Transcripts For CSPAN Hearing On Cars And The Internet 20160104

Will have Opening Statements herd, ms. F, mr. Kelly. After that, we will hear from then, after wend have heard from the witnesses, we will go to questions. So with that, i will give the first Opening Statement and again, welcome, everyone. Its interesting, the age we live in, of new technology and communications. The Incredible Technology that we see in take for granted every day, we are hearing a new we are entering a new era in transportation technology. Theres some of the older panelists, members of an audience who remember when you used to open the hood of a car and could take out the various parts and identify everything. Figure outd a phd to what is in there, and its capabilities are just astounding. A lot of safety features and cars we didnt have before, but we today will address the issues relating to, again, what we call the internet of cars and look at some of the implications of that technology. I think some of this was highlighted some time ago when that vehicle was hacked. Fortunately, it wasnt the folks who chose to do harm, but it did demonstrate that vehicles with certain types of electronic fact bety can in hacked, and it does pose some questions. We have called together today leaders of industry and some others. I particularly want to thank the private sector partners a frankn open and discussion of where we are in where we are going and what the industry is doing to deal with some of these issues and i think they have been most cooperative and i appreciate that and we learned a lot from that particular informal meeting. Today is a little bit more formal. Can ave a lot that we 2010,of benefits in 1. 2 million on the worlds highways. United states, some years ago, we had 43,000 per we have taken that down to 33000 and there are a lot of positive things that have been done again, through safety, technology, warning systems, a whole host of electronic devices. Now, in our vehicles, that makes us safer. Economic benefit from connected vehicles is estimated to be 500 billion. We want to ensure that Electronic Systems we have in these vehicles cannot be hacked, that, in fact, we have safety provisions put in and protections for the consumer and for the public. Helped author the direct national Highway Traffic Safety Administration to complete the review and ultimately determine the needs for safety vehicles and Electronic Systems. We will hear from some folks today where they are in the requirement that will be crafted and put in that. A pastnow the year and the deadline be set in law. Automobile makers has been setting their own Cyber Security standards which is the good news. The bad news is that we have a lot of variety and people going a different direction while the andonal Highway Safety Traffic Safety administration continues to move forward, mandating, dictated shortrange communication devices in cars you must make certain technology this technology hasnt been surpassed by the next thing that is coming up. Are it is is in technology rapid. Advances in technology a rapid purely spent over 500 million on testing this technology that was discovered in 1999. , in 1999, this stateoftheart for some of our communications was the flip phones and we have come ability further from that, so. I fully support connected Vehicle Technology and help with this advancement in the future. We will see vehicles that can talk to each other. Inwill see safety provisions vehicles that will make cars and have more reliable a whole host of features that will benefit the consumer in the traveling public. Ae we must be able to allow bridge to get that environment is the new technologies come to light. While remaining cognizant of the need for Consumer Privacy. So this afternoon, i look forward to hearing testimony from potential witnesses and i pledge to work collaboratively with everyone here on this side, both sides of the aisle, and with the industry. We are entering a new, exciting era that we want to be ready for. Let me now recognize the Ranking Member of the subcommittee on transportation for her Opening Statement. Thank you. Our Motor Vehicles rely on the same methods of communication to and as we have seen committee times, Computer Networks are regularly the victims of hackers. Theave already mentioned july instance this year when a vehicle was hacked. Less than one month later, from that instance, or researcher demonstrated how vulnerabilities in a different vehicle could also let hackers learn the owners home and dress, see our credit card information, and more. So far, there has been no note incidence of malicious attempts to have vehicles but i have to ask the witnesses today, is that because the overall security of the Vehicle Computers is that good . Or heavily simply been that lucky . Congress gave the national Highway Transportation Administration the responsibility to regulate Cyber Security in vehicles but manufacturers and suppliers in the best position to identify weaknesses in their own products. Safety ofhe cyber cars, trucks and motorcycles on the nearly 4 million miles of road that crisscross the United States requires partnership of government, industry, and researchers. Each has an Important Role to play. That is why fight it especially troubling that according to bloomberg, one of the automobile manufacturers involved in the july hack we did 18 months, 18 months to tell federal safety regulators about the security flaw while the other manufacturer reportedly knew about the vulnerability for five years. It undermines a partnership that is a surge protector Public Safety from Cyber Security threats. That is simply unacceptable. Connected Automated Vehicles communicate with other vehicles. They have the potential to revolutionize road safety and save thousands of lives. I agree with him. I look forward to examining these issues in more detail. I think the chairman for bringing this hearing. Thank you. I to recognize mr. Heard, who has the subcommittee on Information Technology for his Opening Statement. Thank you. s hearing is one of a series of hearings. To join with you in a transportation subcommittee here today. My first car was a toyota four runner and i like to call her Shirley Marie appeared i got her in the summer of 2000 and added until summer 2013. We had a lot of adventures together the wanted she cannot do is connect to the internet. 2020, it isd to forecast to one in five vehicles will have some form of Wireless Network connection. It amounted to more than 250 million connected vehicles. Thatent study predicted the internet of things, which includes cars, could have a total potential Economic Impact of between 4 trillion 11 trillion. The report further states that the hype around the internet of things may actually understate the full potential. I agree. I likely does understate the full potential but only if policymakers, consumers, advocates, and other stakeholders understand the real value can be created and focus on supporting innovation and Cyber Security and privacy practices. I worry that overeager regulators in congress will hacked it a stunt with restrictive regulations and heavyhanded legislation. Let forward to hearing from our witnesses from the Automotive Industry today on what steps they are taking proactively to secure their connected vehicles and protect peoples safety as well as their privacy. I look forward to hearing from mr. Garfield on what the companies he represents are doing to ensure the same, that people are safe, that information is secure, that they can be confident to increase the benefits offered by connected vehicles. Aboutorward to hearing the standards of excellence in Highway Safety while staying strictly within the statutory authorities and taking care not to hamper innovation. Thank you. I am pleased to recognize the Ranking Member of the subcommittee on Information Technology. Love them. You are recognized. I think the chairman and our witnesses. Todays cars has been dubbed computers on wheels are they gather in store vast arrays of personal information about the drivers, affording greater convenience and safety but also greater erosion of privacy and security. Our automakers are inventing new technologies that have made the drivers experience more enjoyable and efficient. Tor the air in vehicle Vehicle Technology, things that were once only sciencefiction can save lives and prevent accidents. Comes new innovation questions over security challenges and how data is stored. As a number of internet connected cars grows, so does the threat of vehicle hacking. If cars are going to store personal information about where route and lives, the they taken together, and where they stop, there should be assurances that the information. S stored securely our subcommittees review of cedar previous cyberattacks on networks revealed that the same vulnerabilities show up again. The interconnectivity of seemingly unrelated parts of the Network Makes it substantially easier for a hacker to move through a network and locate sensitive personal information. It is not just Computer Systems that lack segmentation. Seemingly unrelated components of internet connected cars do, as well. A modern car can talk to the radio, the radio can tell whether the doors are locked and the doors know whether the wench and wipers are gone. One of the key topics of todays hearing from me is whether the Auto Industry is designing cars with operating systems that securely store personal information. Ofwe enter this great age tremendous technological innovation, i will focus on how automakers, congress, and regulators can Work Together to secure our vehicles from malicious attack and protect americans. I think our witnesses i think our witnesses for their participation. I think our witnesses for their participation. The yield the remainder of my time. Think you. Thank you. The internet of things brings technology and connectivity into every corner of our lives including our cars. With the pervasiveness of standards, security and Privacy Protection to come or part of the never. Unlike other sectors, security and privacy by designer not yet fully ingrained in Automotive Manufacturing culture, as evidence by vendors regarding cars ever Security Issues with wireless entry fees and hacks of cars. However, regulation can be slow, rigid, and discouraging and red rushing the regulation is not my opinion the answer. But neither is a lack of accountability or standards. The advances of the industry has made in the past year, such as setting up an information sharing and Analysis Center and a set of enforceable privacy principles happened in part because of public and government pressure. The security in the car study act also known as the spike our study act, a bipartisan bill sponsored by congress. Industry in bringing advocates egovernment together to strike a balance between innovation and consumer protection. I served in the military i insulin reserves and i am turned to think about worstcase are threeso there overarching scenarios and questions of elected post at the panel hopefully during the time today you might be of immense array. The first is, is it possible now or in the future for a hacker to remotely taking control of a car and use either as a weapon or cause an accident . Second, is it possible now or in the future for a hacker to take control of a fleet of cars and use them as weapons or cause accidents . 