Senate Rural and Regional Affairs and Transport Legislation Committee, , 6:30:04 to 6:43:37
Senators question the regulation of over-the-air software updates and the potential national security and privacy risks associated with data stored by vehicle manufacturers.
Topics: Privacy, National security, Online safety
Speakers: Hon Bridget McKenzie, Melissa Cashman, Anita Langford, Mr. Jim Betts, Senator Paul Scarr, Senator Ross Cadell
Previously, we've raised the role of the ADRs or lack thereof for overtheair updates. Now, the four corners report included expert testimony that overtheair software updates for connected and electric vehicles can change the way vehicles drive, its suspension, its steering, lights, all are software defined. Um, under the current regulatory arrangement, the department approves vehicles as compliant with Australian safety standards prior to approval for registration if overthe-air updates can materially change the safety performance of a vehicle. um what consideration is the department giving to the need to legislate to require such updates be approved by the regulator prior uh to them being authorized for release in cars registered in Australia.
>> So the framework of the act uh the role of the commonwealth finishes at first supply and states and territory regulation frameworks take over uh and they ensure the ongoing standard of the car through the registration process. Uh so states and territories have a framework for authorizing modifications to the vehicles. I couldn't speak to what extent [snorts] that that would mean would um mean a software change that could modify the vehicle, but we could find that information out for you, Senator, I'm sure.
>> Yep. And Senator, if um I could add to that to uh understand [clears throat] the concern, but the ability to do immediate updates to improve safety and improve performance is also something that we wouldn't want held up through our processes. So, uh this one uh connected vehicles have risks which we're working to manage, but they also have a number of safety benefits and benefits for the consumer. With respect,
Miss Langford, I hear connected vehicles have risks that we are seeking to manage and I'm not seeing them being managed at >> So, in what way are we managing them? What way are we managing them?
>> We're working with industry to lift the base, [snorts] which is the uh principle on which all of the Australian design rules go forward. Um as Miss Kashman's already mentioned, uh there are already a number of vehicles coming to market that are compliant. But even without that framework, um cyber security is something that um most businesses are working to improve um alongside our regulatory efforts. And we are very much focused on working with industry which is why uh we are working with them not just at the technical but the leadership level to get to a point where industry feels like they have a reasonable pathway taking into account costs of implementation as well as the risks. So
what I've just heard in evidence is that an overthe-air update which can change fundamental aspects of a connected vehicle whether it improves or otherwise the safety it changes uh how the vehicle drives. I've heard from Miss Kashman that that is a matter for states. It's registered in states um and that everyone's just washed their hands of it. Is there is this a topic that Minister King has put on ministerial council agendas >> with her state colleagues and
>> Not that I'm aware, Senator.
>> Mr. Betts, is this something that given it seems that Commonwealth is happily letting them in, but overthe-air updates to the software is something that apparently is a responsibility of states. Is this something on the agenda for transport ministers?
>> Yes, it is. So, the automated vehicle um safety law has been discussed um by ministers and by senior officials.
>> Automated. >> But what about my PRAO which isn't far from automated uh but is connected?
>> Yeah. So, you
>> or does automated include connected?
>> You've just Well, there is a significant degree of overlap between those two concepts. Um so our focus around automated vehicle safety law is around uh the new obligations that we'll have to apply in a world where increasing levels of automation are built into vehicles so that we don't choke that off but we manage the risks in the way that Miss Amford was describing but um the overtheair stuff is this is not something about electric vehicles u particularly all vehicles have different levels of uh connectivity in them these days and so this is a challenge which is not unique to the um automobile sector either. It's something which is a feature of the internet of things. It's a feature.
>> We're not talking about blenders here, Mr. Betts. We're talking about vehicles traveling on Australian roads with passengers with drivers interacting with pedestrians and each other. Over the air updates, I would suggest go well beyond privacy issues. Is the department or the minister prepared to um provide this committee with confidence that the states are across uh the overtheair regulatory environment to ensure that vehicles are safe to drive?
>> Can I ask Senator what when you say overtheair software updates what kinds of changes are you thinking there? What are you
concerned? Well, there are standard software updates that occur that can change connected vehicles behavior and functioning. Now, we heard Miss Langford saying that's there obviously safety improvements in many, many, many, many cases, but we don't know. And what I heard from your evidence was that once the car's registered, you hand that vehicle essentially over to state governments to um regulate it and manage it out in the wild. Um my question then is what comfort do we have that states are able to manage those changes? Do do their regulatory systems um provide us with a level of comfort that uh these upgrades are being managed in a way that secures not just the safety of the vehicle physically >> but the um cyber security issues. So the
the a fundamental element of that inservice regulation that I mentioned is that the vehicle should continue to comply with the Australian design rules or the standards that applied to the vehicle at the time it was supplied at the first time. Otherwise approval is required from the state or territory. Now traditionally that has been for physical modifications if you want to make the vehicle a stretch limo or if you want to >> um raise the GVM or things like that. So you can do things to the vehicle, but as long as it continues to comply with the Australian design law, then you're still you're still meeting the registration laws.
