On behalf of the R Street Institute, a free-market think tank headquartered in Washington, D.C that focuses on insurance, technology, and next generation transportation, we respectfully submit these comments in response to the Federal Trade Commission’s (FTC) request for input on the benefits, challenges and potential roles for the government in fostering the advancement of connected vehicles.

Our comments will focus on two of the prompts provided in the request, in particular:

  1. “What self-regulatory standards apply to privacy and security issues relating to connected vehicles?”
  2. “What are the roles of the FTC, NHTSA, and other federal government agencies with regard to the privacy and security issues concerning connected vehicles?”

Introduction

Automated Vehicles (AVs) look to be just on the horizon, along with Connected Vehicles (CVs). These two technologies are interrelated but distinct. Whereas AVs reduce the need for input from human operators, CVs connect to the internet and with other cars on the road to facilitate information sharing. While almost all AVs are ‘connected’, not all CVs are automated. The FTC seeks comments specifically on the role of federal agencies in regulating CVs, but any discussion concerning CVs that does not include their intersection with AVs runs the risk of being both incomplete and quickly out of date. In laying out our comments on the future of CVs, our analysis seeks to address the role of federal agencies and self-regulation within the context of AVs as well.

The single most important statistic that should frame this debate is the number of fatalities suffered per year on American roads. In 2016, for the first time in decades, that number rose to over 40,000 people. What’s more, this figure is increasing. NHTSA reported that in the first half of 2016 there was a 10.6% uptick in the number of fatalities compared to the same period in the previous year. Among the young, vehicle-related fatalities are the nation’s single 4 most profound public health crisis. Yet, because an estimated 94% of accidents are the result of human error, AVs and CVs have the opportunity to dramatically reduce this statistic and save tens of thousands of lives a year.

When considering regulatory action in this space, every policy consideration must be judged by how rapidly it can help us move away from the current baseline of crashes and fatalities and closer to NHTSA’s stated goal of “zero fatalities on our roads.” We share NHTSA’s hope for a future with fewer traffic fatalities. But we also believe that the pace at which we achieve such a goal is hugely significant. If over-regulation slows the deployment of AVs by even 5% we could see an additional 15,000 fatalities over the next 30 years.

Self-regulatory standards and private regulation

As the FTC thinks about a regulatory framework for autonomous and connected vehicles, it should be mindful of the potential for self-regulatory standards and private regulation writ large. When allowed to develop properly, private regulation can be a more effective and flexible tool than traditional prescriptive models of oversight insofar as it uses competition to achieve the same desired consumer-facing outcomes. Because private regulation traditionally develops in the absence of extensive state regulation, there is a real danger that the federal government could cause great harm by moving to establish a rigid regulatory framework, crowding out the development of private regulation.

First, it may be useful to make the distinction between self-regulation, industry-regulatory guidelines, and cross-industry regulation — all of which can be grouped under “private regulation” for the interest of simplicity. Self-regulation is usually defined as practices internal to a company, taken to assure quality and safety across the products or services offered by that company. Industry-regulatory guidelines are the best practices and standards voluntarily agreed upon by companies across an industry. Cross-industry regulation refers to the way adjacent industries like platform or insurance companies enforce their own standards, serve as coordination points, and act as external checks against bad behavior.

Self-regulation:

AV manufacturers have a strong incentive to avoid crashes and insecure data practices. For the countless companies developing this technology, a public relations nightmare lurks behind every disengagement, alleged hack, and vehicle collision (regardless of which party is at fault). Given the high profile of the technology and its development, the media has been vigilant in its coverage of the details of AV development. As the technology gets closer to market, this focus will only intensify. Some consumers may be skeptical of this technology at first glance, and if any single company experiences more high-profile accidents or hacks than the others, the future of their work in the area will be placed at serious risk.

In this way, from a pure public health perspective, in which over 40,000 Americans are killed and countless hundreds of thousands injured each year using conventionally operated vehicles, AV manufacturers may be overly inclined to exercise a preference for delayed deployment to mitigate even small reputational risks. Yet, the sooner AV’s are on the road, the sooner they can begin to push their way up the learning curve, and the sooner they can start saving lives.