30, is it possible for hackers now or in the future to take partial control of a car so thats and say you are going to in a Highway Safety must for our and suddenly the brace without your knowledge thereby causing an accident. Be curious to know if one does a andretical possibilities, second, if so, looking again to mitigate that aspect . Americans have a right to drive cars that are safe and keep their information audited and eyes by the comment the testimony from todays panel in the forward to asking additional questions on this issue of public importance. Think you. 8 thank you. I yield back. Think you. Thank you. Do any of the members have quick statements . The chair will hold a record open for five legislative days for any number who would like to submit a written statement. Mr. Harry lightsey who is the director of Consumer Experience at General Motors. Sandy logan steam, Vice President loganstein that toyota. Toyota. At toyota. Garfield is the president and ceo of the Information Technology industry ms. Barnes finally, is the associate director and Administrative Law council of the electronic privacy information center. Welcome, witnesses. I might tell you in advance that i will swear you in a just a second and we also try to statement,limit your your verbal statement before the committee to five minutes. Chair tosk through the have Additional Information or data put into the record. With that, we are investigating an Oversight Committee and subcommittees of congress. Could you please stand and i will swear you in. Raise your right hand. The you solemnly swear that the testimony you are about to give before the joint subcommittee meeting of congress is the whole truth and nothing but the truth . Allthe record reflect that of the witnesses answered in the affirmative. Thank you. Be seated. We will go right to our witnesses. Let me start first with welcome him again and all of you and thank you for your cooperation today and he is the administrator of the Vehicle Safety research at national Highway Traffic Safety Administration. Welcome. You are recognized. The microphone up as close as you can so we can hear you. Good afternoon. I appreciate this opportunity to testify up at the national Highway Traffic Safety Administration is addressing emerging challenges associated with new, connected Vehicle Technology. In 2013, there were over five. 7 vehicle crashes in the United States that resulted in 32,719 deaths. The consequences of these crashes range from personal tragedies that will impact individual families forever to the billions in economic dollars that we can actually measure. To a dress these crashes in the increasing use of connected vehicle technologies we can believe can help us to that. When combined together, new technologies and such as vehicle to vehicle communication and Automated Technologies have the potential to dramatically change the safety picture in the u. S. However, as the chairman pointed out, these new technologies also bring new and different challenges. For example, consumers hear a lot about Cyber Security as it is related to things imprisonment remission. It often seems like every day, there is a breach reported in the media. Auto space, Cyber Security is taking on new visibility, showing up and television shows. We understand these dynamics. We believe that the challenges associated with connected vehicles are addressable in asia not keep us from pursuing innovation that can save lives. And analysis indicates that it can address up to 80 of crashes involving two or more Motor Vehicles. This technology promises to be transformative in could even enable a new era of safety to not only saves lives but other benefits, as well. And fully realize, this Communication Technology is a symbol even beyond on vehicles. It can be deployed to other devices that would be carried by pedestrians and cyclists, thereby addressing those types of crashes. However, for it to be effective, it relies on the low cost Security System a robust Security System. Exploring the potential of connected vehicles and other advanced technologies, we understand the Cyber Security is essential to the Public Acceptance of new Vehicle Systems and if it filled the safety promise they hold. To developing the last Cyber Security environment, we modified its organizational structure, developed partnerships, adopted it and approach considered legislative action, and encourage members of the industry to take independent improve the Cyber Security posture of vehicles. Our goal is to be ahead of potential vehicle Cyber Security challenges and seek ways to address them. Consulted other Government Agencies, vehicle manufacturers, suppliers, and the public to develop our cyber program. The approach covers various safety applications deployed on vehicles as well as those envisioned for future vehicles that may feature more advanced forms of communications and automation. However, we also believe there are tremendous opportunities in this round for proactive steps. In fact, such steps are essential. Regulation and enforcement alone will not be sufficient to address the risks. Cyber security threats simply moved to fastener to varied for regulation to be the only answer. The Auto Industry can play an essential role by cooperating in establishing rigorous practices that are address the broad range of cyber threats, by reacting quickly and appropriately when such threats emerge, and by working closely with the government in independent security analysts to identify and defeat attacks. We have also given special consideration to the Security Systems that enable this technology. Have spent some time developing the network and the trusted architecture goes along with the system. While we have made significant progress, we believe that more testing is necessary we plan to undertake that. The trust aspect of the system is based upon bki. Tweet the design to balance security and privacy. We take Consumer Privacy very seriously and in the context of our proposed rulemaking on fears of the vehicle communication, we will address privacy as a relates to that system. The effectiveness of the Tv Technology also has unallocated portion of the spectrum. In light of growing demand for spectrum, special sharing has been a topic of much discussion. D. O. T. Is not opposed to sharing the spectrum. Toward that end, d. O. T. Is working closely with that cc and tia, members of the industry, and other stakeholders on a next databases to test and evaluate potential sharing solutions for the 5. 9 gigahertz spectrum. We are waiting for devices. Under the leadership is secretary fox, the department has taken several steps that support the deployment of this technology. In august 2014, we issued in advance proposal of rulemaking in the plentiful of it up this you with a proposal and just recently the secretary announced about a program all into two for the deployed this technology. Connected and Automated Vehicles that can sense the environment around him and communicate with his other vehicles and with the infrastructure have the potential to revolutionize road safety and save thousands of lives. We are already laying the groundwork needed for the road ahead and look forward to working with congress, manufacturers, suppliers, and others in the administration, and in eric in public, in this exciting transmission future. Unfortunately addressing questions. Thank you. Welcome theduce a executive director of global innected Customer Experience Global Public policy at General Motors. Welcome. Thank you very much. Thank you for the opportunity to testify. Roughly 100 years of his existence, the automobile has impacted American Life in ways unique to any other machine. It has impacted how we live and work, where we live and work, how our cities have grown, and how our country has grown. Yet the machine itself remains basically what it was at the time of its inception. Engineine combustion connected by a drivetrain two wheels on the road, driven by a human being. We are now entering an era where all of those basic tenets will change genetically. Cars will, more and more, have different modes of mobility other than a gasoline engine. They will be connected to each other in ways that will make the driving experience safer and more enjoyable. More, reallyre and for a human being of the driving task. Because we know that humans are fallible and will have crashes in cars, the Automobile Industry and the national highway traffic Transportation Safety has spent the last half century designing and building automobiles to be safer when they crash. With innovations like seatbelts, airbags, and crumple zones. Andy, we are designing building automobiles to avoid collisions entirely. With technologies like forward and rear collision warning, backup cameras, lane keeping, and blind spot warnings. Technologies these allow the machine to assist in the driving task itself when the human driver does not react appropriately when quickly enough to prevent a crash. Technologies like a vehicle to Vehicle Communications will be deployed with the promise to and had over 80 of the crashes on todays roads. The savings in terms of lives, property damage, medical cost, and congestion will be enormous. Movingral motors, we are quickly to take advantage of these innovations. Read the first automobile manufacturer to build connectivity into our vehicles. Has over 6 million customers in the United States in over one million customers connected on our we have employed technology in our vehicles, including advanced rearview mirrors and we are the only automaker that has announced a commitment to deploy vehicles with the technology and the cadillac model next year. However, we must acknowledge that with change comes challenge. We must deploy these innovations the safest manner possible. We must omit to our customers we must admit to our customers that we respect their privacy. The software may have more abilities that bad actors could exploit to threaten customer safety and privacy. And we must do all we can to prevent hacking. We must realize that we are competing with other technologies for the use of scarce resources like spectrum. We must be able to use these resources in an efficient mannar. Er. If we have the freedom to innovate within these parameters, the promise of the future cannot be imagined today. Thank you, i look forward to your questions. Thank you, we will now hear from the Vice President of connected services and product planning at toyota. Welcome, your recognize. An exciting time for the Auto Industry, more vehicles are being outfitted with more safety features and on bilboard services. We interact with these the a via smartphone. Futurenected