© chombosan/Shu�erstock.com

*Cybersecurity *Data Privacy *Liability

*Interna�onal Tes�ng Regula�ons

Also:

Motor Carrier Inves�ga�ons

and Client Rights

S����� 2016 V �. 1 N . 1

T����� ����� � C �������

I����� T�� I���…

The Fast Lane: Autonomous Vehicles and

the Liability Landscape________________ 3

Autonomous Vehicles, Hackers, and Cyber-

security: The Legal Principles of Today

Versus the Technology of Tomor-

row_______________________________ 6

Self-Driving Vehicles: Privacy

Issues ____________________________ 9

Recent U.S. and International Regulatory

Developments in the Race to Enable Driver-

less Vehicles ______________________ 12

The Fine Line: Motor Carrier Investigations

& Client Rights _____________________17

T���� !�"�"#!� Q%��"&�'(

Autonomous

Vehicles

101:

Everything You Wanted to Know,

But Were Afraid to Ask

T������������ C�����

C�������� C�-C���

Brigham A. McCown (214) 296-4850

BMcCown@kmlawpllc.com

Jacqueline Glassman (202) 626-9228

jglassman@kslaw.com E#����

Anurag Maheshwary (301) 642-3082

AnuragMaheshwary.Esq@gmail.com

A%����

Christopher Achatz Christopher.Achatz@BryanCave.com

Nick Englund NEnglund@foley.com

Kevin Funkhouser Kevin.Funkhouser@cognizant.com

Anurag Maheshwary AnuragMaheshwary.Esq@gmail.com

Brigham A. McCown

BMcCown@kmlawpllc.com

David Zetoony David.Zetoony@BryanCave.com

The Transporta�on Quarterly is published seasonally

by the An�trust Li�ga�on Commi�ee, Sec�on of Li�-

ga�on, American Bar Associa�on, 321 N. Clark St.,

Chicago, IL 60610. Please direct all inquiries, sugges-

�ons, and submissions to the Editor. The views ex-

pressed are those of the authors, and do not neces-

sarily reflect the posi�on of the American Bar Associa-

�on, the Transporta�on Commi�ee, or the Sec�on of

Administra�ve Law and Regulatory Prac�ce. The

publica�on of ar�cles does not cons�tute an endorse-

ment of opinions or legal conclusions which may be

expressed. © 2016, as to original

MESSAGE FROM THE CO-CHAIRS

Dear Members,

It has been a busy quarter and

we are pleased to present our

revamped commi�ee’s news-

le�er. A special note of thanks to

Anurag Maheshwary for serving

as editor and chief content

herder because let's face it,

tracking down a�orneys isn’t al-

ways easy!

Whether we are discussing

drones, airbags, rail safety, high-

way funding, Uber or autono-

mous vehicles, there is certainly

no shortage of content to dis-

cuss. In order to present topics in

an informa�ve manner, we will

do our best to highlight topics

and subjects of interest to the

commi�ee and to the sec�on as

a whole.

Our current Issue focuses on sur-

face transporta�on, with a ma-

jority of ar�cles dedicated to the

automo�ve industry. Each quar-

ter we will take a look at a spe-

cific industry, but don’t let that

stop you from recommending

topics for us to cover, or be�er

yet, sending content our way!

Transporta�on permeates our

daily lives and is an integral com-

ponent to the quality of life we

enjoy. Innova�ve ideas and dis-

rup�ve technologies promise to

drama�cally alter standard busi-

ness models while o;en outpac-

ing exis�ng laws and regula�ons

governing the industry.

Stay tuned for addi�onal com-

mi�ee offerings including a

brown bag lunches with influenc-

ers, and don’t worry if you don’t

reside in Washington, we’re com-

mi�ed to offering virtual oppor-

tuni�es for program events.

Thanks for being a valued part of

the ABA in a prac�ce area that is

full of both challenges and op-

portuni�es.

Regards,

Brigham & Jackie

B������ A. M�C��� J����� G�������

A utonomous technology in vehicles has the potential to change the landscape of

transportation. From reducing emissions, improving traffic and congestion, providing unprecedented levels of access to transportation (e.g. individuals with disabilities), to dramatically increasing roadway safety, the benefits are many.

For example, in 2014 there were nearly 33,000 fatalities on U.S. roads, of which 94% of were estimated to have been caused by human error or faulty decision-making. Autonomous systems can potentially reduce, if not eliminate, the crashes caused by human error. No surprise that the auto industry and the U.S. Government are making heavy investments in this area, and the rapid advancement is bringing new players into the consumer vehicle market. Software giants like Alphabet (parent company of Google) and IT consulting and systems integrators like Cognizant Technology Solutions are moving into the market.

While these systems are being designed to avoid all accidents, history shows that there is no true perfect engineering (the RMS Titanic comes to mind.). It takes a complex and interconnected system of software, hardware, and component par t s to de l iv er autonomous capabilities. Even with built-in redundancies, hardware will fail, software will have bugs, and the integrators piecing these systems together will make mistakes-let alone when you introduce the most erratic of factors-human unpredictability.

As such, the legal system has been moving at a breakneck pace to address the equally breakneck emergence of autonomous technology . In advance of any clear guidance on how to handle liability concerns, some automakers

haveproposed self-imposed strict liability if their autonomous vehicle crashes. This article will provide a brief overview of the potential liability concerns associated with autonomous vehicles by outlining autonomous technology, detailing some potential legal frameworks, and providing recommendations for advancement.

I. AUTONOMOUS VEHICLE TECHNOLOGY OVERVIEW

First, an understanding of what constitutes "autonomous" in surface transportation is required. Many industry and field-specific definitions exist, but the most widely-used is the N a t i o n a l H i g hw a y T r a f f i c

Safety Administration's (NHTSA) five "Levels" of automation. They range from Level 0 (No automation, to Level 4 (Full Self-Driving Automation). A truly "self-driving" car would fall under Level 4, which allows for the vehicle to function without a human operator: in fact, a true Level 4 autonomous vehicle would completely remove human override of the system.

Most automation technology on the roads today falls within Level 2 (e.g. self-park, lane assist), which combines various automation functionalities into a broader platform. However, advancing levels of automation are being introduced. As an example, the

Tesla autopilot feature falls in Level 2-3 and Google's self-driving fleet are classified as Level 3 or 4 .

While no mass-market Level 4 autonomous vehicles are available currently, it's clear that the industry and other players are making heavy i n v e s tmen t s i n au tonomous transportation. There has been an explosion of new partnerships between traditional automakers non-traditional third parties. As an example, Ford recently announced a partnership with Alphabet and Uber and GM recently partnered with Lyft . The Obama administration further sparked interest with a budget proposal that included a four billion dollar investment over the next ten years, for the development, testing, and overall advancement of autonomous vehicles.

