Senate Foreign Affairs, Defence and Trade Legislation Committee [Part 2], , 2:21:26 to 2:35:50
The Australian Signals Directorate discusses cybersecurity vulnerabilities and data privacy concerns associated with connected electric vehicles.
Topics: Electric vehicles, Privacy, National security
Speakers: Abigail Bradshaw, Speaker 3, Stephanie Crowe, Speaker 1, Hon Murray Watt, Interjection
broadcast. Hello, good back. Hello, hello, hello. Hi DG, how are you?
>> Good evening, Chair. Welcome.
>> Um, I'd like to now welcome Abigail Bradshaw, Director-General of Australian Signals Directorate, and officers of the agency. Good evening, good to see you. Did you have an opening statement by any chance tonight?
>> No, Chair.
>> Okay. Senator Collins, did you have some questions for ASD?
>> Uh, yes, I do. Thank you very much. Um, just sorry, one sec.
>> Yeah, yeah, all right.
Yeah, on the 21st of September, the ABC Four Corners program called Asleep at the Wheel uh, exposed the cybersecurity risk [clears throat] to Australian motorists and to our security more generally. Uh, in relation to connected vehicles. So, with the vehicle camera technology access to content held on drivers' phones and over-the-air data transfers, connected cars, um, as we've seen through that show, is uh, sophisticated surveillance devices on wheels. >> Uh, the program featured a segment where the journalist was driving a new Chinese Xpeng G6 EV, and a person who was identified as an insider within Xpeng was able to remotely connect to the car, view every single system within the vehicle, including speed traveled, turning of the steering wheel, and even position of the seat. And the insider could see exactly where The reporter said this was not a hack, it was a system feature held by the And I'm just wondering, um and perhaps the Minister could help with this, um what regulatory provisions do we have in Australia to protect protect uh vehicle owners from being secretly surveilled remotely by a vehicle manufacturers or wireless surveillance
>> Thanks um for the question, Senator. Um just by way of introduction, ASD is not a regulator or compliance entity. >> Yep. >> Our statutory responsibility relates to giving advice and assistance about cybersecurity um under section 7 of the Intelligence Services Act.
>> Yep.
>> Um we have um acquitted that function in relation to electric vehicles via a number of public advisories. >> [clears throat] >> They include the introduction to connected vehicles first published in June 2025, the Internet of Things devices initially published in September 2020, and then consolidated into a personal cybersecurity handbook in 2026, choosing secure and verifiable technologies in May 2024 and and a variety of other related advisories. In relation to the Four Corners program you're referring to and the interaction of ASD's advisory and assistance function, um I heard colleagues from uh the Department of Infrastructure uh giving early evidence on this topic earlier this week. And and my evidence will be consistent with that, and that is that ASD has engaged uh with those colleagues as the relevant regulator uh to give advice on cybersecurity, and those matters inform, I think, the present position uh of the regulating department, which is to introduce a UN standard which would address some of the um features that you've referred to that were picked up in that reporting. And I'll just ask Ms. Crowe to talk about the relevant standard.
>> Um thank you, Senator. The relevant standard is United Nations Regulation 155 and 156 related to cybersecurity and um also over-the-air updates relevant to the Four Corners um uh program. There are two risks that um are consistent with the advice that ASD has stated publicly already in our advisory from June last year. That is the unauthorized recording um risk, as well as remote access to vehicle functions. In our advisory, we set out advice for individuals concerning both of those risks. We talked about the primary risk being that connected vehicles collect extensive amounts of data due to their connected nature with the infotainment systems, as well as other features in the vehicle. And there are settings that you can undertake to minimize the amount of data that is sent back to the manufacturer, um as well as how you should secure the connected services related to your vehicle. So, for example, the applications that can remotely lock or unlock cars or change settings in the vehicle remotely.
>> So, are you And um Minister, what you might be able to help with this, but are there any protections for I um it's good to have advice, and such a huge part of it is the education piece. Um but uh are there any protections for consumers, for drivers of um connected cars? Are there regulations in place? What do we have?
>> As Ms. Bradshaw mentioned, um the infrastructure and transport department plays that regulatory role.
>> Sorry, I Yeah, I didn't actually hear what you were going
to say about >> I'm aware that they are currently doing some further work in this space. I must admit, I'm not aware of what the current regulations are, but I'm sure there'd be information you can get from that that department.
>> Okay, thank you. Do Do Does ASD receive any reports about any kind of hacking or What do we call it? Like the system override, that sort of thing?
>> Senator, I don't recall receiving any such reports. I'll just check with Miss Clay.
>> No, that's right. We have not received reports of that in Australia.
>> But of course, we are aware of the public reporting and we have engaged with peaks peak bodies that relate to the motor vehicles industry. In fact, we engaged with those bodies as we were drafting the introduction to connected vehicles last year.
>> Okay, so you engage with the car manufacturers? Yeah, okay. So, you're aware of the the various the different systems and
>> aware of the different systems and the very different views amongst the different manufacturers.
>> What What sort of different views?