car of the will far surpass the ones of today. To address questions about vehicle data, the industry came together and develop rentals for vehicle technologies. These privacy principles include meaningful protections, including heightened protections on vehicle data, like the vehicle location or how someone drives. For example, automakers will not share with third parties or use the data for marketing purposes without the affirmative consent of the owner. With these principles, the industry will protect data in the internet of things. This is precisely the type of effort the government has encouraged from the private sector, and it should serve as a model. Cyber security is a key focus. Although no cyber attack on a vehicle has occurred, the Auto Industry is well aware that the risks that exist for other connected devices also exist for connected cars. We fully grasp the potential consequences of the successful, realworld attack. In that light, the Auto Industry exchangeg a group to industry information. We are fully committed to the success. We expect initial information sharing by the beginning of the end of this year. Some are making the case that Cyber Security best practices and standards are needed. The question is, whether automotive best practices will look any different than those that guide Cyber Security and other contexts . That being said, the Auto Industry recognizes that efforts to adapt best practices to the vehicle may be appropriate. That is why the industry has recently embarked on an effort to identify best practices that are being and can be applied to vehicles and to address any potential gaps. For the very same reasons that the government has refrained from mandating Cyber Security standards and other sectors, there is a significant risk of the government mandating vehicles. Industry can move quicker than government to adjust to new threats. In addition, setting specific standards may encourage some companies to simply comply not to do more to protect consumers. Finally, a specific approach will almost certainly have for the limitations internet of things at large. At the internet of cars you call, we are on the cusp of a radical transformation that will be made possible by vehicle to Vehicle Communications. Dsrc is a technology that will us to overcome challenges posed by Sensor Technology. We can identify collisions at a greater distance or around the corner. Red an extensive dsrc. Laboration on due to the spectrum crunch, we support the prospect of sharing spectrum, if they can be proven that no harmful interference lifeimpair dscr safety of mission. A proposal has been offered that has the potential to accomplish this goal. The Auto Industry has recently proceeded to validation testing, and we remain confident it will remain a workable solution. In closing, i like to provide two final observations. First, the internet of cars ecosystem is evolving. Technology companies, telecommunication providers, Insurance Companies, and others will continue to introduce pots and technologies designed to directly communicate with vehicles. As the ecosystem evolves possibility for protecting against cyberattacks and preserving Consumer Privacy should evolve to include all relevant players in this space. Second, there is a number of agencies seeking to oversee or influence Cyber Security and privacy related to the internet of things, either broadly or with a narrow subset. The resulting cacophony of proposals is exceedingly difficult to manage and prioritize. Without consolidations of these efforts, clarification of the roles, and better communication, the opportunities provided will almost certainly suffer. Thank you for the opportunity to testify before you. Well, thank you. We will recognize the Vice President of Business Development for tesla. Welcome, sir. You are recognized. Good afternoon, we appreciate the opportunity to come here today. And for the opportunity to speak. Tesla is known for being exceptionally safe. We have been awarded the highest possible safety rating, five stars, not just overall, but in every category. Safety is a watchword at tesla. Automotive injury and fatalities have fallen as result of safety improvements such as airbags, energy absorption, and to maintain the pace of fatality rates, vehicles need to increasingly use computerized systems to avoid crashes, with particular opportunity in the vehicle space. Two examples leading to significant safety benefits, compared to nonconnected vehicles, are the following. The first would be automatic emergency braking. A vehicle feature which attempts to avoid accidents by applying brakes. Tesla is one of 10 manufacturers committed to making this a standard feature. We have delivered on this promise. The same technology is applied to autopilot functionality, where improvements are constant, as vehicles effectively learn from varying Road Conditions and share those through the fleet with connectivity. The recall rate in general is about 70 . For a given vehicle that 7 rants a recall, about will get repaired. Connected Vehicle Technology offers a significant opportunity for us to do better. Modern vehicles are heavily softwarecontrolled, and Software Changes alone can often resolve a safety issue. In 2013, we became aware of a hazard relating to incomplete thirdparty installation. After the change was identified, we were capable of identifying and solving the thirdparty fault. The Software Solution was automatically delivered to the entire fleet. And in contrast to the industry average, recall updates of 70 , we can achieve update rates nearly 100 in a short amount of time measured in days. Concerns as we go forward, the first caution is to ensure that any update to a vehicle is updated by the manufacturer. This can be achieved by using cryptography, a technology referred to as signing. The second is to strongly isolate the mechanical. If it has network conductivity, the processor should not have direct elections to the mechanical systems steering, acceleration, breaks. We do not have gear selection, that is a separate matter. Some implement this with a gateway technology. A third precaution is to use encrypted protocols for the vehicle. This ensures privacy of the integrity of the data. Weh respect to regulation, have rapid innovation for safety. Already significantly benefiting from investments in successvity, we expect to only continue, as the full potential of connected vehicles are realized. Overzealous or premature regulation does not allow for innovation or creative solution innovation. Fety any move in this direction must be considered carefully, only to the extent necessary, in our view. Thank you for the opportunity. I would welcome any question. The would like to recognize gentleman with iti. Thank you, members of the committee. The mostlf of 65 of Dynamic Companies in the world, we thank you for hosting this hearing. It is perfectly timed before 42 million americans get on the road to engage in thanksgiving commutes. I would suspect that 510 years from now, the cars in the commute would look quite different. I will focus my testimony on the issue, which is the transformation that is occurring, the innovation that is taking place, in that space first. Second, what we are doing to deployment in a secure and safe way. It is often said that it is difficult to appreciate history when you are experiencing and living it. From my conversation with our companies, we are living in an innovation renaissance. The convergence of almost ubiquitous broadband exponential improvement in computational processing comes with almost unlimited storage, and it is transforming mobile computing. That includes the original mobile technology, which is the car. Insee that manifested today advanced driver systems, whether that is adapted Cruise Control or automatic braking which i have and maryin my car. We will see that in the future, whether it is vehicle to vehicle or in Autonomous Vehicles. We are working hard to deploy technologies to make those types of vehicles available, sooner rather than later. Whether that is dedicated shortrange communications, wireless,te or or 5g is a number of panelists have noted, it is in the early days. It is impossible to tell which will work effectively. What we do know is that there will be radical, transformative improvements in safety, access, as well as how we view our cities. The other panelists have spoken about the safety issues. I will not repeat that. But think about all the people today who are not able to drive because of a disability or because they are too old or too young. , orugh connected vehicles Autonomous Vehicles, those people will have access to transportation in a way that they do not today. Similarly, when we do not have to think about cars being parked all the time, the way we think about our landscape in our cities will change dramatically. Our companies are investing billions of dollars to bring that to the market, sooner rather than later. And our partnering with any companies on this panel, we will make this possible. And as well, working with the Public Sector to enable that. A big part of our work is ensuring that consumers have confidence in the safety and security of those vehicles. And security will become even more prominent in the future. For us, we have long experienced working on Cyber Security security. Whether it is protecting tradeking the cloud or everything in between, increasingly, the norm is redundancy at the software and hardware level, so it is not a latch on later on. That means you can build into a chip set. The encryption protocols to adapt if the encryption is circumvented. We are advancing that work. We have taken a collaborative approach and coming with a framework of standards and best practices, while allowing sufficient flexibility for innovation. There is still work left to be done. And that speaks to the role that congress can play. A number of members of the panel have pointed to the number of efforts and initiatives that are being undertaken in this space. Congress can play an Important Role in bringing order to that cacophony, as mr. Logan identified. Is really a need, and Ranking Member duckworth made this point, for a National Information of thing strategy. There is so much work taking place in this space, but not much of it is well coordinated in a strategy that serves Economic Security and safety interests. Finally, once we look at what is being done and develop a strategy, there is an appropriate place for regulation to deal with market gaps. And we would advocate the approach that has been taken by mist in developing a regulatory framework, is the appropriate approach. Thank you. Thank you, we recognize, waiting patiently, the associate director at the electronic privacy information center. Welcome. Thank you, chairman mica. Ranking member kelly and duckworth, i am the associate director for the electronic privacy information center. We are an independent Nonprofit Research center focused on human rights issues. We thank you for taking time to consider the important privacy