II. LEGAL LANDSCAPE

The rapid advancement of autonomous transportation is forcing the legal landscape to evolve to encompass these novel concepts. In fact, the shift in the very concept of an automobile is generating new legal concerns. For instance, twenty years ago nobody considered pr ivacy laws and cybersecurity issues relevant to personal transportation. Now however, these autonomous vehicles possess computing power that process and generate an enormous amount of sensitive data. For brevity, this article will limit the focus to two potential areas of liability concern for autonomous vehicles. The first the role of the NHSTA in addressing the safety of autonomous vehicles, and the second is products liability applied to autonomous technology.

There has been an explosion of new

partnerships between traditional automak-ers non-traditional

third parties.

THE FAST LANE: AUTONOMOUS VEHICLES

AND THE LIABILITY LANDSCAPE

BY: KEVIN FUNKHOUSER ∗∗∗∗

3 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

A. NHTSA

The National Traffic and Motor Vehicle Safety Act, as amended ("Safety Act"), provides the basis and framework for NHTSA's jurisdiction over motor vehicle equipment defects. Th is inc ludes inves t iga t ions , administrative proceedings, civil penalties, and civil enforcement actions. NHSTA's governance also e x t end s t o t h e componen t manufacturers, to the extent they interact/control the overall safety of the vehicle. NHTSA is charged with reducing deaths, injuries, and economic

losses resulting from motor vehicle crashes and ensuring that vehicles perform in ways that "protect[] the public against unreasonable risk of accidents occurring because of the design, construction, or performance of a motor vehicle, and against unreasonable risk of death or injury in an accident."

Under the Safety Act, a "defect" covers "any defect in performance, construction, a component, or material of a motor vehicle or motor vehicle equipment," including a defect in design. A "commonsense" approach

to safety is used in determining what constitutes a "defect." Thus, a defect "does not require any predicate of a finding identifying engineering, metallurgical, or manufacturing failures." As part of the commonsense approach, the determination relies on the failure rate associated with a component part-which may depend upon the failure rate compare to other similar vehicles. Regardless, to constitute a defect, the failures must be attributable to the motor vehicle or equipment itself, rather than the driver or the road conditions. An important aspect of the "defect" analysis is that it extends far beyond the simple function of the device. As connected vehicles and vehic le- to-veh ic le (V2V) communication expands, cybersecurity is going to be an integral component of the safety of autonomous vehicles.

B. Products Liability

There are three primary defect claims available to plaintiffs in products liability cases: a manufacturing defect claim, a design defect claim, and a warning defect claim (sometimes referred to as an informational defect). With respect to autonomous vehicles, each of the three foregoing claims presents novel issues, but for purposes of brevity this article will focus on manufacturing and defect claims only.

In general, strict liability in tort has been, and currently is, the preferred method for recovery by plaintiffs in manufacturing defect cases. The backbone of manufacturing defect claims is that "while consumers may abstractly comprehend the practical necessity of allowing imperfect production, their actual expectation when purchasing a new product is that its important attributes, including safety, will match those of other similar units." Two different tests are primarily used to apportion liability. The first is a "departure from intended design" test, which functions as the name implies: when a design departs from the original, liability may be imposed. Second is the malfunction doctrine, which is used when

circumstances suggest a product defect, but there may be no direct evidence of one. Such an approach requires a more circumstantial means of demonstrating liability , and a court may allow the inference of a defect if (1) the product malfunctioned, (2) the malfunction occurred during regular and proper use of the product, and (3) the product was not altered or misused in such a way that could cause the malfunction.

When plaintiffs make a design defect claim, they are not asserting that an individual product was defective because it was not built according to the design specifications-as would be the case in a manufacturing defect claim-but that the design as a whole was defective. When deciding design defect claims, courts use two primary tests to determine the defectiveness of a design: (1) the consumer expectations test, and (2) the risk-utility test. The consumer expectations test evaluates the defectiveness of a design based on whether "the danger posed by the design is greater than an ordinary consumer would expect when using the product in an intended or reasonably foreseeable manner." Under the risk-utility test, plaintiffs can succeed in proving a design defect if they demonstrate "the product's design proximately caused [their] injury and the defendant fails to establish, in light of the relevant factors, that, on balance, the benefits of the challenged design outweigh the risk of danger inherent in such design."

Applied to autonomous vehicles, both manufacturing and design defect claims present interesting quandaries. Part of the chal lenge of developing autonomous technology is that driving involves an incredibly complicated set of interconnected processes that are constantly evolving based on environmental changes. Thus, the deve lopment of au tonomous technology is commensurable complex, which can prove challenging under product liability claims. For example, merely identifying a defect in the self-learning technologies and the countless lines of code could be problematic.

Early cases will likely in-volve manufacturers (including those of the

component software, hard-ware, etc.) pushing the

claim that either (i) the ac-cident was the cause of some external factor and was not due to fault in the system, or (ii) that the au-tonomous system was in-appropriately engaged.

4 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

Analysis of a defect claim will likely require analysis of the underlying system as well as the environmental data processed by the system at the time of the accident (if stored). Notwithstanding any substantial privacy issues with this process, not only is the technology itself difficult to sift through but analyzing the environmental data processed by the autonomous system is a monumental task.

Another potential speed bump in defect cases is evaluating the "decisions" made by the autonomous system. Countless articles cite to the potential for harm in so-called "moral" decisions made by the autonomous system. For example, what if a vehicle "decides" to swerve away from a group of pedestrians in the road and hits a tree, injuring the human "driver". Engineers claim the technology will prevent such an event, but given the complexities of driving and the historical lack of perfect engineering, such a scenario is plausible. Did a malfunction occur? Would the system have been better off hitting the pedestrians-to their detriment? This may have saved the lives of several pedestrians (a societal benefit) but injured the human occupant in the process. As a result of the uncertainty associated with conventional claims, many are pushing for standardized regulation and guidance in the sector.

While some companies have pledged to assume liability for errors in the autonomous technology, the solution may not be so simple. For instance, such pledges have come with the caveat that liability will be assumed if the autonomous system (while properly engaged) misreads a street sign or speeds, and causes an accident or injury. However, this does not include act ions of other dr ivers or environmental conditions that cause accidents and likely requires that the autonomous system was appropriately engaged. Thus, early cases will likely involve manufacturers (including those of the component software, hardware, etc.) pushing the claim that either (i) the

accident was the cause of some external factor and was not due to fault in the system, or (ii) that the autonomous system was inappropriately engaged.

III. CONCLUSION

Autonomous vehicles are an incredibly complex set of interconnected systems that "involves electronic systems (such as hardware, software, sensors, global positioning systems (GPS) and vehicle-t o - v e h i c l e ( V 2 V ) s a f e t y communications systems)." Software licensors, technology companies, and hardware manufacturers are all becoming essential partners to the traditional automaker. In addition, as transportation moves into the age of big data, V2V communication, and advanced analytics, new concerns such as privacy and cybersecurity arise. This requires new levels of due diligence on potential systems partners and different levels of platform and product development than what has been present in the automotive industry for many years.

