurity research or cybersecurity efforts more broadly. These agencies included: the National Institute of Standards and Technology (NIST) within the Department of Commerce, the Department of Homeland Security’s Science and Technology Directorate, and the Defense Advanced Research Projects Agency within the Department of Defense. We also reviewed documents published by NIST, such as its Framework for Improving Critical Infrastructure Cybersecurity, and based on stakeholder recommendations, interviewed representatives from several IT and telecommunication firms to identify key mitigation practices and technologies. To address our objective on challenges and industry-led efforts related to vehicle cybersecurity, we also interviewed representatives from entities involved in those efforts, including representatives from the Alliance of Automobile Manufacturers, the Association of Global Automakers, AUTOSAR, the National Council of ISACs, and Society of Automotive Engineers International.

To assess DOT’s efforts to address vehicle cybersecurity, we reviewed applicable federal laws and regulations—such as the Moving Ahead for Progress in the 21st Century Act (MAP-21) and the Fixing America’s Surface Transportation Act (FAST Act)—including their requirements for NHTSA pertaining to vehicle electronics and cybersecurity. We also reviewed GAO’s Standards for Internal Control in the Federal Government and NHTSA documents regarding the agency’s strategic planning and vehicle cybersecurity research priorities, including its Priority Plan for Vehicle Safety and Fuel Economy 2015-2017; request for public comment on automotive electronic control systems safety and security issued in response to MAP-21 requirements; and mandated report to Congress that summarized and analyzed the public comments it received, among other things. We also visited NHTSA’s Vehicle Research and Test Center (VRTC) in East Liberty, Ohio, to tour NHTSA’s research facilities and observe ongoing vehicle cybersecurity research and equipment demonstrations. In addition to our VRTC site visit, we conducted the stakeholder interviews described in this appendix, in part, during site visits in 2015 to Detroit, Michigan, to meet with U.S. automakers, among other stakeholders; Silicon Valley, California, to meet with Tesla, technology firms, and parts suppliers; and Brussels, Belgium, and various locations within Germany to obtain international perspectives on vehicle cybersecurity from a variety of stakeholders—including automakers, parts suppliers, government officials, and subject matter experts.

We conducted this performance audit from February 2015 to March 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Transportation

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments:

In addition to the contact named above, the following individuals made important contributions to this report: Nabajyoti Barkakati and Gregory C. Wilshusen (Directors); Nancy Lueke (Assistant Director); Jessica Bryant- Bertail; West Coile; Pamela Davidson; Charlotte Hinkle; David Hooper; Thomas Johnson; Jaclyn Nidoh; Josh Ormond; Malika Rice; and Amy Rosewarne.