implications of the internet of cars. New vehicle technologies offer a variety of new services to american drivers, and are quickly being implemented by american Car Companies. Technologies also raise substantial privacy and security concerns that Congress Needs to address. As cars become more technologically sophisticated, they collect a lot of personal data. Including physical location, destination, Text Messages, and phone records. Most Car Companies and other companies, including google, failed to inform consumers of their Data Collection practices. Few give consumers true control over the data. Auto companies also use personal driving information for various, but they purposes which leaves consumers in the dark over who has access and why . This is often retained for years, if not indefinitely. The very real possibility of remote car hacking poses substantial risk to security. Cars can be taken control of, including breaks, steering, and car locks. They can provide access to the physical location, using built in gps navigation systems. Which can facilitate crimes such as stalking, harassment, and car theft. Congress must enact meaningful safeguards to protect privacy. Last year, a group of 20 automakers, including General Motors and toyota, signed a pledge voluntarily for security. Federal substitute for Data Security regulation. The pledge fails to provide substantial Privacy Protection, lacks any meaningful enforcement, and supports the status quo of the wholesale collection of sensitive driver data. To protect the privacy and security of american drivers, congress will need to do more. First, congress should act on pending legislation. 2015 should establish federal standards for connected cars, in consultation with the ftc, to develop privacy regulations for driver data. It provides a good framework for meaningful safeguards. There is also the house draft bill that would require Car Companies to develop modest privacy policies for the collection of driver information. The house draft falls short of providing robust Privacy Protection. It would not require manufacturers to actually develop or even implement privacyprotecting measures. Instead, the company could only inform drivers about whether the company chooses to take various privacyprotecting measures. Scrutiny forizes developing the policy. The draft would broadly criminalize vehicle hacking, including for research purposes. The senate bill comes much closer to safeguarding the interest than the house draft. Oppose, we would i the house draft, which would be a step backwards for americans concerned about privacy and security. Second, congress should hackingh fines for connected cars, but only when there is malicious intent. This will prevent research to discover vulnerabilities. Third, congress should Grant Authority to issue privacy rules. The spy car act of 2015, with civil fines for offenders, provides a type of privacy and security safeguards that drivers need. As Congress Moves forward, it is hasical that this Agency Rulemaking authority. This rule should incorporate Consumer Privacy bill of rights. Which is a sensible, comprehensive framework for Privacy Protections that provide some standards and would help establish fairness and accountability for the collection and use of driver information. Every day, without car privacy and protection, it places countless drivers at risk for having their personal information, or worse, their physical safety, at risk. Swiftly. Must act thank you for the opportunity to testify this afternoon. I would be pleased to answer your questions. We will go right into your questions. National Highway Traffic Safety Administration, in 2012, when i helped craft the legislation, i put a section 31 402. Electronic systems performance. It said specifically, not later than two years after an accident, that was july. 2012, the august of secretary shall complete an examination of the need for safety standards, with regard to Electronic Systems and passenger Motor Vehicles. And has a couple of criteria. Upon completion, the secretary should submit a report to the committee. I see i screwed up. I shouldve put the department of transportation in here, too. They dont have one, but we have commerce in the senate. At energy and commerce in the house. Have you completed that report . No, mr. Chairman. That is still under review. What we have done, which is unprecedented, we put the entire Research Program that we developed in consultation with other Government Agencies and the private sector i guess iis not just put these things in the law and we forget them. It shouldve been until july, we give you august until 2014, november . Ok . So we are a bit behind . Agreed. Is there a draft . I tried to get a draft from the committee. They said they did not have one drea thi. This is from either committee. Can you submit joint subcommittees here a draft . I am not sure if i can but we will take tha. Not sure if you can . The work it has been done we want to see it. You can, and you will. You will have it here in 10 days. That is the way we operate here. You did not comply. We do not have any penalties now, do we, if someone hacks a vehicle . That is correct. The law is still favoring the senate side as far as testimony. But we have seen that they can be hacked. That is also correct. . So far, no one with intent has been hacked. But you could probably stop an engine. Or could disable brakes steering, because they have electronic components. With that be a good assumption . I am not technologically competent. That is correct. You would be able to disable that. Congress has enacted, i have then we gaveon us, a lot of money maybe. If i may, to suggest the suggestson of that that nothing is being done, when in fact, much is being done. It is not that nothing is being done. We give certain directives. I was going to get to the question of them working with you all. Whichu did talk to them, sets standards and have pretty good reports back. Participated . Has have you participated with him . Yes, mr. Chairman. We embrace the framework. We adopted that into our both of those federal agencies, or with the private sector, or in a group . We had discussions with both. And you . Yes. Weve all had discussions. Perfectlyactually, accurate, im certainly we are absolutely involved in an ongoing basis. I cannot testify to the involvement. I commend you for coming together as an industry, working and i dont want to imply that nothing has been done. But my job is to give certain directives to agencies. I am not here just to look good. I know i do. [laughter] yes you do, mr. Chairman. My job is to hold their feet to the fire. When you put something into law, some of the newer members will find out around here, i put things into law three or four times and they still do not comply. We wont go there today. We give you a lot of money. We spent about 500 million in taxpayer funds testing the dedicated short range Radio Communication devices. What is it currently doing to address the potential issues with security credential Management Systems . Where are we on that . Jpo funds,nds are joint program office. Is that under you . It is not. It is now part of the office of the secretary. It is under dot . Half 1they have had million. What the department is doing is putting the sort of hardware behind that system. What has been done to date has been a lot of hard work, smart people coming up with design. Now we feel we must build this to see the vulnerabilities and do largescale testing. Do you have any idea where . I am told some of what you have done is actually sliding behind the advances in technology. And how much more money, how much more time will it take . Do you know . Thethink that is why secretary of transportation is putting it out for Public Comment in 2016. So that is not until next year . Months, hein two asked us to accelerate that. Which we have. We spent a lot of money, and we dont see a lot of progress. And when would you have your final report, the report that i requested here . It is in draft, you are going to give us the draft . When will you have that finalized . I can get back to you on the record with that, sir. Within the next 10 days . Absolutely. I want a firm date, and i wanted part of the record. Absolutely. Sorry, i dont mean to be demanding. Circumi understand your frustration sir, i understand your frustration. We expect the agencies to act responsibility. Right now, just my final question. Cars can be hacked with Electronic Systems. We do not have in place either a bility to stop that. I guess that is the simple way to put the. Is that correct . Mr. Chairman, thank you. Gm has invested a lot of time and effort into making it as difficult as possible to hack into cars. As i indicated, we embraced the framework. That is an individual effort. We applaud you for that. But my question is that we really dont have a standard, we dont have the ability to prevent that development . Do we . We have the ability to implement things as a business. General motors cannot be hacked . I cannot say they cannot. But we are making it difficult. You are individual. I am asking if we have a standard. As i know. As ifar we are trying to be proactive. But again, the question was and i applaud each of you. Tell us they are fivestar and all of that. But my question was, is there a standard developed . Is there protection in place, the answer is . We have begun working as an industry to establish but we dont have that in place, mr. Oconnell . There is sort of a difference between hard access and wireless hacking. We have seen the former, people with access to a vehicle then being able to modify certain axis. Ccess. It has happened on isolated cases. I am personally unaware of any wireless hacking. There are no protections or standards . Known that we are aware of none that we are aware of. Congress has not held any agencies to the fire. In theuld just point out written testimony, key examples of computer scientists and other researchers finding ways to wirelessly hacked into vehicles. There is a difference between developing standards and their being laws. Standards being developed around Cyber Security. And there are laws in place that would punish someone. Be it the digital millennium computer act or anything else. The question is, are there laws mandating particular standard . I would argue that mandating a particular standard be the absolute wrong approach. We dont have that. But we still have industrywide standards or protections. Unpacking a host of things we are for today. Mr. Chairman . On the last question, the Industry Group just recently within the last week has developed a set of voluntary industry best practices. We are just looking at. Thatted you to know was out there. Usually, things happen before the hearings. Thank you, mr. Chairman. Thent to speak to sectorspecific sharing Analysis Centers, which are nonprofit member driven organizations formed by Critical Infrastructure owners who share information between government and industry. Not necessarily in the Automobile