In an effort to safely develop these complex new systems, NHTSA's best

practice guidance on autonomous technology states that automotive manufacturers "should consider developing a simulator, using case scenarios and threat modeling on all systems, sub-systems, and devices, to test for safety risks, including cybersecurity vulnerabilities, at all steps in the manufacturing process for the entire supply chain, to implement an effective risk mitigation plan." In addition to the software and hardware p a r t n e r s , t h e comp l ex and interconnected nature of autonomous vehicles necessitates the need for an experience IT consulting, services, and implementation partner. Companies like Cognizant are moving into the space to apply such past expertise in this emerging market.

Of part icular import to the development of these vehicles will be extensive data gathering and testing. Google's fleet of autonomous vehicles has logged countless miles for the past several years, and can provide a trove of useful data. In addition, Volvo has pledged to find a pilot group of drivers, from all ages and backgrounds, to test and generate data on the development of their new vehicles. Beyond the manufacturer themselves, there will be a large need for third party testing of the vehicles, as evidenced by the University of Michigan's live "testing city" and the build-out of testing facilities and capabilities from the large professional services players like Cognizant .

Regardless of what the future holds for autonomous vehicles, it is clear that they will significantly impact the state of transportation. The legal liability risks will provide the guardrails for the future implementation, and will greatly influence the pace at which the development and widespread implementation of autonomous technology takes place.

* Kevin Funkhouser is Corporate Counsel at Cognizant. He can be reached at Kevin.Funkhouser@cognizant.com. Endnotes are on file with author and will be furnished upon request.

5 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

In addition to the soft-ware and hardware partners, the complex and interconnected

nature of autonomous vehicles necessitates the need for an expe-rience IT consulting, services, and imple-mentation partner. Companies like Cog-nizant are moving into the space to apply

such past expertise in this emerging market.

“T here is no Internet-connected system where you can build a wall that’s

high enough or deep enough to keep a dedicated nation-state adversary or a sophisticated criminal group out of the system.” In April of this year, the Automotive News attributed this quote to the U.S. Assistant Attorney General for National Security, John Carlin, during his keynote speech at the SAE World Congress. Mr. Car-lin’s quote voiced a concern that seems to permeate our increasingly technology-driven lives: nameless and faceless hackers in some base-ment or far away land could co-opt the gadgets and machines that we use in our daily lives to harm us. As our vehicles become increasingly connected, the potential for mischief literally in the streets can be alarm-ing.

Yet, these potential risks must be viewed in light of the great promise of advanced technology in vehicles that could potentially save millions of lives. Forward-collision warning, automatic-emergency braking, lane-keeping assist, vehicle-to-vehicle communication, and fully autono-mous vehicles could drastically de-crease the number of accidents at-tributable to human error, driving down the carnage seen on our high-ways every year. The great equalizer between these competing concerns is cybersecurity.

Modern vehicles can be thought of as a network of computers and in-creasingly that network is becoming connected to the outside world. A useful way to view the vehicle’s net-work is to think of the system as a series of inputs, instructions based on the inputs, and outputs. A simpli-

fied example illustrates this concept. The vehicle receives an input, such as the driver turns the steering wheel to the left. Based on the input, the vehicle’s software, which contains the instructions, commands the vehi-cle to execute a specific output, in this case turn the wheels to the left. The instruction is then executed by the component or system of compo-nents that will turn the wheels. The goal of cybersecurity is to ensure that the vehicle’s inputs, software, and outputs are authentic and not the work of malicious attacks.

As vehicle technology becomes more complex, the number of places in the system where non-authentic inputs, software, or commands may arise increases. Due to the number of vehicle functions that are con-trolled electronically. As the lines of code necessary to support these sys-tems increases, the increase inevita-bly leads to more coding errors (bugs), of which some portion of those errors will create vulnerabilities in the system to malicious attacks. The rise of connected infotainment systems and the emergence of auto-mated vehicle functions increase the lines of codes in vehicles and, conse-

quently, the number of potential vul-nerabilities in the system.

As the opening quote aptly states, vehicles that are connected to the Internet will in all likelihood have vulnerabilities that can be exploited. The question that remains is how should vulnerabilities be treated once they are discovered?

In the United States, the National Highway Traffic Safety Administra-tion’s (NHTSA) jurisdiction covers manufacturers of motor vehicles and motor vehicle equipment. NHTSA’s powers include investigative and en-forcement authority and, if neces-sary, the power to order manufactur-ers to recall defects that present an unreasonable risk to motor vehicle safety (safety-related defects). De-fects are broadly construed to in-clude any defect in design, manufac-ture, or performance. NHTSA evalu-ates potential safety-related defects by determining the number of fail-ures and the safety consequence of the failure. Repeatedly, the Agency has emphasized that it does not nec-essarily need to wait for an injury or fatality to make demonstrate that a defect presents an unreasonable risk to motor vehicle safety.

On April 1, 2016, the National High-way Traffic Safety Administration (NHTSA) published Request for Public Comments on NHTSA En-forcement Guidance Bulletin 2016-2: Safety-Related Defects and Emerg-ing Automotive Technology. 81 Fed. Reg. 18935 (Apr. 1, 2016). The guid-ance informs the automotive indus-try that NHTSA can and will use its traditional investigative powers and processes for safety-related defects to evaluate cybersecurity vulnerabili-ties. Of particular note, the non-

AUTONOMOUS VEHICLES, HACKERS, AND CYBERSECURITY: THE LEGAL

PRINCIPLES OF TODAY VERSUS THE TECHNOLOGY OF TOMORROW

BY: NICK ENGLUND ∗∗∗∗

6 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

Cybersecurity vulner-

abilities are qualita-

tively different than

what can be thought

of as traditional de-

fects in a vehicle.

binding guidance clarified NHTSA’s position that, depending upon soft-ware’s application in the vehicle, software can be considered motor vehicle equipment, including soft-ware on portable devices connected to vehicles, such as phones.

NHTSA further explained that “if a cybersecurity vulnerability in any of a motor vehicle’s entry points (e.g., Wi-Fi, infotainment systems, the ODB-II port) allows remote access to a motor vehicle’s critical safety sys-tems . . ., NHTSA may consider such a vulnerability to be a safety-related defect compelling a recall.” 81 Fed. Reg. 18938. The agency will weigh several factors to determine whether a vulnerability poses an un-reasonable risk to vehicle safety and hence is a safety-related defect com-pelling a recall.

- The amount of time elapsed since the vulnerability was discovered (e.g., less than one day, three months, or more than six months);

- The level of expertise need-ed to exploit the vulnerabil-ity (e.g., whether a layman can exploit the vulnerability or whether it takes experts to do so);

- T h e a c c e s s i b i l i t y o f knowledge of the underlying system (e.g., whether how the system works is public knowledge or whether it is sensitive and restricted);

- The necessary window of opportunity to exploit the vulnerability (e.g., an unlim-ited window or a very nar-row window); and

- The level of equipment needed to exploit the vulner-ability (e.g., standard or highly specialized).