Because AV manufacturers have such strong incentives to provide a safe consumer experience, we should expect them to think hard about the best kinds of technologies to accomplish their goals. For instance, when it comes to V2V communication, if DSRC will really provide enormous boosts to safety relative to the price of implementation, there can be little doubt that companies will work to pursue the technology voluntarily. Similarly, since companies are aware of and are planning for the unique challenges and vulnerabilities that AVs and CVs bring from a cybersecurity perspective they are inclined to take steps to limit their exposure to such risks. Google, for example, has consciously opted to minimize the amount of time their AVs spend connected to the internet as a way of minimizing their susceptibility to hackers.

Industry-regulatory guidelines:

It is already the case that cyber-security best practices are capable of being formalized across the industry through groups like the Automotive Information Sharing and Analysis Center (Auto ISAC). The group publishes regular best practices reports compiled from subject matter experts from within their member organizations. Crucially, the members “represent more than 99 percent of light-duty vehicles [manufacturers] on the road in North America.” Functionally the entire field is subject the the private organization’s standards.

Additionally, Auto ISAC serves as a clearinghouse for emerging cyber vulnerabilities. Members all benefit from the identification and neutralization of cyber threats, so they submit susceptibilities they encounter to Auto ISAC, which then pushes out updates as solutions are discovered.

With such a large pool of member organizations, it is apparent that Auto ISAC and other groups like it can serve as a focal point for adopting new security standards across the industry. Crucially, doing so obviates the need for standards to be ensconced in statute or regulation, where rapid-reaction and flexibility are not easily achieved.

Cross-industry regulation:

Transportation network companies (TNCs) like Uber and Lyft have burst onto the scene in recent years. Their platforms have enabled millions of customers across the globe to access cheap, affordable rides by matching consumers who want rides with private drivers who are willing to give them. This model is sometimes called a ‘multi-sided platform’ in economics literature. A similar approach to organizing transportation may be in the offing for AVs, and it has important ramifications for the private regulation of the industry.

Some studies suggest that in large urban areas, most consumers will interact with AVs and CVs primarily through platform companies that manage entire fleets. As today, consumers would summon an AV TNC via mobile application, enter the destination, and ride in the AV until the destination is reached.

The appeal of this model is that a single platform company would be capable of servicing thousands of AV taxis in a city. Due to efficiencies gained through automation, primarily the lack of driver and lower insurance premiums, industry analysts have estimated that an autonomous taxi could cost as little as 35 cents per mile, passing on huge savings to consumers. In fact, on-demand transportation this inexpensive could make 18 car ownership less economically attractive.19 These factors make a powerful case for a future in which AV fleet operators will command a significant portion of the overall market share for AV.

Should such a future come to pass, these fleet operators will have some unique private regulatory capabilities through their function as platform companies. For instance, because platform companies stand as public facing intermediates between manufacturers and consumers, they feel customer pressure on issues like comfort, security, and efficiency more directly than manufacturers do. As a result, fleet operators would be more likely to be responsive to shifting consumer concerns than AV manufacturers. Additionally, because platform companies command significantly more marketshare than any individual purchaser, fleet operators could also enforce minimum levels of security or help standardize particular privacy standards.

While not technically platform companies themselves, an example of this effect can be found in the relationship between food producers and retail stores like Walmart and Costco. Retail stores directly interface with customers and thus have unique local knowledge about the preferences and food safety tolerances of consumers. They utilize this knowledge to enforce minimum requirements on freshness, variety, size, and cleanliness on food producers. Walmart in effect acts as a private regulator on the companies for which they stand as an intermediary.

Note that individuals buying directly from manufacturers also gain from the self-regulatory efficiencies brought into the market by platform companies. The larger the market share of these platform companies, the greater their ability to help set and coordinate safety standards across the industry, and individuals can free ride off the positive externalities that result.

Other third-parties, like insurance companies, are also set to be major players in crafting the industry standards that govern AVs and CVs. Because individuals and fleet operators are still going to be mandated to demonstrate proof of financial responsibility while operating on public roads, those that shoulder the risk associated with the state requirements are going to have the ability to encourage best practices. As they were with other vehicle safety developments, insurance companies may act as powerful coordinators and motivators in developing industry self-regulatory and safety standards.

