Israel's New Car Cyber Guidelines Criticized as Insufficient

Israel's Ministry of Transport has released its first set of guidelines for vehicle cybersecurity, developed over two years. However, critics argue the recommendations are "too little, too late" and non-binding, potentially leaving national security vulnerable.

The guidelines focus on logistical cybersecurity for importers and repair shops, offering "recommendations" rather than mandatory rules. This approach stems from a desire to avoid disadvantaging smaller importers who may lack the resources for extensive cybersecurity investments, a move that aligns with the ministry's goal of supporting smaller businesses and curbing the dominance of larger ones.

A significant concern is the lack of focus on the potential national security threat posed by the transfer of sensitive data from smart vehicles to overseas servers. With approximately 350,000 internet-connected cars from China already on Israeli roads, and more being added rapidly, the data collected by these vehicles, including location, audio, and video, could potentially be exploited for intelligence gathering by adversaries, especially given Israel's current security situation.

The document also fails to address data security for private consumers and fleets, unlike recent regulations in the United States. While some targeted efforts by Israeli security agencies have filtered Chinese vehicles from sensitive security fleets, this is described as a limited measure. The article suggests that Israel could adopt a similar approach to China's own stringent regulations, which classify certain vehicle data as "forbidden for export" and restrict data collection near sensitive facilities.

The new guidelines do incorporate European standards for vehicles manufactured after July 2024, which require manufacturers to manage cybersecurity risks during production and remote software updates. However, this leaves a considerable number of existing smart vehicles on Israeli roads unprotected by these standards. A key innovation is the attempt to close gaps in cybersecurity for the import and maintenance chain, recommending measures like real-time monitoring of cyberattacks and network isolation in repair shops.