The guidance paints a useful picture of how NHTSA is currently thinking

about these issues. It raises, howev-er, some questions that are not ade-quately addressed in notice. Cyberse-curity vulnerabilities are qualitatively different than what can be thought of as traditional defects in a vehicle. For decades, safety-related defects focused on overcoming two forces that could affect the vehicle and po-tentially result in an unreasonable risk to safety. In non-technical terms, these forces were forces of nature (for example, the structural integrity of parts or the effects of corrosion or vibration) and the fore-seeable abuse of vehicles by their owners (for example owners who do not follow maintenance schedules), which is of course related to the f o r c e s o f n a t u r e . C y b e r -vulnerabilities, however, introduce a different challenge: anticipating how the conscious and malicious acts of third parties affect the vehicle.

In a sense, the low-tech analogue to cybersecurity threats has been around for years: sabotage. The pos-sibility of a saboteur cutting a vehi-cle’s brake line or throwing a brick throw the window of a moving car has been around for generations. Sensibly, there is no expectation that vehicle manufacturers must design their vehicles to protect against these criminal acts. Cybersecurity is differ-ent because the vulnerabilities can theoretically scale to large popula-tions of vehicles. This difference likely drives the concerns of the in-dustry and regulators. Further, as more vehicle functions become au-tomated and vehicles become con-nected to one another, the tempta-tion to target vehicles becomes more enticing to malicious actors.

So, how should cybersecurity vulner-abilities be treated? Do the tradition-al investigative and reporting re-quirements of NHTSA make sense in the world of cybersecurity threats? NHTSA’s enforcement guidance seemingly argues that cybersecurity vulnerabilities can be analyzed and

regulated in the same way as tradi-tional defects. There are, however, some potential short comings that are unique to cyber-vulnerabilities.

One of the hallmarks of NHTSA’s safety-related defect enforcement is the obligation on manufacturers to submit a defect information report to NHTSA and recall products by notifying owners. This is a necessari-ly public process. Defect notices are posted on NHTSA’s public website and owners are notified in writing of the recall. There rationale for this

open process is powerful. Owners should be notified of the unreasona-ble risks their vehicle presents in or-der for them to protect themselves and learn that they are entitled to a free remedy.

NHTSA has repeatedly stated that the public notification of a safety-related defect must be made even if the manufacturer has not developed a remedy for the defect. Underlying this public notification is the under-standing that the public announce-ment would not increase the likeli-hood of the risk occurring. In short, telling the public that a suspension system may fail as a result of corro-

7 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

NHTSA’s enforcement

guidance seemingly argues

that cybersecurity vulnera-

bilities can be analyzed and

regulated in the same way

as traditional defects. There

are, however, some poten-

tial short comings that are

unique to cyber-

vulnerabilities.

sion will not accelerate the corrosion and resulting failures.

On the other hand, publicly an-nouncing a cyber-vulnerability po-tentially does increase the likelihood that the vulnerability will be exploit-ed. Publicly announcing the vulnera-bility before a remedy has been de-veloped and deployed would essen-tially be an invitation for mischief from malicious third parties. This concern is one of the reasons that vehicle manufacturers have voluntar-ily developed an information sharing and analysis center (ISAC) for the automotive industry. The Auto ISAC allows vehicle manufacturers to work confidentially and collabora-tively to seek solutions to cybersecu-rity threats by creating a central re-pository for intelligence and analysis, sharing vulnerabilities seen in the industry, and distributing the infor-mation to the member manufactur-ers.

NHTSA’s guidance does not address the question of whether public dis-closure may heighten the risk of vul-nerability. Can disclosure of a vul-nerability to the voluntary Auto ISAC function as a substitute for NHTSA’s traditional defect infor-mation report?

Another potential short coming to NHTSA’s traditional analysis is that software does not wear out as a brake pad, windshield wiper, or oth-er component does. Rather, software remains the same until it is replaced or patched. But the security features of the software will almost assuredly become obsolete over time. While over-the-air updates of vehicle soft-ware are becoming more common, how should potential vulnerabilities be handled for vehicles that do not receive security updates, particularly if owners refuse the updates? Simi-larly, how long must the vehicle manufacturer service old versions of software? Does the manufacturer have a responsibility to continue looking for potential vulnerabilities

in a vehicle produced 10 years in the past? Can manufacturers limit that liability by setting an end-of-life date for vehicles?

These questions remain unresolved. As advanced technology moves for-ward, greater guidance on how vul-nerabilities will be treated and what would be a reasonable level of secu-rity for vehicles would surely benefit everyone.

* Nick Englund is special counsel and a busi-ness lawyer and practices in the NHTSA Team and Automotive Industry Team of Foley & Lardner LLP. Previously, Mr. En-glund worked as a litigation and enforcement attorney with NHTSA. He works in Wash-ington, D.C. and can be reached at NEnglund@foley.com.

Publicly announcing

the vulnerability before

a remedy has been

developed and de-

ployed would essen-

tially be an invitation

for mischief from mali-

cious third parties.

8 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

S elf-driving cars, or autono-mous vehicles, may be the greatest disruptive innova-tion to travel that we have

experienced in a century. A fully-automated, self-driving car is able to perceive its environment, determine the optimal route, and drive unaided by human intervention for the entire journey. Self-driving cars have the potential to drastically reduce acci-dents, travel time, and the environ-mental impact of road travel. Fur-thermore, the market opportunity for car manufacturers, technology developers, and original equipment manufacturers is expected to reach $87 billion by 2030. However, ob-stacles remain for the full implemen-tation of the technology, including the need to reduce public fear, in-crease reliability, and create adequate regulations. Self-driving vehicles combine an ar-ray of currently available and in-development technologies to obtain “perception” of the vehicle’s envi-ronment. Examples of autonomous technologies include autonomous emergency braking, automatic park-ing, adaptive cruise control, lane-keeping assist, and vehicle-to-vehicle or vehicle-to-infrastructure networks communication systems. Traditional automotive manufacturers have gen-erally adopted an incremental ap-proach to the distribution of autono-mous technology, whereas technolo-gy companies and non-traditional automotive manufacturers have ad-vocated for the distribution of fully-autonomous automobiles as the starting point for the technology. For example, the Google “Bubble Car” was originally designed without a steering wheel or brake pedals and

was intended to be driven without the aid of a human operator. The debate between semi-autonomous and fully-autonomous development seemed to be all but closed late in 2015 when certain state regulations required that autonomous vehicles maintain a “driver” present in the car at all times while in motion. But earlier this year, the National High-way Traffic Safety Administration clarified that autonomous driving software itself could qualify as the vehicle’s legal “driver.”