The combined effect of manufacturers’ pre-existing incentives for safety, the market power brought in by fleet operators as platform companies, and the ability for insurance companies to further incentivize safety and security through lower rates, all lead us to the conclusion that robust mechanisms for constructive private regulation exist in the AV and CV market.

The role for government

Federal agencies should certainly be wary of over-regulating this infant industry, and they should also be cognizant of the fact that powerful self-regulatory standards will emerge and evolve as the industry grows. Nevertheless, the federal government has an important role to play. The AV and CV industries do not fall neatly within the realm of a single regulatory body, so it is important to lay out clear guidelines to ensure that multiple agencies are not competing over jurisdiction. The danger here being, if industry members do not understand the standards they are going to be held to beforehand, regulatory uncertainty will slow investment, decrease experimentation, and reduce the incentive to enter the industry.

The three primary agencies involved in the regulation of AVs and CVs are the FTC, NHTSA, and the FCC. The following sections will attempt to break out the clear dividing lines of responsibility for regulating this emerging industry.

Role of the FTC

The Federal Trade Commission is the nation’s oldest and most experienced privacy and security regulator. They have evolved a framework over time that attempts to balance the protection of consumers’ privacy rights with the reasonable business interests of digital services and advertisers. As such, it should fall to the FTC to ensure that AVs and CVs are united with the existing privacy and data collection frameworks. Additionally, it should be within the purview of the FTC to consider preempting the establishment of anticompetitive licensing arrangements on the municipal level.

Data collection and privacy:

The amount of data created by AVs and CVs will be substantial: Intel estimates that each AV will create over 4 terabytes of data every day. The heaviest flow of data will come from the cameras and LiDAR sensors being used by the AV to interpret the outside world, but metadata about the trip including origin, destination, road conditions, levels of congestion, and passenger data will all be picked up by sensors in the vehicles. There may be so much data created that it would be impractical to store or collect it all for long periods of time. Companies may have to pick and choose which types of data they want to collect and analyze for long and short term use. As an example, it seems unlikely that companies will keep high resolution, 360-degree video of all recorded time spent driving across a fleet of tens of thousands of AVs. The storage costs of such an attempt would quickly grow to be prohibitive at current price levels.

Given this reality, the FTC should largely leave it up to individual companies which parts of this data trove they wish to regularly collect and analyze. The enormous wealth of data created from large scale deployment of AVs and CVs does not have an appropriate analog in a related industry, so it’s difficult to predict beforehand the types of data that will prove to be the most useful. As such, it is important for regulators to recognize that the uses and applications of data in AVs will shift and evolve with time. The FTC should not attempt to impose data restrictions on the types of data collected by AV manufacturers or fleet operators. A more flexible approach, in-line with privacy regulation in other industries would narrowly restrict harmful uses of data by companies when it is clear that the harms outweigh the benefits.

In joint comments on the FAVP from R Street, TechFreedom, and CEI, we pointed out that:

“Businesses, consumers and society generally stand to benefit immensely from both current and as-yet unidentified data flows. Thus, consumers are likely better off on net when the collection of data from them in voluntary transactions remains generally unencumbered; rather than requiring repeated consumer affirmations, the better way to protect consumers is usually to require (i) general disclosure as to what data is being collected that consumers might not expect to be collected, (ii) that users may opt out in certain circumstances, and (iii) that affirmative action by the consumer be required only when the potential harm is great enough to outweigh the benefits.”

As a way of formalizing our suggested framework for the FTC, we built the following taxonomy which covers the spectrum of consent and disclosure issues associated with AVs and CVs.

Crash data:

One area of data collection which may require more direct oversight by the FTC is the collection and storage of data around crashes. This information is currently vital for the rating, underwriting, and claims processes of the nation’s automobile insurers. In the context of AVs, its importance will only grow. AVs have the ability to record and retain detailed collision-related information. With that information, through video evidence from vehicle cameras and LiDAR sensors, insurers may be able to more easily resolve claims and cut-down on costly instances of insurance fraud. There is precedent for the promise offered by AVs in this space. When dashboard mounted cameras and/or other video devices are present, the claim-settlement process is made significantly easier.

