US Lawmakers Ask Incoming Mexican President to Review Chinese Automaker Risks

BYD electric cars for export waiting to be loaded on the "BYD Explorer NO.1", a domestically manufactured vessel intended to export Chinese automobiles, at Yantai port, in eastern China's Shandong province on Jan. 10, 2024. STR/AFP via Getty Images

U.S. lawmakers concerned about the Chinese Communist Party’s (CCP) access to Americans via connected vehicles have asked Mexican president-elect Claudia Sheinbaum to address concerns posed by Chinese automakers with a foothold in Mexico.

In an Oct. 1 letter, Rep. Elissa Slotkin (D-Mich.) and Sen. Sherrod Brown (D-Ohio) led a group of lawmakers asking Sheinbaum to establish a national review of these CCP-linked manufacturers.

All modern vehicles have connectivity features, with hardware and software that allows for internet access and data transmission. Last week, the U.S. Commerce Department proposed a rule aimed at blocking Chinese software and firmware from cars on American roads.

“We believe that this body of data, under the control of the Chinese Communist Party, is a national security threat,” said the letter, also signed by Sens. Gary Peters (D-Mich.), Debbie Stabenow (D-Mich.), and Tammy Baldwin (D-Mich.).

The lawmakers also requested Sheinbaum send a Mexican delegation to the United States for additional talks by early 2025.

Slotkin and Brown have voiced support for rules to block the use of Chinese parts in American cars. Slotkin has introduced two bills that would strengthen the Commerce Department’s proposed rule, creating review processes for Chinese technology and give the Commerce Department authority to limit or ban the sale or import of those cars and technologies. Brown has highlighted the risk of China using Mexico to get around U.S. trade restrictions.

During the Commerce Department’s rulemaking process, carmakers and security experts weighed in on the issue, describing a complex supply chain with parts that may have multiple sources.

The Coalition for Reimagined Mobility, which includes industry executives and private and public sector leaders in technology, wrote in their public comment that while Mexico is the largest auto parts supplier to the United States, China is the second largest supplier for Mexico. China is also the third largest supplier to the United States, and additionally manufactures many parts and technologies that may be used in car parts assembled in and exported from Mexico.

U.S. officials say that with millions of these cars being in use, with lifespans of more than a decade, the national security risk is high. The United States views the CCP as the top cybersecurity threat, as state-sponsored hackers have already stolen great amounts of private information and revealed ongoing cyber campaigns.

Brandon Barry, CEO of Block Harbor Security, which provided a risk briefing to the Commerce Department during the rulemaking process, told The Epoch Times that though there have been no publicly known incidents of cars being hacked by the CCP, connected vehicles inherently have cybersecurity risks.

Officials are concerned the connected vehicles could be used for surveillance. This might include tracking key individuals or law enforcement vehicles, disabling entire fleets, eavesdropping on conversations, or intercepting sensor data, Barry said. Other technology experts said in public comments that some sensor technology is long-ranging and highly sensitive, potentially allowing a compromised vehicle access to data that would provide detailed renderings of sensitive locations like military bases to a foreign adversary.

“Moreover, given the intense global competition in the electric vehicle market, there could be economic motivations to influence which companies or countries emerge as leaders in this space over the next decade,” Barry said. “With numerous suppliers involved in vehicle production, each presents a potential entry point that a foreign adversary could exploit to compromise a vehicle’s security.”

Barry said the best thing the auto industry can do to mitigate risks is to follow proper cybersecurity engineering standards and have an automated and comprehensive risk management platform, including evaluating supply chains.