However the technology comes to market, the question is no longer “Is it possible?”, but, rather, “When will it be available?” Most global auto-motive industry executives expect self-driving cars to be on the market by 2025. By 2035, it is projected that there will be 54 million self-driving cars on the road globally. If these numbers are accurate, we should expect to see a monumental shift in regulations that address autonomous technology and driver behavior in-formation over the next few years. Of particular concern with regard to autonomous technology and driver behavior information are the data

privacy issues. To date, seven states and the District of Columbia have enac ted l aws tha t addres s autonomous vehicles or autonomous technology, but none of these state regulations address key areas of data privacy, such as the collection, use, and disclosure of driver behavior in format ion ga the red f rom autonomous vehicles or autonomous technology. Other state laws, construed broadly, could be used to regulate the collection, use, and disclosure of driver behavior information. Seventeen states have passed event data recorder (“EDR”) statutes. EDRs, also known as “black boxes,” capture information in the event of a collision such as speed, changes in velocity, engine throttle, safety belt use, and brake compression time. EDR statutes address privacy concerns such as whether the driver must be made aware of the EDR, who has access to the information collected by the EDR, and who owns the information collected by the EDR. In December 2015, the federal Driver Privacy Act of 2015 (the “Act”) was enacted. The Act makes clear that information collected from an EDR belongs to the owner or lessee of the vehicle and that data recorded or transmitted by an EDR may not be accessed by a person other than the vehicle’s owner or lessee, except in certain defined circumstances. In addition to the states that have enacted regulations regarding autonomous technology and driver behavior information, automotive industry representatives have enacted their own self-regulatory

SELF-DRIVING VEHICLES: PRIVACY ISSUES

BY: DAVID ZETOONY AND CHRIS ACHATZ ∗∗∗∗

9 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

Self-driving cars have the potential to drasti-

cally reduce acci-dents, travel time, and the environmental im-

pact of road travel.

guidelines to address these issues. The Alliance of Automobile Manufacturers and the Association of Global Automakers, representing 19 automobile manufacturers, enacted a set of “Privacy Principles” for vehicle technology and services in 2014. The Privacy Principles govern the collection, use, and disclosure of driver behavior information retrieved from vehicles equipped with autonomous technology or enabled with “smart” services. Participating automobile manufacturers commit to comply with a set of seven fundamental privacy principles that address Transparency, Choice, Respect for Context , Data Minimization, Data Security, I n t eg r i t y and Acces s , and Accountability. Additionally, the A l l i a n c e o f A u t o m o b i l e Manufacturers has established an automotive information sharing and analysis center that serves as a central hub for sharing data regarding security threats and vulnerabilities in car technologies and in-vehicle data networks. The following are questions to consider when evaluating the data privacy issues of self-driving vehicles:

* Do current regulations cover your self-driving car? If so, what as-pects of your self-driving car do these regulations cover, and what do those regulations require? Re-member that even if there is no federal statute that specif-ically addresses self-driving technology and if state stat-utes that do address the tech-nology do not discuss data privacy or security, it does not necessarily mean that your technology is not cov-ered by regulations (or regu-lators) that have a broader scope. For example, the Federal Trade Commission has taken the position that it has jurisdiction under the Federal Trade Commission

Act to require any company that collects sensitive person-al information to apply rea-sonable and appropriate se-curity to protect that infor-mation.

* What types of data does your au-tonomous technology collect? If the data is not personally identifiable (i.e., it is not ex-pressly linked to a vehicle’s owner or passengers), could third parties easily associate the data to a person, render-ing it personally identifiable?

* Who else has access to the data,

and what are these third parties doing with the data? Third par-ties include other companies to which you may be provid-ing data in order to explore joint marketing efforts. Third parties also include your vendors, service provid-ers, corporate affiliates, and corporate subsidiaries that provide your company with

support in providing, or op-erating, self-driving technolo-gy.

* Do you have a duty to notify the

driver of the self-driving car of the data you are either actively or pas-sively collecting? State statutes that have historically forced disclosure of data collection practices never envisioned autonomous technologies. That said, it is not a foregone conclusion that such technol-ogies will not apply to self-driving cars. Federal and state agencies have already demonstrated a willingness to interpret these statutes broadly in an attempt to ap-ply them to new technolo-gies.

* Do you have a duty to notify the

driver if you lose the data or if based on the data you are aware of conditions that could put the driver in danger? Current data breach notification statutes do not apply to all types of information; most state stat-utes force disclosure only if a breach involves Social Secu-rity Number, driver’s license number, or a financial ac-count number. That said, a minority of states have ex-tended their statutes to other types of data that may be collected by self-driving cars. For example, some states require companies to notify consumers if biometric infor-mation is lost. As car manu-facturers have already began experimenting with finger-print identification, facial recognition, and body form recognition technologies, it is conceivable that a data loss may trigger one or more of these state statutes. Even if a data breach notification stat-ute is not triggered, it is also important to remember that

10 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

To date, seven states and the District of Co-lumbia have enacted laws that address au-tonomous vehicles or autonomous technolo-gy, but none of these state regulations ad-

dress key areas of data privacy, such as the col-lection, use, and disclo-sure of driver behavior information gathered

from autonomous vehi-cles or autonomous

technology.

companies often voluntarily disclose data breaches in order to protect their long-term reputation and to satis-fy commitments made to consumers about transpar-ency.

* What choices have you given, or

are you required to give, the driver of the self-driving car? In the United States, companies are typically not required to pro-vide data subjects with choice in terms of what in-formation is collected, or how it is used, so long as the information collection is disclosed. From a legal per-spective, consumers are con-sidered to have exercised “choice” by their decision to purchase a product, along with all of its data privacy implications, in the first place. That said, other countries have focused more on requiring that companies provide consumers with choice concerning how their data is used—and not condi-tioning the purchase of a product on the consumer agreeing to certain uses. Developers of autonomous technology that intend to market cars globally will need to decide whether to adopt a uniform, or country-specific, approach to offer-ing choice.

* Have you attained appropriate

releases of liability permitted un-der current regulations? Not all risks, in all jurisdictions, can be released or disclaimed. As self-driving technology develops, we expect to see more regulators limit the extent to which risk can be released.

* Have you procured insurance in

sufficient amounts to cover likely

risks and threats? Given the developing nature of the industry, it is an open ques-tion as to how much insur-ance markets will provide coverage to developers of autonomous technology and, if they do, what will be the cost.

* David Zetoony is a Partner at Bryan Cave LLP. He can be reached at-David.Zetoony@BryanCave.com. Christo-pher Achatz is an Associate at Bryan Cave L L P . H e c a n b e r e a c h e d at Christopher.Achatz@BryanCave.com.”

In addition to the states that have enacted regula-tions regarding autono-mous technology and driver behavior infor-

mation, automotive indus-try representatives have enacted their own self-regulatory guidelines to

address these issues.

