New driverless car policy encourages security collaborations between rivals

Newly released guidelines​ published by the Department of Transportation, Tuesday, intend to guide the development and deployment of driverless cars. Proper cybersecurity measures remain a central concern for the U.S. government when it comes to autonomous vehicles, experts say. As part of the guidance, the DOT is making an early push to shape the cybersecurity standards of tomorrow that will ultimately protect future vehicles from hackers.

Newly released guidelines published by the Department of Transportation Tuesday intend to guide the growth of driverless cars, with the agency making an early push to shape cybersecurity standards that will ultimately protect future vehicles from hacks. 

In short, the DOT’s latest foray into driverless car policy offers a collage of rough sketch best-practices, which may be applicable to original equipment manufacturers, or OEMs, and automakers, among others. 

“I applaud DOT for taking the first step in documenting its cyber security guidelines; however, over the long haul, despite great defenses, testing, architecture, and policies, the inherent weakness is poorly written software code which cannot be legislated,” said Joseph Saunders, founder and CEO of RunSafe Security,“The burden will remain on the manufacturer to adhere to the best software development principles minimizing attack vectors and vulnerabilities.”

By furthering broadly written recommendations, rather than proposing law, the DOT is facilitating ongoing partnerships that already exist between “car manufacturers, cybersecurity companies and other key stakeholders,” according to Monique Lance, a director at Argus Cyber Security, an Israeli security firm closely monitoring the advancement of related policy. 


Argus Cyber Security is one of the largest and most established firms specializing solely on vehicle cybersecurity. Last year, the Israeli-owned company raised a $26 million Series B funding round from a group of prominent tech investors. Argus Cyber Security works with “car manufacturers, their Tier 1 suppliers and aftermarket connectivity providers.” 

One of the larger themes discussed in the guidance relates to fostering collaboration between multiple stakeholders, despite the fact that auto companies compete for the same market share. 

“Manufacturers should be ready to share event reconstruction data to promote safety throughout the industry … Each industry member should not have to experience the same cyber vulnerabilities in order to learn from them,” DOT explains. 

Research conducted by a variety of organizations predict the mass adoption of driverless vehicles in the U.S. will occur sometime between 2020 and 2030. By 2025, the driverless car market will be valued in excess of $42 billion, according to Boston Consulting Group. An estimated 92 percent of all vehicles sold will carry some semi-autonomous features by 2030, per a separate forecasts by Lux Research.  

Beyond cybersecurity, the guidance lists a series of recommendations that work to widely govern the “collection, use, sharing, retention, and deconstruction” of recorded driver data. Relevant data shared between automakers, for example, must be stripped of personal identification information, or PII, similar to active protection already evident in the Cybersecurity Information Sharing Act.


“Manufacturers and other entities should follow a robust product development process based on a systems-engineering approach to minimize risks to safety, including those due to cybersecurity threats and vulnerabilities,” the guidance reads. “The identification, protection, detection, response, and recovery functions should be used to enable risk management decisions, address risks and threats, and enable quick response to and learning from cybersecurity events.” 

Chris Bing

Written by Chris Bing

Christopher J. Bing is a cybersecurity reporter for CyberScoop. He has written about security, technology and policy for the American City Business Journals, DC Inno, International Policy Digest and The Daily Caller. Chris became interested in journalism as a result of growing up in Venezuela and watching the country shift from a democracy to a dictatorship between 1991 and 2009. Chris is an alumnus of St. Marys College of Maryland, a small liberal arts school based in Southern Maryland. He's a fan of Premier League football, authentic Laotian food and his dog, Sam.

Latest Podcasts