GUARD Act

I 117TH CONGRESS 1ST SESSION H. R. 3262 To require the Secretary of Transportation to submit a report on cybersecurity risks to motor vehicle safety, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 14, 2021 Mr. UPTON introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To require the Secretary of Transportation to submit a re- port on cybersecurity risks to motor vehicle safety, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Guarding against Un- 4 authorized Attacks Related to Driving Act’’ or the 5 ‘‘GUARD Act’’. 6 SEC. 2. CYBERSECURITY RISKS TO MOTOR VEHICLE SAFE- 7 TY STUDY AND REPORT REQUIRED. 8 (a) STUDY REQUIRED.—Not later than 1 year after 9 the date of the enactment of this Act, the Secretary of 10 VerDate Sep 11 2014 04:41 Jun 15, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3262.IH H3262 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3262 IH Transportation, in coordination with any other appro- 1 priate Federal agency, shall conduct a study on the state 2 of cybersecurity regarding motor vehicles. In conducting 3 such study, the Secretary shall— 4 (1) develop a comprehensive list of Federal 5 agencies with jurisdiction over cybersecurity and a 6 brief description of such jurisdiction or expertise of 7 such agencies; 8 (2) identify all interagency activities taking 9 place among Federal agencies related to cybersecu- 10 rity regarding motor vehicles, including working 11 groups or any other relevant coordinated effort; 12 (3) develop a comprehensive list of public-pri- 13 vate partnerships focused on cybersecurity regarding 14 motor vehicles, as well as any industry-based bodies, 15 including international bodies, which have developed, 16 or are developing, mandatory or voluntary standards 17 for cybersecurity and the status of such standards; 18 (4) identify each regulation, guideline, manda- 19 tory standard, voluntary standard, and other policy 20 implemented by each Federal agency identified 21 under this subsection and each guideline, mandatory 22 standard, voluntary standard, and other policy im- 23 plemented by industry-based and recognized inter- 24 national bodies; 25 VerDate Sep 11 2014 04:41 Jun 15, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3262.IH H3262 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3262 IH (5) review the technology, measures, guidelines, 1 or practices used across the motor vehicle industry 2 as of the date of the enactment of this Act to iden- 3 tify, protect, detect, respond to, or recover from 4 cyber security incidents affecting the safety of a 5 motor vehicle, focusing on the most advanced vehicle 6 security solutions such as AI-driven vehicle security 7 software; 8 (6) identify existing cybersecurity resources to 9 assist individuals in maintaining awareness of cyber- 10 security risks associated with motor vehicle safety 11 and mechanisms for alerting a human driver or op- 12 erator regarding cybersecurity vulnerabilities; 13 (7) identify means to protect vehicle occupants 14 from cybersecurity incidents affecting safety that 15 may arise while the motor vehicle is operating; and 16 (8) identify pervasive industry vehicle software 17 security solutions, such as, embedded in at least 150 18 million vehicles and 50 percent of the electric vehicle 19 marketplace at the time of enactment. 20 (b) REPORT REQUIRED.—Not later than 6 months 21 after completion of the study required pursuant to sub- 22 section (a), the Secretary shall submit to the Committee 23 on Energy and Commerce of the House of Representatives 24 VerDate Sep 11 2014 04:41 Jun 15, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3262.IH H3262 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3262 IH and the Committee on Commerce, Science, and Transpor- 1 tation of the Senate a report that contains— 2 (1) the results of the study; 3 (2) recommendations to enable the exchange of 4 information and lessons learned across the industry, 5 and across relevant Federal agencies, regarding cy- 6 bersecurity incidents, threats, and potential 7 vulnerabilities in a timely manner; and 8 (3) recommendations for other measures 9 deemed reasonable, appropriate, and practicable with 10 respect to cybersecurity related to motor vehicle 11 safety. 12 (c) MOTOR VEHICLE DEFINED.—The term ‘‘motor 13 vehicle’’ has the meaning given that term in section 30102 14 of title 49, United States Code. 15 Æ VerDate Sep 11 2014 04:41 Jun 15, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\H3262.IH H3262 kjohnson on DSK79L0C42PROD with BILLS