11 ABA S���� � A ��������� L�� T���������� Q�������� V�. 1 N. 1 S���� 2016

RECENT U.S. AND INTERNATIONAL REGULATORY DEVELOPMENTS

IN THE RACE TO ENABLE DRIVERLESS VEHICLES

BY: ANURAG MAHESHWARY*

12 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

T he race to develop the first driverless vehicles (i.e., NHTSA Level 4 and SAE International Standard

J3016 Level 5) has spurred a fierce competition, not just among industry stakeholders, but also among jurisdic-tions vying furiously to establish them-selves as the premier global test-bed for such technology. Although many jurisdictions have adopted a formal framework to permit testing driverless vehicles when a human driver is pre-sent, few, if any, have addressed test-ing without human driver presence. Over the past year, however, a frenzy of developments has occurred in juris-dictions worldwide that may soon ena-ble driverless vehicles to be tested without human drivers. This survey highlights some recent developments in jurisdictions that have adopted a formal framework (comprising regula-tory, legislative, and/or quasi-regulatory actions) that addresses pub-lic road testing or mass deployment of driverless vehicles without human presence. The survey compares and contrasts differing approaches among jurisdictions and ranks them according to their “testing friendliness” from the perspective of industry stakeholders. Finally, the survey concludes that alt-hough some U.S. states were the early global leaders, that lead is in danger of being eclipsed by other jurisdictions that are quickly catching up. I. New Zealand: The World’s Most Testing-Friendly Jurisdiction — For Now In what seems to be a well-kept secret, New Zealand — yes, New Zealand — appears to be the world’s most testing friendly jurisdiction. In February 2016, the New Zealand Ministry of Transport issued guidelines entitled, “Testing Autonomous Vehicles in

New Zealand” that set forth prerequi-sites for stakeholders seeking to test driverless vehicles. Among them are liability and indemnity insurance, sub-mission of a “safety management plan” setting forth a description of the technologies being tested, a summary of prior private testing thereof, a log of incidents that occurred during test-ing, and compliance with (or applica-tion for exemption from) applicable regulations. Upon satisfaction of these conditions, New Zealand will permit testing on any public roads

without restriction. In contrast to other jurisdictions that have adopted traditional rulemaking or legislative tools to enable testing (see below), New Zealand has adopted a purely “quasi-regulatory” approach (e.g., gov-ernment-issued guidelines, policy statements, and exemptions from ve-hicle standards). While New Zealand’s approach is unique, what truly distinguishes the country is its express proclamation that existing laws do not require a hu-man driver to be present in the vehi-cle: “A particular advantage of test-ing autonomous vehicles in New Zealand is that our legislation does not explicitly require a vehicle to have a driver present . . . . So long as any testing is carried out safely,

a truly driverless vehicle may be tested on public roads today.” Granted, the guidelines are silent as to whether existing laws implicitly require human driver presence. However, the guidelines’ plain language and multiple references to testing without human driver presence show a clear intent to allow such testing. Moreover, the guidelines encourage stakeholders to seek exemptions from provisions in vehicle standards “where requirements are clearly unreasonable or inappropri-ate,” suggesting a willingness to re-move implicit barriers to testing driv-erless vehicles. With respect to deploy-ment, however, New Zealand has not proposed any enabling initiatives, opt-ing instead to monitor international developments and respond when ap-propriate. New Zealand’s newly issued testing guidelines specifically encourage test-ing of driverless vehicles without hu-man driver presence. Although there is an open question as to whether im-plicit regulatory barriers exist, New Zealand’s willingness to entertain ex-emptions suggests an openness to ad-dress that issue quickly. Arguably, for those seeking to test a truly driverless vehicle today, New Zealand is the most testing-friendly venue in which to do so.

II. U.K.: Runner-Up After New Zealand, the U.K. appears to be the world’s second most testing-friendly venue. The U.K. has been aggressively developing a quasi-regulatory approach to facilitate test-ing of autonomous vehicles, publicly declaring its goal of becoming the global leader in this area. Since 2015, the U.K. has issued several policy guidance documents to achieve this goal. In February 2015, the U.K. De-

For those seeking to test a truly driverless vehicle today, New Zealand is the most

testing-friendly venue in which to do so.

partment for Transport issued a report entitled, “The Pathway to Driverless Cars: A Detailed Review of Regula-tions for Automated Vehicle Technol-ogies.” This report summarized find-ings of an audit of existing U.K. motor vehicle regulations, which was tasked with identifying regulations that were incompatible with the testing of au-tonomous vehicles. The audit report concluded that existing regulations permit such testing on public roads, provided that a human driver is pre-sent in the vehicle. Importantly, no certifications, permits, or posting of bonds are required to commence test-ing, which are significant burdens im-posed by many other jurisdictions. Finally, the U.K. committed to issuing detailed testing guidelines in collabora-tion with stakeholders. Notably, the U.K. touted its “light touch/non-regulatory approach” as “quicker to establish, more flexible and less oner-ous for those wishing to engage in testing than the regulatory approach being followed in other countries, no-tably in the U.S.” In July 2015, the U.K. issued its test-ing guidelines in a report entitled, “The Pathway to Driverless Cars: Code of Practice for Testing.” Alt-hough non-statutory, the U.K. clearly intended the testing guidelines to be affirmative proscriptions, warning that non-compliance would constitute neg-ligence. The guidelines established detailed requirements for driver licens-ing and training, documentation of prior in-house testing on closed roads, data recording devices, data privacy and cybersecurity protections, among other things. But most critically, the guidelines appear to soften — or de-part completely from — the audit re-port’s earlier requirement of human presence. The guidelines provide that either a human driver or a “test opera-tor . . . who oversees testing . . . without necessarily being seated in the vehicle” shall supervise testing and be able to override autonomous mode at any time and take control of the vehicle. This conflicts directly with the audit report, which provides that “[r]eal-world testing . . . is pos-

sible . . . providing a test driver is present and takes responsibility for the safe operation of the vehicle.” It is unclear how to resolve this con-flict. Still, given that the audit report predates and defers to the guidelines for establishing testing requirements, driverless vehicles without a human driver present arguably could be tested so long as a remotely located human supervisor is capable of taking control of the vehicle. As with New Zealand, stakeholders should consider seeking interpretations or exemptions to re-solve this ambiguity. In contrast to its quasi-regulatory ap-proach to enable testing driverless vehi-cles without human driver presence, the U.K. recognizes that deployment would require regulatory and legisla-tive actions, and the country has estab-lished a roadmap for doing so. By summer 2017, the U.K. aims to identi-fy necessary regulatory reforms, and by the end of 2018, it would complete an assessment concerning the need for enabling legislation. Overall, the U.K.’s testing guidelines raise the tan-talizing prospect of testing driverless vehicles without human driver pres-ence, pending resolution of conflicting guidance in the audit report. A resolu-tion endorsing the view set forth in the guidelines could establish the U.K. as a leading testing-friendly jurisdic-tion in the near term, as well as a lead-ing venue for deployment in the long-er term.

