Manufacturers given onus to handle automated vehicle security in Australia

Australia is currently developing nationwide laws for automated vehicles, with transport ministers from across the country in November having endorsed the National Transport Committee’s (NTC) “safety assurance approach” for the first supply of automated vehicles.

This approach uses the existing certification framework for vehicles introduced into the Australian market and includes mandatory self-certification by the company bringing the technology to market, and according to the NTC, also forces vehicles to follow a clear set of performance-based safety criteria against which companies must provide evidence.

Facing the House Infrastructure, Transport and Cities Committee on Wednesday and its inquiry into automated mass transit, NTC director of automated vehicles Marcus Burke said this performance-based approach also covers cybersecurity.

The policy approach related to the first supply of vehicles, Burke explained, will allow the appropriate legislative bodies to determine if vehicles are safe before they are allowed into the market in Australia.

“A self-certification approach — one of the criteria was cybersecurity,” Burke told the committee.

“So what that means is that a company looking to bring this technology in will need to demonstrate [to the regulator] that they can manage the cybersecurity risks both upfront and on an ongoing basis, and that they have appropriate processes in place to do that.”

According to Burke, there are no guidelines or prescriptions set around what such cybersecurity processes look like, from an Australian government perspective.

“It’s been left as a performance-based approach,” he explained.  “There’s not prescription around how a company would do that, and the challenge may be different for an automated bus versus an application being used by a private owner of a vehicle, and depending on the technologies that are being used for the specific application.”

NTC acting director Dr Kirsten McKillop said such an approach is being discussed on an international level, as part of the World Forum for Harmonization of Vehicle Regulations (WP.29).

Burke said, however, that while there is some work conducted through the WP.29, nothing has been agreed to, nor is there anything ready for implementation.

With the committee concerned about an autonomous or remotely controlled vehicle being used for illegal activity, Burke said it’s on the NTC’s radar.

“That’s certainly something of concern that has been raised by law enforcement with us, that there would be a risk that these vehicles could be used for criminal purposes or acts of terrorism,” he said.

Where the broader idea of breaking the law is concerned, he also said there’s a heavy focus on determining at what stage the responsibility of the vehicle shifts from the human driver to the system.

“There needs to be one driver at any time and that responsibility needs to be very clear,” Burke said. “The question would be: Has the driving task been handed over to another entity?”

This could involve a black box-like recording device being fitted into every vehicle along the automated spectrum.

The NTC was stood up to develop uniform or nationally consistent regulatory and operational reforms for road, rail, and intermodal transport.

As an independent statutory body, the NTC develops and submits reform recommendations for approval to the Transport and Infrastructure Council, which comprises transport, infrastructure, and planning ministers at the federal, state, and territory levels.

McKillop said that guidelines the NTC scripted in November 2017 around the testing of vehicles are being used by all states and territories currently.

Burke believes the development of laws to enable the safe deployment of automated vehicle-related technology is a prerequisite to Australians gaining the promised benefits. He said that without a legal framework in place, commercial deployments will not occur.

“National consistency is critical,” he added.

RELATED COVERAGE