Industry, but other areas. Can you talk about what mechanisms or organizations have been instituted . And also by the industry, to ensure sure, there is been quite a bit of work. We were at the forefront to encourage it is up and running right now. There are additional steps that are probably necessary. One is clarifying the role it will have interaction with the agency. And how that group will be expanded to other sectors, including suppliers. I would like to speak to the suppliers portion of it. This is something that has come up in my work on the Armed Services committee on military equipment. Cyber security is something of great, Great Potential harm to our military. And one of the things i found out was for military weapons platforms, something as critical as the new fighter jet, there is not complete security of the supplier network. Gentlemen the three from the automobile manufacturers here talk a little bit about what you have done to secure or safeguard or inshore that there is ensure that there is a plan you can trust . I have in my congressional manufacturerip that has been identified as a problematic company that engages significantly in both corporate espionage and in governmental and intelligence espionage, as well. What are you doing i am assuming you dont make your own chips. But what are you doing to make sure your supply network is secure . Thank you, Ranking Member. Invested substantial resources and time into the Cyber Security issue. In fact, we created a global cyberzation to end Security Products and services. Is headed bytion our chief product Cyber Security officer, who reports to the Senior Management of the Corporate Company including the ceo and the board at regular intervals about cyber products and services. That includes our supply chain. And we have requirements that our suppliers must meet. We audit them on those requirements. And we test their products. And we have those products as part of security by design. G, allhe very beginnin the way through to production of those products, those products are tested by both internal and external experts. Phone cyber r cyber vulnerabilities . It is pretty standard. For toyota, Cyber Security is paramount. We also use industrystandard best practices, risk assessments, multilayers. We have Cyber Security teams embedded in our activities, from the day we put pen to paper through development, and even through the operations. One thing i also want to mention invitedwe have also automotive suppliers to participate in that. And so wenging them can share information with them, as well. Mr. Oconnell . A couple of thoughts. Withof them are consistent my colleagues, the general robustness of the system. Tesla, being an Industry Leader in the electric vehicle space, we have a unique concern about the integrity of our operations. Because as a new industry and uniquelyt we are vulnerable. Especially in Software Development, but also on the vehicle side, we have a much higher degree of vertical integration. Many of our Software Systems are t designed from the ground up, rather than relying on outside providers. With respect to our chip technologies, to my knowledge largely, we are sourcing from domestic sources. But we are holy focused wholl y focused on the vulnerabilities, as any Silicon Valley company would be. I always appreciate your questioning and insightfulness. I want to recognize my colleague from the great state of texas for five minutes. Thank you very much, mr. Chairman. I appreciate the opportunity. In my browsing the correct . And i pronouncing that correct . Yes. Tech Companies Like google, making anl are Autonomous Vehicle overall. And Prevention Technology for atshes do not rely on dsrc all. What steps are you taking to support this type of innovation, which is one of the reasons why the u. S. Leads globally in Intelligent Transportation systems . With respect to the Automated Technologies, we could not agree more. We think there is a future for both, both connected and automated. We are pushing hard on both. You see recent examples by the secretary on emergency braking, we just included that technology into our new car assessment program, one of the most visible in terms of consumer information. The other thing we have done is encouraging industry to make that technology standard, slowly meeting trying to get them to a place where it is a standard feature on all vehicle models, without regulation. That is a september announcement that just happened. Likewise, on connected Vehicle Technology, we believe that it is a mandate that is necessary to get the market to go. So, how are we going to tie this in with the proposal to mandate dsrc and all like vehicles . When you require companies to put dsrc on top of their own technologies . Re forcing a standard on folks that may not be ready for are we forcing a standard on folks that they may not be ready for . Approach look at the of the department, it is trying to get it out of the Research Phase and ready to deploy. As for these difficult questions, we certainly believe it is ready to deploy. We believe they are, mentoring e complementary. Tesla, you take a different approach to determining Security Issues. You basically have a bug bounty and employ white hat hackers. Why is that a good thing . How was it working . Sure, our approach is really consistent with sort of Software Development the Silicon Valley approach to hardening software over the course of time. It relies on a system of incentives, whereby we encourage folks to test our system, both professional and informal environments. And we reward them when they added the five vulnerabilities. This is consistent with the incentive system that i think generally works in the human environment. But we find it works very well in most software environments. It is working very well for us, as well. Identify us to rapidly and rectify, and intimate the solutions. U. S. Supported a global standard at 77 gigahertz. We are looking locally at a whole different frequency range, around 50 gigahertz. Is this an example of one hand not talking to the other . Would we not be better off with one International Standard . Im not exactly familiar with that issue. I do know on the radio side of things, we have worked very hard to make sure we have the same standards on both sides of the atlantic, so to speak, so we can have one set of hardware. Mr. Lowenstein, would you like to address that . We fully support the idea of sharing spectrums. Gigahertz band. We think it is important to protect this bandwidth in the u. S. Dsrc provides lifesaving services. Is there a technical reason it would not work at 77 gigahertz, like the rest of the world . Im sorry, i am not a technologist. If i might, it speaks to the point you are making earlier about all the disparate efforts in this area. And why an agency that is focused on standards and Standard Development globally has to be part of this conversation. Ici amount of time. I look forward to a second round of questions. Now, i would like to recognize the Ranking Member of the i. T. Subcommittee. My friend from the great state of illinois, robin kelly. The promise of internet connected vehicles is that they bring greater levels of convenience and safety. But that same connectivity means that these computers on wheels faced the same threats and vulnerabilities as other computers. Mr. Garfield, given the volume compromises of networks, in your estimation, how likely is it that we will see hackers, instead of just researchers, hacking connected cars . Especially in light of the testimony . It is hard to the future. But i think the likelihood israel. And that it is likely. I think the information that mr. Oconnell shared about the approach in the Software Industry on taking an agile adjustch, where we and integrate robustness, so we are not compromised completely, is the proper approach. Is there anything that keeps you up at night, any scenario that concerns you the most . Generally, i sleep quite well. [laughter] but i think part of my worry is that all of the great things we have been talking about will be a dream deferred. Because our policy apparatus will not be as agile as our Software Development to keep up with these shifts. So i get the instinct to act. And we should act. What we are suggesting is that we act in a strategic and coordinated action to make sure that shared interests are achieved. Logan,oconnell, mr. When you think of new features you are going to add to your cars, is there anything not that you would do it on purpose that you would add that could be negatively compromised . As you are getting more connected, i guess . Said, wes we have certainly embrace all of the tenets that mr. Garfield has spoken about. And we incorporate security by design, defense in depth strategies throughout our reviews. And so, from the very beginning of any service or hardware, it begins to go through the design cycle for our automobiles. Cyber security posture, that particular element is being evaluated. , andisk of being assessed appropriate measures are being taken to mitigate that into the lifecycle of the vehicle, itself. Toyota, the safety and trust of our customers is paramount. As i mentioned on the telematics side, we employ the same best practices that have been mentioned here today. We include our Cyber Security experts in the very beginning. They provide feedback to us that we implement. I think as we go forward, we will continue to expand on that. We also look forward to working as an industry to develop best practices we can all employee. You did not ask me, but i sleep well at night, too. [laughter] i know reasons, one, that we are employing within tesla some of the industrys best. Considering privacy issues, the other piece that gives mean peace at night, we are working in context of open innovation. Whereby it is not the integrity of our system is not tesla, butant on looks outside to improve the system and rapidly implement them. Thank you. Your testimony talked about some of the statistics dying on the highway. But mr. Garfield, your testimony references a tremendous economic and societal benefit that could be derived from Autonomous Vehicles. In your opinion, what could congress and the federal government be doing . What more can we do . Thanks for asking. There is certainly important work for congress. There are so many different agencies working on the internet of things. Connected cars are a part of that. Congress can play a great role in bringing clarity on a path forward. And filling gaps where they exist. For example, the representative spoke about the spy act that is going through the house. Trying to bring order to all the work going on. We think that would be quite valuable. Thank you. I yield back. Now, i like to recognize the gentleman from north carolina, mr. Walker, for five minutes. About five or six years in the early 1990s, i worked in the Auto Industry on the retail side. I can look back on those 20 years and see how much paperwork on the dealer side was required then. And how much is required now. The last