III. U.S.: Federal Leadership vs. State Patchwork Quilt At the state level, the U.S. was the pioneer in evangelizing autonomous

vehicle testing. In 2011, Nevada be-came the world’s first jurisdiction to adopt a formal regulatory framework permitting testing on public roads. As of this writing, three states (Florida, California, and Michigan) and the Dis-trict of Columbia have adopted formal frameworks explicitly permitting such testing, and many others are currently considering regulation and/or legisla-tion. Collectively, roughly two dozen states have proposed more than fifty bills varying widely, resulting in incon-sistency and confusion. For example, Michigan restricts testing to OEMs, California requires the posting of a $5 million bond, and Nevada requires the presence of two licensed individuals in the vehicle, storage of pre-collision sensor data, special license plates, and geographic restrictions on testing. This fractured approach has created a regulatory “patchwork quilt” that im-pedes testing, and it is largely due to an absence of comprehensive federal guidance. However, recent NHTSA announcements and actions aim to resolve this regulatory morass and create a uniform national policy. A summary follows.

A. Federal: A New, Uniform

Approach May Soon Provide Leadership

In January 2016, Transportation Secre-tary Anthony Foxx unveiled the De-partment’s new strategy for autono-mous (i.e., NHTSA Level ≤ 3 and SAE J3016 Level ≤ 4) and driverless vehicles, comprising various an-nouncements and milestones that NHTSA committed to meeting this year. Among them, first, by July, NHTSA would propose guidelines regarding the deployment of driverless vehicles, along with a common under-standing of requisite performance cri-teria and test procedures needed to assess them. Second, by July the agency would release a model state policy concerning both testing and deploy-ment of autonomous and driverless vehicles that offers a path to con-sistent national policy. Third, NHTSA acknowledged that its existing legal authority is likely insufficient to sup-

The UK’s quasi-regulatory framework raises the tantalizing

prospect of enabling the testing of driverless

vehicles without human driver presence.

13 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

port mass deployment of autonomous vehicles, “including those designed without a human driver in mind,” and stated that it would consider seeking additional authority via legislation or initiating rulemaking. Finally, Secretary Foxx encouraged stakeholders to seek FMVSS interpretations or exemptions, where appropriate, to facilitate testing or deployment of driverless vehicles — including those without human driver presence. With these an-nouncements, the U.S. has committed to a comprehensive framework to ac-celerate the advent of truly driverless vehicles. Next, in a February 2016 letter, NHTSA responded to a rule interpre-tation request from Google concern-

ing the definition of the term “driver” for purposes of compliance with cer-tain FMVSS provisions. In a major policy shift that may have a significant impact on enabling driverless vehicles, NHTSA interpreted “driver” broadly to include an artificial-intelligence self-driving system, which opened the door to legal recognition of truly driv-erless vehicles for the first time. How-ever, the agency cautioned that until it develops performance criteria and test procedures for evaluating whether a self-driving system meets various FMVSS provisions, it could not cate-gorically interpret self-driving systems as compliant with existing regulations. The agency allowed that some FMVSS provisions could be addressed in the short term via requests for interpreta-tions and petitions for exemptions, but cautioned that other provisions,

such as requirements for manual con-trols, would require a traditional regu-latory solution. In March 2016, the DOT issued a pre-liminary report entitled, “Review of Federal Motor Vehicle Safety Stand-ards (FMVSS) for Automated Vehi-cles,” which summarized results of an audit of existing FMVSS provisions. One purpose of the audit was to iden-tify standards that include references, both implicit and explicit, to a human driver that could impede deployment of driverless vehicles. The audit re-port painstakingly examined each of the 73 standards specified in the FMVSS and identified specific provi-sions that could be problematic. Among other things, the audit found that although few existing regulations would hinder deployment of autono-mous vehicles designed for human driver presence, vehicles without hu-man drivers or manual controls would indeed conflict with FMVSS provi-sions or policy objectives. However, the DOT noted that its analysis pre-dated NHTSA’s interpretation of the definition of “driver” and therefore did not reflect this development. Together, imminent federal guidance documents, results of the regulatory audit, and NHTSA’s innovative inter-pretation of “driver” show leadership that may establish the U.S. as among the world’s preeminent venues for both testing and deployment of truly driverless vehicles. In the near term, NHTSA’s quasi-regulatory approach should help harmonize conflicting state approaches, resulting in a con-sistent and uniform national policy. Longer term, contemplated legislative and rulemaking efforts should facili-tate deployment. B. States 1. Florida: Soon to Become the Leader? In 2012, Florida became the second state (after Nevada) to permit opera-tion of autonomous vehicles on public roads. However, it placed onerous

restrictions on those wishing to do so, including: restricting operation to testing only, restricting testing to ei-ther OEMs or educational institutions, requiring the presence of a human driver, and requiring either proof of insurance or a bond in the amount of $5 million. In April 2016, however, Florida enact-ed H.B. 2027, which was a sweeping expansion of the permissible uses of autonomous vehicles on public roads. Among other things, the legislation jettisoned all of the foregoing limita-tions — including the requirement of human presence. Theoretically, re-moval of this limitation would enable driverless vehicles without human driver presence to be tested or de-ployed on Florida roads. It remains to be seen, however, whether implicit Florida or federal regulations would thwart such testing or deployment. Still, if stakeholders are able to obtain favorable regulatory interpretations or exemptions, Florida may have cata-pulted itself to the status of being among the world’s most testing-friendly venues. The legislation takes effect on July 1.

2. California: Soon to Become the Laggard?

California is one of the world’s only jurisdictions to develop regulations for the deployment of autonomous vehicles. In December 2015, California released draft rules that address only the transi-tion from testing to deployment, but not full deployment. The rules would require, among other things, manual controls, human driver presence, new safety and performance requirements, certifications from third-party testing organizations, regular submission of usage reports, and restriction of distri-bution to leases, not sales. Unsurpris-ingly, many stakeholders have criti-cized the proposed rules harshly as unnecessarily restrictive and likely to stifle development of autonomous technologies. In particular, critics have condemned the requirements for human drivers and manual controls, contending that if finalized, such re-

Theoretically, Florida’s recently enacted legislation would soon enable vehicles

without human driver presence to be tested or

deployed on Florida roads.

14 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

strictions would deter firms from de-ploying — or even testing — driver-less vehicles in California.