>> Uh well, there are um different There There is not one cohesive view on issues, for example, such as data management. It It would depend on the
>> Uh has ASD conducted any technical testing or intelligence assessments to verify whether any off-the-shelf connected vehicles can passively harvest useful optical imagery or RF signatures or operational pattern of life data while parked at defense facilities?
>> Um Senator, I'm not going to speak to intelligence assessments in this forum, but that's obviously why we are under the jurisdiction of the PJC. Uh our public advisory is on the basis of our technical understanding of Internet of Things systems.
>> So So, the engagements that you had with the different So, you engaged with every different manufacturer of an EV or connected car.
>> Sorry, Senator. No. Um we have engaged with Ms. Crowe might remind me of her name.
>> Australian Automotive Association.
>> And which one was that, sorry?
>> Australian Automotive Association. AAA.
>> Okay. So, not an actual manufacturer, but a
>> No, a peak body.
>> A peak body. Okay. Was that to understand the different models that were coming through, or I thought you were trying to understand the different systems?
>> That was for the purpose of ensuring that the public advisory which we put out, which we published on cyber.gov.au, um did in fact um pick up those issues, uh not just that we were seeing from a technical perspective, but engaging with the peak to understand it from um from the motor vehicle um association perspective.
>> Okay, so you weren't um I was confused by that. You weren't understanding the different systems and their capabilities. Uh to, you know, get this data and information or control from afar. You're engaging with the peak body and the different views were about like what what sort of views? Can you just go into that a little bit more just so I can understand?
>> Oh, well, there are different views amongst vendors, for example, about data retention, um about that they have their own views about um where data should be um held, about whether there should be um uh for example, uh quite often if you buy a uh vehicle connected vehicle for servicing purposes, you might be tethered to the manufacturer. There are views about whether there should be more freedom in relation to uh movement um amongst the market.
>> Okay. And and what sort of places could data be [clears throat] held? So, you said that they would have different views about where the data could be held, the data retention.
>> Well, it depends on where the vendor is and what the arrangements are for um for the connected vehicle. So, a a vehicle which is being updated um, by the internet, for example, um, might have connectivity to a vehicle and might be being updated from offshore.
>> Okay. Uh, and there's there is no we don't have any, um, protections in place to keep that data onshore. How how much of that data, in your assessment, would be going offshore?
>> I I I'm I'm I'm sorry, Senator. I wouldn't have a view of that.
>> Okay. But we don't make any electric vehicles here in Australia, do we? So, pre So, all the manufacturers would be offshore, so uh, how how much of the were there any car manufacturers that were keeping the data onshore?
>> I I'm I'm sorry, Senator. I think that's really a a question for, um, uh, the relevant, um, department that is setting standards for, um, vehicles.
>> Okay, but you you had the conversations with the triple A triple A with the triple A >> Mhm. >> and you were discussing the views on retention and
>> Yes.
uh, in those discussions did >> [clears throat] >> anybody indicate that they would rather keep it onshore? So, you you you talked about you talked about where you're going to keep it and obviously it's all going offshore. So, just let's talk through that
discussion. >> Well, um, sorry, Senator. What I said was, uh, we talked with the triple A in order to get, uh, a view that was more, um, we wanted to have an informed view from a peak body that was actually associated with, in this case, the vehicle sector.
>> Okay, so it's a con it's a consumers, not the manufacturers.
>> Correct. Well, no, it's it's actually both. Um, we did not, um, in the course of those interactions, um, seek advice on on statistics on the manufacturer or or how much data was here. That that really would be beyond the scope, I think, of ASD's function Um, and also our focus is really on the connectivity rather than the operation of the vehicle.
>> So and the the scope of the discussion was about the connectivity. What what was the scope of the discussion about?
>> The the scope of the discussion was initiated on our end because we we knew that despite the fact that we had a whole bunch of information public facing on internet of things devices and the cybersecurity measures that that we recommend in relation to using those devices that there was a need to now address questions that were being raised around connected vehicles as a new entry at that point or newer entry into the market. And so we engaged with the peak body as we quite often do when we're we are writing advice for a sector. >> Mhm. >> In order to ensure that that our advice was going to hit we're going to meet the market need in terms of a general Australian public who would who would want advice on cybersecurity for connected vehicles.
>> Okay. Did you meet with the federal chamber that represents the manufacturers?
>> I did not.
>> Okay. If you were to give advice have you given advice to the government about I guess I mean it's very difficult for I guess at the stage that it's at to be able to protect consumers cuz looks like we don't really have progress in that. You understand the security risks of these connected vehicles. So have you given any advice to the government about what they can do to better better protect consumers here in Australia?
we have given advice consistent with um the advice that's contained in our public advisory, including those measures that mitigate or address those risks. We have given advices, as I mentioned as and Ms. Crowe mentioned, to the regulator of the relevant sector, and that is the Department of Infrastructure.
>> Okay. And And just to be clear, the advice that you give on connected cars, that's all publicly available?
>> That's right. It's on cyber.gov.au.
>> Okay. Thank you. Just wondering