thing we want is more federal regulations on these men and women who are working hard to provide jobs out in the industry. So i do have a couple of questions, though, to make sure we are headed the right direction. What role, if any, and the internet of cars can be filled by the federal government . I would like to hear your thoughts on that. One of the things we are doing is try to ensure proactive steps from the getgo. It has been mentioned about security by design. We think that is paramount. One of the things we have been doing all along, we saw this coming, that in order to see the vision of the future with automated and connected vehicles, we really have to start focusing on that. We have been pushing and prodding as best we can to get that to happen. In your opinion, do you really need a specific regulator . Or auto specific best actors here . Or is the National Institute voluntarily setting the right approach . Can you address that . It really might be all of that. Right now is kind of a twopronged approach, working with the Auto Industry on a set of best practices. But as a regulatory agency, we have to keep in mind that that is our job. If theres a need, we will do so. Does the federal trade commission currently have jurisdiction under section five two police the privacy policies to police the privacy policies, to the extent they connect personal information from these devices . That is probably more directed at the fcc. But we have been working very closely with the sec on privacy issues. Ok, does the department of transportation or the nhtsa have particular expertise that would warrant them to answer your response to oversee the privacy responses related to the devices . We do have privacy expert. That is one thing we will be referencing an hour rulemaking. We have expertise. Is there a certain timeframe, date, a conference, or meeting you will be addressing this. . Sure, what we will be doing medications, wens we wil will have more on that. Last question, most of the technologies and development are independent of the dsrc. What is the nhtsa doing to enable further adoption, to not hamper the innovation that we are seeing . We are using regulations, where appropriate. It really is an era where we see technology. Knology to g in your testimony, you notice the sensitivity of the information connected by the vehicles. But just to review. Describe what kind of information could be collected . And what entities would be collecting it, other than the manufacturers . Is locationle information, which can reveal an individuals patterns or habits. There is also the collection of credit card information, with certain telematics placements in the car. Individuals can, in the car, speak into their system for a text message that is audio. There is also Text Messages looking at the privacy policies of certain manufacturers. It is an almost endless list. Most of the time, manufacturers do not specify the various thirdparty entities. We know in certain contexts that it is marketers. We know there is an increased market for Insurance Companies to gain additional access. Without sufficiently requirement, Law Enforcement could also gain access. I have just a few questions and seconds left. And what questions are we seeing the most innovation on this right now . Can you go down the line . I yield back after that. Is certainly ae globally competitive part of the industry. The United States leads in terms of the deployment of the advanced technology. But i think this is rapidly changing. And i think the proper policies need to be in place to ensure that this innovation continues in the u. S. Thank you, i agree. We are moving very quickly in the u. S. To adopt these kind of technologies. Although, in countries like japan, technologies of artie been put into place. I wont refer to our unique regional hubris, but i think the most advanced efforts are taking place in the u. S. I like to see us on the leading edge of this. Thank you. You are recognized for five minutes. I want to thank the Ranking Members for the searing. Mr. Oconnell, you can talk area the hubris of the bay as long as you want to. [laughter] i represent that area of the country. I asked that this be entered into the record. Without objection. And maybe toyota and General Motors, the whole issue of independent researchers mr. Oconnell has talked to teslas advocacy. Could you tell me if toyota and General Motors have the same feeling that they will allow for independent researchers to help them to make sure the software is working properly . I say to someone in the context of what has happened, visavis volkswagen. Can you respond as to whether you agree with mr. Oconnell . We generally agree with this approach. We have a specific relationship with certain groups of security researchers and academics. As i said, they perform valuable services for us in terms of testing the Vehicle Software and the systems on the vehicle. To help us design and make them better, so that hacking them is more difficult. We are also public the disclosing that we are looking very hard at security vulnerability programs. Whether or not it is exactly like the one tesla described will be determined. But we should be rolling that out very quickly. We want to know if our software has more abilities. We want to know that, both from folks within the company and outside the company. Mr. Lowenstein . We try to welcome information from socalled white hat hackers. We have regular communications, regular relationships. We attend the same conferences they do. We also do employ thirdparty Cyber Security testing on some of our systems, to ensure that we have all the most uptodate information. And we are patching any vulnerabilities we might find. Thewitching to privacy, privacy principles are exciting to look every buat. Concerns, mrs. Barnes we had very spirited debates for opting out of thirdparty data. The industry lobbied heavily against agree it did not get it. Within the language you have in the privacy agreements you have come up with, and the value you place on it, and the concerns that have been expressed here today as well, can you provide a comprehensive list of all the data currently tracked and store in your vehicles . Can you provide that information, and can you provided to the committee borrowing on the chairmans within aomments couple of weeks . Our relationship with the customer is the most vital thing we have in the company. We respect the privacy of our customers. And we want to protect their information. I will say that before we disclose any information to any third party, we get specific affirmative consent from our customer to do so. Mr. Lowenstein . We also follow a similar process, we want to be very transparent on the data we are collecting, and how we are using it. For instances where locationbased services are used, we asked for affirmative consent of the consumer. Appreciate that, mr. Oconnell . A similar protection is the up and out. People have the option to not share any of their data with us. Wen they do share it, atomize that dead and aggregated as such and not only can you not data but wethe aggregate it as such that you is to thats the intent increase principally safety of the vehicles. Hopefully will hit all of us. That related to other tech Privacy Protections. Normsgeneral, the privacy in the United States are driven by different standards. Also at the heart of the regulation in this area which over time has become more expensive, not just to deal with expectations that are explicitly articulated, but those that are normative. Is our recognize myself here, can you tell me what that is . Dedicated shortrange radio connections. It was an safety messages between devices. This is being developed by the department of transportation . And a whole bunch of agent ultimate soup. Agencies, suppliers, manufacturers. Andere is my concern, dod va spent over half 1 billion electronicet to Health Records to Work Together. This four years they said is really hard, will have to go to separate areas. Now we talk about being in industry where you have so much private sector investment, why are we even thinking about the federal government getting involved and doing this . A standard hasnt developed out of the private sector. The thing is probably going to work a little bit better, do you have some opinion on this . We do. I would like to hear them. I shared it in my testimony consummately are technologies being developed, gncluding advanced lt and 5 that we cant tell which will prove most effective. So we think having the ability for all of those, including dsrc to advance but without a thumb on the scale for the department of transportation. Why do we think that department of transportation should be doing this . Why would this be helpful in the concert of interconnected cars . I appreciate you talking with the safety concerns related inter two interconnected cars. I think there is a misconception about the proposal level. We are writing a proposal to make sure everything is needed to support communication between vehicles. At some point in the future, data comes in that shows there is not the technology that can meet the safety potential i think tesla is doing it. Has even tinkered with this. None of those comments came in. Not one person responded back saying this technology shouldnt be mandated. Makingi think we are that with an open mind. It is just a proposal, the idea that we will get comments and evaluate where we are. The whole notion of going this step is to take it out of the research where it is been for so long. Dearsolutely, i had friends in a recent car accident and that was a fatality. Therethat hit them breaking involved. I think the Technology Tesla is developing, i want to see this as we as possible. My question to you is, is there any barriers that are preventing you from moving faster on deploying the technology . Human i think it is just will, and open communication both between the parties here at the table and with government bodies so that confidences obtained all around. We used the Convenient Power of our separate agencies, and share information. That is what will solve this problem. Can protect more citizens, the survey great thing for all of us. My question to you, this is from you having your hat as the new chair of the auto have you been given any information and brief in an thing of known attackers targeting specifically vehicles, types of vehicles, russian organized crime is that creating focus on getting access to vehicles. Have you seen that kind of information . I am not actively involved in isac myself i cant get that information to you. Awaret about you, are you of getting access to legal information . At this moment, no. One of my concerns is that i did this for a living. On trains and subways. We have to know the threat is. This is why i think this c istion of the auto isa important. The federal government should be sharing as much information as it possibly can with the private sector to protect itself and protect consumers. If you are not getting that, let me