Echoing these concerns, in February 2016, legislators introduced bill A.B. 2866 in the California State Assembly, which amounts to a full frontal assault on many of these restrictions in the draft regulations. Among other things, the bill would overturn the proposed requirements for human presence and manual controls, and it directs California, by July 2018, to adopt regulations expressly permitting the testing and deployment of driver-less vehicles without human drivers or manual controls. The bill would also expressly permit public road testing and deployment of driverless vehicles upon adoption of the new regulations. The bill is currently in the embryonic stages of the legislative process. Until it is enacted, however, California’s strict regulatory approach has brought with it the dubious distinction of be-ing the least hospitable jurisdiction in this survey in which to test truly driv-erless vehicles. IV. Australia: The Most Comprehensive Approach Yet

In November 2015, Australia launched a comprehensive plan to enable testing and deployment of au-tonomous and driverless vehicles. The plan sets forth specific mile-stones, including auditing all relevant federal and state laws and regulations to identify potential barriers to testing and deployment, recommending reme-dial actions, and commencing some preliminary reforms. Australia has set an aggressive timeline to achieve these milestones — just over one year. The first fruit of this effort was borne in February 2016, when Australia’s National Transport Commission (“NTC”) issued an initial report enti-tled, “Regulatory Barriers to More Automated Road and Rail Vehicles Issues Paper.” The report provided an overview of Australia’s existing regulatory landscape and identified key issues that could impede testing and

deployment of autonomous and driv-erless vehicles. The report concluded that although most aspects of its exist-ing regulatory framework are unlikely to impede driverless vehicles, still oth-er potential barriers exist. In particu-lar, the NTC noted that “the most significant barrier[s]” were some fed-eral and state laws, as well as vehicle safety and performance standards, that implicitly require human driver pres-ence. The report identified several additional categories of potential barri-ers, including: ambiguity in the defini-tion of “control” concerning who or what is in “control” of an autonomous vehicle, liability issues, and data priva-cy and access thereto. The NTC painstakingly examined the proper role of government in removing the fore-going barriers, and considered whether the optimum approach should involve rulemaking, legislation, or a quasi-regulatory approach. Ultimately, the NTC cautioned against a rush to rule-making or legislation at this time, fear-ing that such processes could chill innovation in this rapidly evolving technological area, devolving into a U.S.-style regulatory patchwork quilt. In May 2016, the NTC issued a follow-up report entitled, “Regulatory Op-tions for Automated Vehicles.” Anal-ogous to audits conducted by the U.K. and U.S., Australia audited relevant laws and regulations and identified specific provisions — 716 in total — that were potential barriers to testing and deployment. It also proposed recommendations to address these issues, which are subject to revision based on upcoming public comments. Importantly, these reforms would be coordinated at the federal and state levels, in contrast to the current ap-proach in the U.S. The remedies dif-fer in purpose and scope and would phase-in over five years. Phase 1, which would commence as soon as possible, would facilitate testing of driverless vehicles and deployment of autonomous vehicles by introducing national guidelines to support a uni-form approach to testing and state-based exemptions to existing stand-ards, as well as clarifying the meaning

of “control.” Phase 2, which would commence within two years, would enable deployment of driverless vehi-cles via new legislation expanding the definition of “driver” to include au-tonomous driving systems, providing a “safety assurance framework” for au-tonomous vehicles, among other things. Finally, Phase 3, which would commence within three to five years, would initiate rulemaking to remove implicit references in vehicle standards to human drivers and manual controls, and issue new standards governing cybersecurity, data privacy, and other issues. The NTC will make final rec-ommendations to federal and state transportation ministers in November 2016, and in December 2016, the

agency will issue a final report summa-rizing the direction chosen by the min-isters.

Australia has embarked on an ambi-tious journey that may establish it as a preeminent jurisdiction in which to both test and deploy truly driverless vehicles. Under its proposed regulato-ry reforms, public road testing of vehi-cles without human drivers could commence almost immediately, and full deployment may be possible in 2020. Like the U.S., Australia has em-braced the idea that the term “driver” in vehicle standards should not be narrowly confined to humans, and instead should be broadened to in-clude autonomous systems — a criti-cal recognition made by no other ma-jor jurisdictions. However, unlike ef-forts in the U.S., Australia’s blueprint

Australia has embarked on an ambitious journey that

may establish it as a preeminent jurisdiction in which to both test and deploy truly driverless

vehicles.

15 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

proposes comprehensive, coordinated reforms at the state and federal levels, which should provide greater uni-formity and clarity. Coupled with Australia’s phased approach to re-forms — ranging from a quasi-regulatory approach in the short term, to legislative amendments in the medi-um term, to initiating rulemaking in the long term — Australia’s overall framework is an innovative solution that should provide clarity and pre-dictability to industry stakeholders seeking to test or deploy truly driver-less vehicles. V. Canada: Last Among the G7 Among G7 nations, Canada is farthest behind in developing a formal regula-tory framework for testing autono-mous vehicles and has no plans specif-ic to driverless vehicles. (Canada is included in this survey due solely to its geographic and economic proximity to the U.S.) However, recent develop-ments show that Canada is keen to shed that status. In January 2016, On-tario established a pilot testing pro-gram, making it the first province to enable public road testing of autono-mous vehicles. Under the 10-year pi-lot, a human driver must be present in the vehicle, and a certification of in-surance of $5 million is required; no special permits, license plates, identifi-ers, or other onerous conditions are imposed. Notably, the application process is highly streamlined, consist-ing of an online, single-page form that does not require submission of any supporting documentation. Appli-cants are simply required to certify, by clicking a checkbox on the form, that they have reviewed the requirements set out in applicable regulations. This simplified online form is a unique and innovative feature that should facili-tate participation in testing. Although Canada has not yet adopted a formal framework specific to driverless vehi-cles, Ontario’s actions have already catapulted itself ahead of many U.S. states with respect to testing autono-mous vehicles and may hasten devel-opment of a federal approach for test-ing truly driverless vehicles.

VI. Conclusion

An analysis of recent international developments to facilitate testing driv-erless vehicles without human driver presence shows a continuum of widely varying regulatory approaches. At opposite ends of the spectrum are New Zealand, with its freewheeling, quasi-regulatory approach, and Cali-fornia, with its rigid, traditional rule-making approach. Occupying the white space in the middle are the U.K., U.S. (federal), and Australia, which are following hybrid frame-works, consisting of a quasi-regulatory approach in the short term, with legis-lation and rulemaking contemplated in the longer term. For those seeking to test a truly driver-less vehicle today, New Zealand (and perhaps Florida beginning in July) is the most testing-friendly venue in which to do so, although there re-mains an open question concerning the existence of potential implicit reg-ulatory barriers. The U.K. appears to be the runner-up, as it ostensibly per-mits testing by a remotely located driv-er, but a conflict in the relevant guid-ance documents needs resolution. In the U.S., a regulatory patchwork quilt at the state level, together with recent federal pronouncements, create much uncertainty. However, if imminent federal guidance resolves the regulato-ry quagmire, the U.S. may be poised to lead. Finally, the Land Down Under is perhaps the most interesting. Alt-hough Australia’s legal landscape bans

testing vehicles without human driver presence, its proposed reforms, which comprise a comprehensive, coordinat-ed effort at the federal and state levels, are broader and deeper in scope than those of the U.S. and ultimately may yield the most promising outcome for stakeholders seeking to test truly driv-erless vehicles. Overall, although much uncertainty persists from devel-opments over the previous twelve months, the next twelve are certain to be even more momentous. * Anurag Maheshwary is an attorney at a Fed-eral Government agency. Previously, he was an automotive engineer at Freightliner Corp. