Thank you so much, Mr. Chair and members of the committee. Thank you for the opportunity to appear today.
When we talk about electric vehicles and cybersecurity, we need to start with a simple truth: The issue here isn't the power plant; it's the connectivity. Whether a vehicle runs on gasoline, diesel or electricity, modern cars are increasingly computers on wheels connected to the Internet. If a vulnerability in a smart phone crashes an app, it's inconvenient. If a vulnerability connected to a car is exploited, it can be deadly.
We have already seen what happens when those computers on wheels are insecure. In 2015 security researchers remotely hacked a Jeep Cherokee while a journalist from Wired was driving it on a Missouri highway. They cut the transmission, leaving the vehicle unable to accelerate while travelling at highway speed. In further testing, they demonstrated the ability to control the steering and disable the brakes. That vulnerability forced the recall of 1.4 million vehicles.
Little has improved since then. Recently, a cyber-attack hit a Russian company that provides Internet-connected vehicle alarm systems used across multiple car brands. The attack knocked the company's infrastructure off-line. Thousands of drivers suddenly could not unlock their cars, start their engines or disable their alarms. Some even reported engines shutting down unexpectedly while driving.
The threat to connected vehicles is not hypothetical. It is not in the past. It is a clear and present danger.
Connected vehicles also collect enormous amounts of sensitive information. They capture precise location data, telemetry about how we drive, and often audio and video recordings from inside and outside the vehicle. A connected car is no longer just transportation; it is also a rolling surveillance platform. China banned Tesla vehicles from its military bases and sensitive political gatherings for good reason.
In the wrong hands, a vulnerable connected car can also be a weapon. That creates real risks—risks from nation-states seeking intelligence; risks from cybercriminals stealing vehicles or exploiting owners; and, increasingly, risks from intimate partner violence, where connected vehicle apps can be used to track victims. Some countries have begun to recognize this risk. Poland, for example, is considering restrictions on Chinese-made connected vehicles entering military bases because of espionage concerns. Those concerns are legitimate. China's national security laws can compel companies to co-operate with intelligence services.
But we should also be honest about history. The Snowden disclosures showed that western governments have also pressured companies to compromise technology in the interests of those states. China did not invent that playbook; they studied it. Governments are not the only concern. Investigations have shown employees at major automakers sharing sensitive images recorded by vehicle cameras. Regulators have also taken action against manufacturers accused of collecting and selling drivers' location and behavioural data.
To be clear, this is a privacy issue. It's also a consumer protection issue. Increasingly, it's also a public safety and national security issue. Connected vehicles are also a risk in Canada's auto theft crisis. Vehicles that rely on wireless connectivity and poorly secured communications become easier for criminals to locate, unlock and steal. The risk doesn't stop with manufacturers. Aftermarket entertainment systems, telematics devices and security systems introduce vulnerabilities as well.
The reality is that we're not going back to a simpler time, one where we don't have Internet-connected features, but there is a way for us to do this in a much safer way. I would like to make four recommendations.
First, every Internet-connected vehicle sold in Canada should include a physical connectivity kill switch, not software, but physical, a clearly identified fuse or hardware switch that allows the owner to disable the vehicle's Internet connection. If a widespread vulnerability emerges, and one day it will, Canadians should be able to disconnect their vehicles immediately.
Second, Canadians deserve a “connected car bill of rights”. Drivers should know how long manufacturers must provide critical security updates. If you paid for the car, you should control the data. Drivers' data should not be sold or shared without meaningful consent. That consent should not be coerced by threatening to disable features in a vehicle someone already owns.
Third, Canadians deserve a strong right to repair. If a manufacturer abandons software support for a vehicle, owners and qualified technicians must be able to maintain and secure those systems themselves. Cars last decades. Connectivity should not expire after a few years.
Finally, security must become a baseline regulatory requirement for connected vehicles sold in Canada, security by design with independent testing and responsible disclosure. We would never allow a car on Canadian roads with known defective brakes. We should not allow cars on Canadian roads with known defective cybersecurity. The Jeep hack was a warning shot. The Russian cyber-attack disrupting connected vehicles shows what happens when those kinds of warnings are ignored.
My question for the committee is easy. Will Canada act now or wait for the first cyber-attack that shuts down cars on Canadian roads?
Thank you, and I look forward to your questions.