Thank you so much, Chair and committee members.
I appreciate the opportunity to appear again to talk about this issue.
I want to begin with a simple truth. The issues I'm going to speak to are not about Chinese vehicles only, and they are not limited to electric vehicles. I'm going to focus on the issues around connectivity. I've provided images to help you understand what I mean. Unfortunately, I can't share them by screen, but the clerk has sent them to your emails.
Exhibit A is a photo that shows the display of the modern software-defined car that comes from Hyundai's user experience lab in Seoul, which I recently visited. Exhibit B shows a modern steering wheel. It's important to note that there is no mechanical link to the front wheels. It's drive-by-wire. Software controls the steering. Exhibit C is the wireless connectivity functionality and secure gateway systems in this computer on wheels. Exhibit D is the fuse box, which is the last, best opportunity to intervene for safety and privacy.
The architecture that I have shown you in those images isn't unique to Hyundai or electric vehicles. It's in almost every new Ford, Toyota and Honda in Canadian driveways. An F-150 is just as much a computer on wheels. So is a Civic, and so on. If someone can connect to them, they can find ways to hack them.
In 2015, security researchers remotely took over a Jeep Cherokee on a highway, with a Wired magazine journalist behind the wheel. They cut the transmission at speed, and later demonstrated control of the steering and brakes when the car was in a parking lot. One vulnerability forced the recall of 1.4 million vehicles.
Little has changed in vehicle cybersecurity over the past decade.
Last year, researchers at Black Hat Asia demonstrated how they compromised a 2020 Nissan Leaf through its Bluetooth connection, pivoted through the internal network and set up persistent remote access over the cellular modem. From there, they controlled the doors, the wipers, the horn, the camera, the in-cabin microphone and the steering wheel, including while the car was in motion. It took Nissan more than 18 months to resolve that.
Earlier this year, a cyber-attack took down a Russian alarm system provider serving multiple car brands. Thousands of drivers could not unlock their cars or start their engines. Some reported engines shutting down while they were driving.
If anyone on the committee believes that the hardware and software designed outside of China are immune to their advanced, state-sponsored hacking teams, the examples I provided show evidence to the contrary. All software can be hacked.
Banning Chinese-branded cars will not stop China's advanced hacking teams. They will redirect their efforts. They will look for holes in every other manufacturer. They will look for holes in the cloud platforms that every automaker now runs, and they will find them.
The risks are not unique to Chinese EVs, and it would be a catastrophic mistake to think they will not hack other cars to achieve the same objectives. China has demonstrated the capability and the audacity to hack into even the most sensitive government systems. They can and will hack connected cars.
Last year, we learned that a Chinese state group called Salt Typhoon lived inside AT&T, Verizon, T-Mobile and at least six other American telecoms undetected for three years. They compromised the very wiretap systems the U.S. government built for itself. Canada's own cyber agency co-signed the public warning. They broke into those same systems again this March.
By the way, China did not invent this playbook. The Snowden disclosures showed that western governments have pressured companies to compromise technology in the interests of their states. If we are going to take this entire issue seriously, we need to take it seriously for every vehicle on Canadian roads, from every jurisdiction.
Now I want to focus on what keeps me up at night. Espionage and privacy are real risks. They are serious, but they are not at the top of my list. Physical safety is. A compromised phone can leak your location or listen to conversations. A compromised car, at 100 kilometres per hour, is a two-tonne weapon.
The pool of people who could wield that weapon is widening. State services are no longer our only concern. Concerns now include a domestic abuser tracking a partner through a vehicle app, a grievance-driven misanthrope egged on by online radicalization groups like “The Com”, and a ransomware crew. Apps and AI tools are lowering the skill floor for exploitation, and Canada does not have a framework to detect, deter or respond effectively to any of this. We are behind, and the risk grows every day—not only from the PRC.
I made recommendations earlier this year to the Standing Committee on Industry and Technology that would help us address these risks.
The first is a physical disconnect requirement. Every connected vehicle sold in Canada should include a clearly identified hardware switch or fuse—a real one, not a software toggle—that can sever cellular and wireless external communications at the owner's discretion. This power-down is the last, best option. No, AI can't override physics.
The second is a connected car bill of rights—