know. Office ofint is, the Personnel Management had difficulty protecting the requisite 23 million people. Audacity to not even say my bad when they sent out the letters that said you were compromised. When some of these issues have arose with the Auto Industry that i got a letter pretty quickly talking about how you fix it. There was a responsiveness that i wish the federal government had. Concerned i am always inn we put too much faith federal agencies to protect our information. Where we need to work sureher to make entrepreneurship is allowed to grow. Quicki can make a recommendation for legislation pending for quite some time. It is long overdue, and to be helpful here as well. Would like to recognize my colleague from virginia, mr. Connolly. Welcome to the panel. Maybe, can you tell us the difference between autonomous and assisted vehicles . And common nomenclature, the idea is that an economist vehicle doesnt necessarily will Autonomous Vehicle doesnt necessarily rely on communication. It is truly not connect to another car or communication or to a driver, correct. Assisted by communication or by another driverless also be in that sense . Yes. I represent northern virginia, National Capital mgion as measured by a mobility scorecard now has the nations worst congestion. As measured by these metrics 82 hours stuck in traffic every 35 gallons of gas wasted idling every year, and at least me every year. Ti talk of these technologies assist a region like this with arguably the worst congestion . Yes, so first of all of the backtrack a little bit to the chairman questions about, and let me say on behalf of the industry and gm, private industry is investing a substantial amount of money greater or equal to the mother money the government is investing in this technology. View this as, mentoring to the onboard Sensor Technology that are also being used for many of the safety systems. Advantages today of being the only technology we know of that meets all the latency requirements to be able vehicles talk to each other in time to prevent a collision or crash from happening and works for bad weather. Those are the advantages we see to dsrc, if you take all of these collisions, all of these technologies, any time that we can prevent a crash from happening we get the benefits of all the congestion that happens when you have a crash. I conceded that, but that is not my question. I think we have covered safety and i concede that. You talk about im not in control, what if something happens, well 94 of current fatalities are due to human error. Surely we can do better than that. And we can reduce i think significantly seeing better already with advanced driver assistance systems. But how can it work in helping to alleviate and better manage congestion . That was what i was getting at . System,u take the whole certainly as we bring the andastructure into play, traversing was become more aware of what cards are flowing in what direction, they can time themselves to optimize the traffic flow. , beingous vehicles better control than by human operators, will be able to follow each other a little bit more closely. In a safe manner, and therefore make more efficient use of the roadways of the already have instead of having to continually have add lanes to our highway system. I want to give mr. Logan seen loebenstein an opportunity to come in here as well. This is the nations capital, we are not very good at deploying technology currently. In terms of traffic management, not much. I have been involved in local government for a long time. Japan, theyre lightyears years ahead of us in the deployment of technology for managing traffic control. Have technology deployed already for improving traffic flow. If we look at the traffic informationtraffic was provided one way to vehicles here years ago, now they understand they can communicate back and we know realtime when there is traffic and weather is traffic. I think expanding the thennication allows us to improve routing which improve it improves productivity for businessmen to think about delivering goods and services. It has the capability of improving emissions as well. Youtube was a great video that shows 20 cars put on a race track with individual drivers all given a green light to move at a certain time at a areain speed, Human Systems not great as you know. , myastructure is also hard comments are mostly within the context of tesla. Driveralready fielding systems, what we refer to as autopilot. It presumes that the driver is there and at the hands are on the wheel. A lowspeed environment such as congestion, and vehicle can modulate its own position and traffic and keep traffic flowing. It is tempting to think this or technology could be of limited rapidly across the fleet, it is too bad the connectivity doesnt exist across the fleet. At a think youll see it incremented more quickly over time. Just at the end, i think what is hopeful is how rapidly we already are adjusting to new technologies that assist us. On our own where getting on this and finding out what is the better route because of congestion. I can even look at reports coming from what is causing the congestion. S has revolutionized i have to explain to my young staff what a map was. We have become hooked on that already, it is an efficiency. Im confident as we advanced technology at think we will adjust. Like is a mature being here. To recognize the chairman of the full committee. Mr. For being here, this is one of the most exciting part of our economy. This is somewhere where we can lead to world, and can real jobs on peoples lives as long as the federal government doesnt come in and screw it up. We are been prone to do that in the federal government. One of the raging discussions and topics we will have to do in the station in light of the horrific terror attacks in europe and what we have a furtherd here is discussion about encryption. I think one of the Big Questions before our nation is how much security, will we give up in the name of security . It is a difficult question when these he loved ones on television being killed, it is a difficult thing. I want my neighbors and friends to be a safe and protected as they could be people who are wanted to cause them harm. If you could address the whole encryption issue, how does it really work . You really cant create a key for just the good guys. Its either encrypt it, or it is not. Give me your perspective on that. Thanks for the question, i would start by saying that people that i work with are patriots. So they were sickened by what they saw in paris, as everyone else in this room. The context in which we are this conversation speaks the issue. Aboute are talking security and safety, and corruption is an important tool. The conversation is not either or, it is how we advanced security with encryption as a tool and make International Security is protected. I think that are ways to do that. Thatnk a folly is to think creating backdoors or making keys available to just some people is absolution. If you create vulnerabilities, they will be widely exploited. To thet you just give it guy the genius bar, and your wife, and call it a day . Explain come to the person not as familiar with this how this works. Challenge to the person just giving in to the person of the genius bar bars the same challenge we are talking about with 90 of traffic accidents. Person entrusting one who may be vulnerable to being compromised with the security for everyone. That is the problem with empowering the guy or gal at the genius bar. You are creating a vulnerability that could be widely exploited. The city when of 20 addresses of the panel here . Probably not. It is an issue of philosophy right . None of us has a new group was a tory i think open systems are ultimately the best systems to innovate and to protect. It is a dynamic process, but it hopee where i guess you either in the inherent goodness of man or the inherent badness of man. I prefer to vote for the former. I think that it is the minority that are malignant. And a truly open system where innovation is encouraged, where there is sufficient penalties for malignant behavior, you will see a net positive benefit over time. I think, as members on this this, 99 of with our population that does deal with things in a safe and secure way are good, honest, decent people. I think the bigger obligations to protect them as best we can. Certainly, there can be carveouts for Law Enforcement need to fear probable cause. Type ofave a terrorist activity going on, of course there are things whether geolocation or other types of things they should be able to tap into. If you are a suspicionless american, someone leading a good, decent, honest life, i think you have an expectation of privacy in this nation. That will certainly come into wit cars, butc with the internet of things. This will be one of the big question to be all have to deal with. Issueswe approach these has to be grounded in something. What they need to be grounded in its our values. Thatof our values here is we act consistent with laws. There are certainly legal frameworks for gaining access to that information. Lawill work with enforcement to ensure our National Security is protected. At the same time, there is a fundamental belief that peoples rights will be protected as well. We have figured out how to strike that balance, and will continue to do so. That is partly why we are viewed the way we are around the world. May i just onto that, and other way in which to ensure growth both privacy and security escorted that into the cars. More privacy protected would be enhancing techniques which are minimize or eliminate the need to collect personally identifiable information. So that when there is a report of a malicious hack, those that need information are only getting the absent of absolute necessary information about moving the personally identifiable information. It is not important what she was speaking inside the car, where she was going. I do hope members are able to look at the geolocation legislation that we have here that you would need a warrant or trackion certainly to some of geolocation. I do think that is the content of their life. Two other members have questions . I would like to take up a little bit where the chairman left off. Thatutomakers testified they are very careful with the information that they collect. Reading your written testimony, im not sure that you would agree with that. There is a lot of information that is tracked. I havent turned up geolocation on my phone, this is my veterans day map. Was, i canerywhere i slide over and it tells me i got into the houston airport and was there for 32 minutes at 4 00 in the morning. Shower, ie and took a lexington, iss welcomed some bicycle riders. I then went to applebees degree some betterments. It notes everywhere veterans. It knows everywhere i went. This is turned on by default in almost every persons phone. I would imagine the cars collected the same information. Unless i am aggressive about turning it off, or telling them a dont want it