Centre proposes security system for cars in India to stave off cyber threats

India may soon have a uniform cyber security system for passenger cars and commercial vehicles to protect them against cyber threats and breach of data privacy. The Centre has proposed a draft which says that vehicle manufacturers will need to submit applications seeking approval of vehicle type with regard to cyber security. The draft will be notified by the Ministry of Road Transport and Highways (MoRTH) after seeking opinion on public forum. The move comes amid reports of how popular car brands have become data privacy nightmare with all modern gadgets and gizmos packed in vehicles.

In a draft report issued by the ministry, the government has proposed to set up a uniform Cyber Security and Management Systems (CSMS) for certain categories of cars and commercial vehicles to protect their functions from cyber threats. "Based on the discussion in the 66th meeting of Automotive Industry Standards Committee (AISC) held on 14th July, 2023, the Committee agreed to formulate an Automotive Industry Standard (AIS) for approval of vehicles equipped with Cyber Security and Management Systems (CSMS). The purpose of this standard is to establish uniform provisions for CSMS fitted to motor vehicles of categories M and N," the draft report said.

According to the draft report, the cyber security system will protect data privacy of vehicle owners. The report said, “It is also without prejudice to the application of national and regional legislation on privacy and the protection of natural persons with regard to the processing of their personal data." Connected cars, which are gaining more popularity in India, come loaded with technology. They not only mine data from driving, but track in-vehicle entertainment and third-party functions such as satellite radio or maps.

A recent study conducted by California-based Mozilla Foundation showed how connected car can be a data privacy nightmare. The study revealed that a staggering 84 percent of car brands admitted to sharing users' personal data with service providers, data brokers, and other undisclosed businesses. Most of them, 76 percent, said they sold on their customers' data and more than half said they share data with government and law enforcement on request.

Tesla was the worst offender, according to the study, with Nissan coming in second and singled out for seeking some of the "creepiest categories" of data, including sexual activity.