>> But we don't have an Austral that's the problem in this case, isn't it? That we don't have.
>> But this is what I I was asking about the difference. So we we don't have the standard in place yet for cyber security, but we do have other standards in place for the performance of the vehicle. So if you're talking about software changes that would change the performance of the vehicle, the fundamental aspect is that if the vehicle continues to to comply with the Australian design rules that applied to it at the time, then same with physical changes, it it it wouldn't need further assessment from the state of Terry. But if you're fundamentally changing the operation of the vehicle, so are you if we're talking about changing a vehicle from a regular vehicle into an automated vehicle, are you talking about that type
of thing? But but or even that I can change engine maps. I can change emissions. I can change performance. I can change all sorts of stuff over the Y. That's the sort of stuff that might specifically affect what the vehicle's fit for and whether it meets ADRs.
>> Yeah. Yeah. So if the vehicle if the mean that the vehicle stays within its ADRs, then it's fine.
>> But does a state know how to look at
these? So well so similar to you could change the vehicle the
>> but physically is physically physically software is is not visible.
>> No no no but physically you could also change a vehicle in the backyard. You know they have a process. Yeah people [laughter] could and people have but the law is clear that the vehicle should cont should maintain a compliance with the standard applied
>> but the physical difference is I have to go if it's over 5 years I have to take it and get a pink slip. If it's registered to get a blue slip >> and they are inspected physically, you cannot see code. >> That's right.
>> No, no, you can't see code. So, that's one thing that the UNREG 156 will assist with is that it will um provide a bit more clarity around the software updates that are applying to a vehicle at the time uh as as they go. Like like your phone, you know, when you get an update from your phone, it tells you what the update is going to do. some of the um vehicle manufacturers are already doing that, but we're just not used to seeing it yet. So, people aren't looking for that information. Um but that's what 156 will do. It'll be much clearer on the software updates that happen to a vehicle over its life and what they bring in that upware update. But this
security in so far as if a vehicle doesn't have overthe-air cyber security rigor >> that someone could use the overthe-air capacity to make changes which are detrimental to the safety of the car and the driver. Do
you mean the manufacturer or somebody else the owner
>> or some well whoever it is
>> or someone hacking into it?
>> Correct. >> Yeah. >> So, so how do we protect
>> any they can all be true?
>> Yeah.
>> Currently,
>> but even as an owner,
>> all of these things can happen.
>> for nefarious purposes.
>> Okay. So, the um the first thing I would say about that is that that's directly what the 155 part of it. The first part is to stop unauthorized people, third parties being able to access the vehicle. And as the um that art that that that four corners um permit showed it, it it did work. It was quite hard for the professional hacker to hack into that vehicle when they had physical access to it for 2 weeks. Um so a lot of vehicles already have that standard. Um, and it it is difficult to hack in into vehicles. Now, we don't assess that. It's not mandatory, but they're providing it because it's part of the protection of their brand. If their vehicles could get uh hacked into by anybody on the street, no one's going to buy that vehicle. So, so they are doing it for two purposes. Partly for brand protection, partly because in their home country, they already have to have that system in place. Uh, notwithstanding that, we absolutely want to lift the bottom. We want to make sure everybody has that standard. But that is what that that type of thing people hacking into somebody else's vehicle um is is is what one5 is directly looking to um to
address. But if to to the actual point protecting your brand reputation unless you are you know European brand or you know Japanese brand if you are have been in the market for two seconds >> um that's not your main game and I would argue the urgency of these standards and have been arguing the urgency at these for a long time. So I'll go to another this getting it just is frustrating every time. M is cashman I hope you get a gold star when you get home. I don't understand why Minister King is not concerned about this. Um when a rag gets accepted is it the Commonwealth or the states that will regulate it here in Australia given how our cars are registered by states? Just sorry could
you say
>> so when the UN reggg changes eventually get accepted 155 and 156 who then will have the responsibility will it be the commonwealth or will it be the states who the car being registered with them will be dependent on oversighting its
>> so so both standards require that the manufacturer identify risks to both the cyber security of the vehicle or to software management of the vehicle, identify risks, and put in place mitigators for all of those risks in the design and the manufacturer and the ongoing management of the vehicle. So if a vehicle goes out into um into operation out in on the road and a vulnerability um comes up as happens with our phones and our laptops and everything then their onus is on the manufacturer to make sure that those vulnerabilities are