Given that proof of financial responsibility is required by law at the state-level, the need for this data is virtually ensconced in law. Moving forward with input from industry, it may be logical for the FTC to make some accommodation for that constructively-mandated data’s collection, storage, and sharing.

Oversight of anti-competitive municipal licensing practices:

The FTC has a long and distinguished history of competition advocacy, and has recently been putting more of a focus on anticompetitive actions taken by local and state level municipalities that act as barriers to competition — specifically in regard to occupational licensing. This new focus is welcome and would be desirable within the context of AVs as well.

As AV and CV technology continues to progress, some believe that it will supplement or outright replace traditional public transportation services in urban areas. Point-to-point, affordable, autonomous taxis may be just as cheap, but more convenient than metro or rail services.

Additionally, as new urban areas are coming on-line, the idea of skipping building these costly services altogether in lieu of subsidizing individual private ridesharing companies like Lyft and Uber has been embraced by some cities.31 As autonomous taxis make this option cheaper, this will only become more a viable and attractive model for local municipalities.

There is a danger then, that cities may seek exclusive licensing or subsidy deals with specific AV fleet operators. The goal in doing so would be to establish preferential treatment reminiscent of monopolistic taxi services. Deals like these would undermine the competitiveness of the AV market and lead to less innovation and higher prices for consumers in the long run.

Cities that would like to subsidize the use of AVs and CVs for the purposes of public transportation should do so in a broad-based manner that doesn’t discriminate against particular companies or transportation models. It is important for the FTC to recognize this potential danger and begin contemplating preemptive action to prevent this scenario. Federal legislation may be necessary to give the agency this type of preemptive authority.

Facilitating industry roundtables to coordinate safety protocols:

One method the FTC can use to actively facilitate the development of industry-regulatory standards is simply bringing them to the table — literally. Organizing roundtables can be a useful way of ensuring that key members of the industry have the connections and opportunities necessary for a robust intra-industry discussion about safety and privacy protocols.

Role of NHTSA

NHTSA, perhaps, has the largest role to play in regulating AVs, but the smallest in regulating CVs. NHTSA’s expertise as an agency is primarily around data collection, analysis, and recall authority, whereas the FTC is geared to handle the privacy and security concerns of CVs. NHTSA may also have a role to play in preempting particular aspects of state and local level regulation like manufacturing requirements and preventing arrangements exclusive to particular municipal jurisdictions.

Statistics and data sharing:

NHTSA has an extensive record of keeping statistics on automobile accidents and trends nationwide. During this transition to AVs and CVs, NHTSA’s role in helping other regulators and the public understand the extent and speed of rollout will be crucial. NHTSA should continue to carefully monitor accident data and report the causes and trends in automobile accidents and fatalities. In particular, it will be important for NHTSA to track the number of miles driven by AVs and CVs and break out the crash and fatality data by model and manufacturer. As AV manufacturers pursue different strategies in achieving SAE-5 levels of automation, understanding the experience of particular models and technologies will be a useful regulatory benchmark, and part of the public discussion.

Recall authority:

One of NHTSA’s strongest tools in the regulation of traditional automobiles is the ability to recall motor vehicles that fail to comply with the Federal Motor Vehicles Safety Standards (FMVSS) requirements. Since Congress granted NHTSA this authority, over 390 million cars, trucks, buses, and motorcycles have been recalled to correct safety defects.33 As we look to manage the transition to AVs and CVs, this recall authority may have to be evaluated in an era where over-the-air software updates will fix the majority of AV defects that arise.

When AVs have traditional physical defects that violate FMVSS in the same way that non-AVs would, (i.e. wheels that crack or break, wiring systems that result in fires, airbags that don’t deploy properly) we would recommend NHTSA enforce recalls in the same manner they employ today. New physical components like LiDAR sensors may also fall into the same category. But the inner-workings of the algorithms and software that govern AVs and CVs may require a different status altogether.

Speedy software updates could be the difference between life and death. After the Tesla autopilot accident in June 2015 that resulted in the first autopilot fatality, engineers quickly began working on a complete overhaul of the autopilot system and pushed out a major update in just a few months. Post-sale software updates are going to be an essential 34 part of fixing problems as soon as they arise, and anything that slows down that process will be a dangerous impediment. It would not then be desirable for NHTSA to play ‘code police’ and attempt to investigate and regulate every post-sale software update that AV manufacturers push out to their fleet as they suggested in their Federal Automated Vehicle Policy published last year. NHTSA should instead focus its efforts on promoting general best practices to guide manufacturer self-certification.

Oversight of state safety-standards:

While cities are more likely to create exclusive agreements with AV fleet providers than states are, there is a separate, but also important, preemption issue in the states as well: safety-standard requirements. Some jurisdictions have proactively crafted regulatory frameworks that obliquely address matters better left to the federal government. These frameworks are of differing quality and, insofar as they deviate from the traditional allocation of authority between state and federal areas of responsibility, risk creating a patchwork of state regulatory approaches.

NHTSA should seek to resolve ambiguity. For instance, while the Federal Automated Vehicle Policy’s guidance lays down sensible distinctions between state and federal authority, it also includes a “model state policy” that suggests states make certain safety standards mandatory, even though the guidance is otherwise non-binding. Addressing this issue is particularly crucial, because state legislatures across the country are unsure whether they should follow the guidance as written since it is unclear whether it will continue to exist at all.

In states that have not passed legislation, lawmakers are considering legislation to create the mandatory standards apparently required by the NHTSA. This would disrupt the balance between activities best left to the states, such as licensing, registration, liability, and insurance, and all safety-standard-related activities, which are best left to the federal government. Clarifying the states’ proper role would go a long way toward addressing many of the problems now popping up in state capitals.

NHTSA’s proper role is as a national regulator of safety standards. We would thus encourage NHTSA to both clarify its existing guidance, via an update to the FAVP, and to assist federal lawmakers as they consider legislation designed to preempt the creation of bespoke state safety requirements.

Role of the FCC

Do not force technical mandates:

The Federal Communications Commission has the smallest role to play, primarily as a facilitator of radio-spectrum, if, and when, the industry needs it. To date, the FCC has been overly aggressive in pushing Dedicated Short Range Communications (DSRC) as a specific technical standard. Yet, the federal government does not have a good track record at maintaining flexible technical standards when compared to industry self-regulation.

Consider, for example, the consistent evolution of cellular standards which have been modified many times over the past 20 years without specific device mandates. Contrast that with the FCC’s mandate for broadcast television standards which have remained mostly stagnant for 60 years.38 On this basis, consumers are better served by the FCC taking a more passive role and allowing a multi-stakeholder, industry-driven model to set the standard.

Provide access to spectrum, but not for free:

Part of the complaint made by the FCC is that it has been providing unpriced access to a set-aside portion of the radio spectrum specifically for the use of DSRC, and they are frustrated it hasn’t been taken advantage of yet by automobile manufacturers. While this is understandable, perhaps it is indicative of the fact that this specific technology isn’t as useful at this present moment as they imagined it would be.

We recommend, as part of a broader effort to price and increase the flexibility of spectrum available to the market, the FCC reclassify this band as exclusively assigned, flexible-use spectrum and auction off licences to the highest bidder. If AV and CV manufacturers believe this technology will be useful for them, they should be willing to pay for it. Most likely, V2V communication will only become viable when we have ‘driverless-car-only lanes’, where AVs can run at much faster speeds and with limited distance between each car. By this time, however, a superior version of DSRC will almost certainly exist, and it may utilize different bands than the DSCR spectrum set-asides that have now lain fallow for nearly two decades. We encourage the FCC to continue allowing flexible usage of DSRC spectrum for AV and CV communications, while also recognizing parallel efforts at 3GPP and elsewhere to standardize AV and CV communications protocols, and allowing the market to dictate which standards are best suited to the future of AVs and CVs.

Conclusion:

AVs are coming quickly and have the potential to save tens of thousands of lives a year while radically reshaping the way we commute. In order to get this life-saving innovation on the roads as quickly as possible, the federal government needs to strike a difficult balance: it must devise rules that give the industry clarity and certainty; avoid overlapping jurisdictions; preempt certain anti-competitive state and local level regulations; and facilitate the growth of private regulation.

Industry groups have the right incentives here, and we should let them take the lead. But every day matters with AVs, and a healthy, balanced regulatory system will help us all reach this brighter future even faster.

Featured Publications