19. The representative of FIA presented WP.29-179-18 on consumer views on automated/autonomous vehicles emphasising the challenges associated with the cyber security performance of vehicles over their life time. He presented a possible solution to address the challenges. He admitted that the solution proposed was not design neutral. He explained that his purpose was to demonstrate that the challenge could be solved and that at least one solution would exist. He stated that the World Forum was the right place to address this issue. He proposed that WP.29 mandate GRVA to regulate Information Technology (IT) security in automotive products over their life time at the ECE level within the framework of the 1958 Agreement.

20. The representative of the United Kingdom, on behalf of the Co-Chair of the Task Force on Cyber Security and OTA issues, explained that the task force was facing difficulties of legal nature concerning what could be done within the frameworks of the 1958 and 1998 Agreements. He questioned whether, under the 1958 Agreement, manufacturers can be required to undertake to protect vehicles from cyber-attack throughout their lifetime. The representative of OICA supported this statement.

21. The representative of the Russian Federation, Co-Chair of IWG on PTI, supported the views expressed in the presentation. He invited delegates to participate in the work of IWG on PTI to work in the spirit proposed in the presentation.

22. The representative of CITA supported the idea proposed in the presentation. He clarified that the comparison of replacement parts (e.g. brake pads) with IT products did not reflect the complexity related to cyber security. He mentioned that it was certainly possible to draft technical provisions under the 1958 Agreement to address this challenge.

23. The representative of ITU supported the view of CITA. He recalled his previous compromise proposal that regulatory provisions require that manufacturers were responsible and able to address cyber security as long as the communication capability in the vehicle existed. He explained, that in practice, this would mean that manufacturers would have to apply security patches (as it is done in other industries) as long as the vehicle is equipped with a functioning communication capability.

24. The representative of Germany stated that there was no disagreement among WP.29, that cyber security would need to be archived over the life time of a vehicle. He stated that the main point was to find out how to reasonably achieve that goal from the regulatory perspective. He mentioned that his country would certainly be able to regulate this, but that given the international nature of road traffic, internationally harmonized provisions would be needed.

25. The representative of the United Kingdom noted that this issue had already been discussed at GRVA and that the key issue in the discussion was whether there was a legal basis to provide provisions. He invited the secretariat, possibly with the support of the Office of Legal Affairs, to provide guidance on this point for the next session of WP.29.

26. The representative of the United States of America suggested that the Task Force could continue its work and consider developing voluntary guidelines, while legal matters were clarified.

27. The representative of the Republic of Korea informed WP.29 about their plan to issue a national guideline for cyber security in the Republic of Korea. He stated that Korea would release a guideline for cyber security before the end of 2019, based on the activities of the Task Force on Cyber Security and Software Update and the research conducted in the Republic of Korea. He added that they would introduce their guideline in the upcoming Cyber Security and Software Update meeting in Washington, D.C.