44. The secretariat reported on the recent adoption by WP.29 of the guideline on cybersecurity and data protection (ECE/TRANS/WP.29/2017/46), submitted by the IWG on Intelligent Transport Systems (ITS) and on its decision to include the guideline as a new annex to the Consolidated Resolution on the Construction of Vehicles (R.E.3.). In this respect, GRSG noted draft Revision 5 of R.E.3 (GRSG-112-18) and endorsed it.

85. The representative of the United Kingdom, Co-Chair of the IWG on Intelligent Transport Systems (ITS) presented to the World Forum for consideration the proposal titled “Guideline on cyber security and data protection” (ECE/TRANS/WP.29/2017/46), for amendment to the Consolidated Resolution on the Construction of Vehicles (R.E.3).

86. WP.29 adopted ECE/TRANS/WP.29/2017/46 without objections or abstentions and requested the secretariat to remove the word draft from the title and to include it as an annex in the R.E.3.

18. The expert from Japan, Co-Chair of the Task Force on Cyber Security and Over-the-Air Software Updates presented GRVA-02-03, containing a status report of the group’s activities since the previous GRVA session and introducing ECE/TRANS/WP.29/GRVA/2019/2. He mentioned that the group responded in writing to all the questions and comments received on the proposal.

19. The expert from FIA welcomed the proposal produced by the group but mentioned that it did not reflect their position regarding life time requirements.

20. The expert from OICA wondered whether such aspect raised by FIA would belong to the scope of the 1958 Agreement. The secretariat answered that some precedents could help answering this question e.g. UN Regulation No. 49 (including conformity of in-service vehicles/engines provisions), UN Regulation No. 59 (Replacement (retrofit) silencing systems), UN Regulation No. 83 (including durability requirements and “in use” requirements), UN Regulation No. 90 (Replacement braking parts) and UN Regulation No. 133 (Recyclability of motor vehicles). He stated that he was not aware of any provision of the Agreement that would limit the activities under this Agreement only to the performance of new vehicles. The expert from OICA, Secretary of the Task Force agreed to submit in written an informal document highlighting the difficulty faced by the group with this aspect. He presented, on the last day of the second GRVA session, GRVA-02-46 that described the issue of post-production, understood as the product lifetime starting after the production is definitely discontinued.

21. The expert from Germany and the Netherlands stated that the document should address the three following phases: system/vehicle development, production and post-production.

22. The expert from Japan supported the proposal ECE/TRANS/WP.29/GRVA/2019/2 and stated the need to adopt this document during this session, since the new UN Regulation proposed in the document was one of the important and needed Regulations for the improvement of vehicle safety.

23. The expert from EC provided comments on the proposal (GRVA-02-37).

24. The expert from IMMA presented GRVA-02-18, proposing to exclude vehicles of category L from the scope of the document.

25. The expert from Japan, Co-Chair of the Task Force, responding to the advice received from the previous session of GRVA, reported on its proposal for a test phase to assure the draft produced. He presented the aim and the desired output of this activity.

26. GRVA agreed to keep the documents under this agenda item for continued review at next GRVA session. GRVA invited the Task Force to address the comments received and to proceed with the test phase. GRVA noted the need to make further progress on this item and requested the secretariat to explore the possibility to organize a special session of GRVA in May or June 2019.

24. The expert from the United Kingdom, Co-Chair of the Task Force on Cyber Security and Over-The-Air software updates (TF CS/OTA) reported (GRVA-03-02) on the work of the group (recommendations, a draft regulatory text with provisions for the approval of a manufacturer Cyber Security Management System and provisions for the approval of a vehicle with regards to cyber security), including the ongoing testing activities. He clarified that the outcome of the work did not aim at specifying technical solutions, preventing all kind of cyber security events to happen, securing systems outside of the vehicles (e.g. pendrives), specifying durability requirements, listing all risks and corresponding mitigation solutions, but rather a systems-based approach to security management.

25. He explained that the current testing phase was aimed at checking the robustness of the proposal. He noted that manufacturer involvement represented seventy per cent of the global sales. The expert from AVERE confirmed that North American manufacturers were involved in the testing phase. The output could result in the production of interpretation guidelines if necessary.

26. He answered to the questions raised by the GRVA experts. He confirmed that the work was involving Contracting Parties using the regime of self-certification, but that no Country had indicated their intention to become a sponsor in the sense of the 1998 Agreement.

27. The expert from the European Commission requested clarifications about the purpose of the non-regulatory text in ECE/TRANS/WP.29/GRVA/2019/2. He noted the importance to define pass/fail criteria (also for audits) in the context of mutual recognition of type approvals. He expressed the need to consider covering hardware updated in this context. He stated that cyber security impacts privacy protection and mentioned other regulations in other jurisdictions that could complement or impact the ongoing work, such as the European General Data Protection Regulation (GDPR).

28. The expert from France proposed to revisit the definition of a type in the regulatory draft. He proposed to consider the vehicle architecture as one discriminatory feature.

29. The expert from Germany expressed support to the test phase work and expressed the need to consider lifetime provisions.

30. The expert from CLEPA explained that their industry would have a role to play to support cyber security and asked that GRVA consider provisions that would address their role.

31. The expert from Sweden noted the proposal on slide 16 of GRVA-03-02 “UNECE may decide to develop a harmonized framework on [the post production and vehicle support by the manufacturer] topic” and proposed to reflect on this point.

32. The expert from Spain expressed concern with the lack of guarantee over the whole life cycle and proposed to look at practices of other industry sectors to explore best practices. She also noted that these activities were linked with the activities of existing cyber security authorities and that frameworks were already existing. She stated that the outcome of the test phase should result into amendments instead of interpretation documents.

33. The expert from ITU stated that basic requirements should be built in the communication side and that support provisions could be linked to the life of the communication system (He mentioned as an example the Global System for Mobile Communications (GSM) protocol shutdown).

34. The expert from FIGIEFA introduced GRVA-03-16 proposing amendments to ECE/TRAN/WP29/GRVA/2019/2. She mentioned the importance for the after sales sector to take into consideration their needs when drafting provisions. She proposed that Approval Authorities should, as neutral entities, determine independently from manufacturers the companies that are authorized parties. She proposed that the Regulation specifies that the manufacturers shall share with authorized parties: data, function calls and resources inside of the vehicle to allow third parties to provide services to maintain safety and security of vehicles during their lifetime. She also proposed to replace throughout the proposal “life cycle” by “life time”.

35. The expert from the United Kingdom, Co-Chair of the Task Force, explained that the Contracting Parties were able to nominate Approval Authorities according to their competencies (1958 Agreement, Article 2, para.2). He explained that the group did not reach consensus on the post production and support duration issue and that in that case existing national regulations would apply. He confirmed that the work of the group did not conflict with other regulations such as the European GDPR. He also confirmed that the group did not discuss in detail the level of access required in GRVA-03-16.

36. The expert from France stated that the Regulation should not freeze the market for repair and maintenance. But he also expressed concerns with safety and cyber security risks posed by automotive product modification and access as proposed in GRVA-03-16. The expert from Sweden also expressed interest to the position expressed in the document and agreed with France on the need for the right balance between access and security.

37. The expert from OICA stated that the access right matter is not a cyber security one. He added that such provisions clarifying access to data for the purpose of balanced market would be relevant for a Regulation dealing with access right issues.