shared with Marketing Partners i will is in the pop up saying you are near a water burger, why dont you stop . Informationot of that is out there. Do you want to comment on that . Always advocate for stopping at water burger, but repeatedly fails consumers. This idea that there is such an information asymmetry that auto manufacturers and thirdparty services can gobble up all the information. And that the consumer isnt he unaware. When were looking at the privacy pledge, the consumer doesnt have any type of choice. Enough for theot consumer, that is why we need some kind of standard. Where the consumer love guaranteed Privacy Protections. Should not be on the consumer to turn off her Location Information at every single subset. When you look in the cars buy act, there was a provision that would allow the individual to turn off Data Collection should she choose, but still retain the functionality. How easy is it we can talk about hackers, ballistic about the government. How easy is it for the google, orto contact tesla, toyota, and say i want information for xyz person. Do they need a warrant . What do they need . It would depend exactly what type of personal data it is. Some of it may be protected under statutory provisions. But, in the absence of full on protection for all of the types of information that is collected not only by auto manufacturers but thirdparty services, that is why there needs to be it could eventually be subpoenaed by private parties as well. Easily. Insurance companies, marketers, that is some provisions to prevent marketers and getting it as well. Do many requests they they get a year . Number,ot aware of the but we have a longstanding policy whenever we get requests we require either a court order or a warrant. We have that same policy. We will not give away any customers private information unless there is due process of law. Thank you very much. We talk about encryption, and all the technology in the cars and the computers. We look at we also created a system where we are now making it difficult for us to repair our own cars, to modify our own cars. The industry of being able to kill the industry for our car because it is all automated for the gps system. Recently a case for john deer tractor with a could let them fix it same copyright on the security and the anti circumcision made it illegal for the to fix it without going to a john deere dealer. We see the death of the corner garage. Whether it is bigger tires to jack up your pickup truck or do things to enhance performance the example you gave is a great example of regulatory processes working. Every three years the Copyright Office has to evaluate the dmca to enjoy the good faith resources can be advanced. Recently, the Copyright Office said that as a part of doing goodfaith research you can do so on a car. And get beyond the encryption systems. It is a great example of an agile system working effectively. My concern is you never really on your vehicle because there is so much software involved. You made the Licensing Software that could become a brick that if you tried to modify it or transfer it. We cant have it always. We cant say we want connected cars, and be secure and safe while the same time saying we want everyone to be able to get into that and be able to stop it while it is moving. Think he is saying we want open sourced software so we can see what is coping in and in control. Wheres the line . To be clear, i did necessarily advocate for open source software. I do advocate for an open system of improving software. That is an important differentiator. The last, that there are models that posit people dont even want to own their car anymore. This may no longer be a problem which opens up the possibility that there are others. I appreciate your comments on that and yield back. And the other questions . In closing, im sitting here thinking my wife is a pretty ofrt lady, and she does all the computer work at the house. Onng the bills, everything, a sunday afternoon she is on the computer. She gets a call for Microsoft Service center. They ask for some information. She reluctantly kind of gave it to them. The next thing we know her. Omputer is locked it is an extortion attempt. I found out they were pakistanis , im a member of congress. We have a whole communications network, with the Capitol Police and access to the fbi. Basically, they told me that you are screwed. And it was extortion. I can see extortion to you can , this showsar happen with our little home computer. It was interesting, we bought some of the software. She found of the Software Company that they keep another locked protection behind that. Release actually can the system. Think weget toyou to have incredible capabilities. I was in a General Motors car, device i just spoke at gonzaga high school. I told all those teenagers what is coming. They were aghast. The things you can do are unbelievable. Our biggest i was paying attention to the paris terrorist threat. Those kids get in a car, and that is the biggest cause of death for our teenagers. Fromve gotten deaths 4333,000, a huge percentage of those our kids. The devices i saw was pretty astounding. How you can control that. The question more than the comment is private sector has come up with some incredible innovations. Standards andg trying to protect the owner and the consumer. You have a Good Association bring together, trying to folks together. Im anxious to see your report. I get to said it was just turned over. , likeope of government the chairman said, we usually over legislate and over regulate. Trying to get it right, you want to also protect rights. I hammered on dot because i it is now three years ago i said lets see where we are going with this. I tried to set a schedule. That hasnt been adhered to. Bitter frustration in that. It is complicated. They need to work with you. The towns like, for the most part, they are. We dont want them to come out requirements, or mandates that are obsolete. By the time we enact them, sometimes they are an overreach. That is a challenge we face. In closing, and the quick guidance on how to proceed . I want to hear from the private sector. I know we are going down a certain path. What do think the proper role of standards, i the tried to get a biometric standard after 9 11, that was three times i put in law biometric standard. I think we may be there it is 12 years later. Theyre very difficult to nail down. Changing technology, you have to try this. It is like trying to change the wheels on a vehicle that is moving down the highway. Tell me, how you would like to see this unfold . The three guys representing the companies that actually produce vehicles. Thank you, mr. Chairman. With all due respect, our industry cant afford to wait for government. We are not doing that. We are investing a substantial amount of resources and energy into innovating. Will make our products safer, and make them more enjoyable. Again, i have to nail you down. What is the proper role of government . Regulation, law, i think our industry has shown time and again that we can, and do work well together. I think the Industry Needs the freedom to innovate, and to do that work. Who in government would you at should we leave it dot . How should it be structured . For the federal level, we work well with them and have proven we can do that. Think in this space, obviously the federal trade commission is active in this space. We have begun to work with them as well. We will work with whatever Agencies Congress decides are the ones that need to be involved in this. If i could interject, after i hear from others. I didnt really get a real handle we havent even really talked about the ftc. Let me hear your take. First of all, we appreciate the work that has taken place between the Auto Industry and its a so far. It is a 15 year long road to get to where we are. We think really Good Technology that is ready to go. Once we get this spectrum Mission Close i think we can move forward with that. Dsrc promises a safety alive. We look to be missed framework and think that it is a good agency for us to partner with. As an industry, to create the same types of best practices and self Guiding Principles be of already done in terms of the privacy and security. Anothere level, and level. Principle, issues of it is all about incentives. No one could be more interested in our own survival, especially as a small, Young Company that we are. Putting the right incentives in place is key. Whatever we do, whatever agency it resides in, we need to foster innovation and share it. But in the proper incentives in place to innovate, and to share. Of how thisive case could proceed was advanced emergency braking. Rather than resisting the impulse to regulate, they foster the development of the technology. Then encouraged the deployment of that technology and did so as far as i know without the benefit of any sort of regulatory knowledge. The hazard with standards is in a long process you move towards lowest common denominator. That is to be encouraged in some cases, but the standardsetting process but not wholly appropriate in innovative arenas like this. To the agencies, i dont have any particular point of view. The only thing i would adds one of the real challenges here is that these are crosscutting impact multiple agencies. One way that congress can certainly help is bringing order to that for making sure there is greater coordination among all the agencies. It is not to suggest anything the cut out, but congress can play a Critical Role in making departmentc, and the of commerce are working with each other to achieve the things we all have in mind. Again, you did a very good agendaing us your recommendations. Thank you on the privacy side. Thank you for participating. I look forward to hearing back and seeing some of your plans. Do is leave like to the record open for ten days. We may have additional questions, others we didnt even get to. Without objection, that is so ordered. Again, im looking forward to having a report on the other items we requested today. You, each of you, very interesting. And we made10 years such incredible progress. Thing ato do the right this important juncture. That is bringing out these issues. Need to go is important. If there be no further business , we wille subcommittee adjourn. Thank you. Cspan has your best access to congress in 2016. The house and senate will reconvene on january 4. On tuesday, january 5 the houses back from legislative work. On monday, january 11 Senate Returns it to 2 00 p. M. Live coverage on tv and radio. Republican congressman mark walker is a newcomer to politics. He talks about the 2014 campaign in which he defeated a number of wellfunded betterknown opponents. You represent north carolinas sixth the district. A baptist minister and a former republican congressman mark walker is a newcomer to politics. He talks about the 2014 campaign in which he defeated a number of wellfunded betterknown opponents. You represent north carolinas sixth the district. A baptist minister and a former car dealer