Chapter 8 - Towards an Obligation to Secure Connected and Automated Vehicles “by Design”?

Summary

INTRODUCTION

Driving automation is expected to result in a drop of road fatalities “since human error is estimated to play a role in 94 per cent of accidents”. Increased connectivity of vehicles and of the road transport environment is also strongly grounded in the expectation that it will enhance road safety. It is additionally regarded as a prerequisite for automated or autonomous vehicles to drive safely. On the other hand, increased connectivity of vehicles results in cybersecurity sensitivity and increasing risks. The developments of driving autonomy can therein be viewed as an additional layer of sensitivity: “the more a car is capable of doing itself, the larger the potential for damage is if the control of the car is taken over by malicious minds”. Generally, digitization is expected to “change the nature of risk” and especially of road “safety-related risks”. In other words, the emergence of CAM implies, to some extent, a shift of safety risks to cybersecurity sensitivity.

This book chapter focusses on ‘CAM vehicles’, namely on road vehicles in the context of “connected and automated mobility”, after the Communication from the European Commission ‘On the road to automated mobility’. Although the Communication does not lay down a definition of CAM (vehicles), the following features are covered. First, the vehicle grows in connectivity, and especially visà- vis its environment. Second, the vehicle is increasingly automated and even autonomous (“driverless vehicle”). These features are further clarified in the first section.

For the purpose of this book chapter, cybersecurity is defined broadly, following the definition of the International Telecommunication Union (ITU) as “the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user's assets. Organization and user's assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment. Cybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and user's assets against relevant security risks in the cyber environment. The general security objectives comprise the following: availability, integrity, which may include authenticity and non-repudiation, and confidentiality”.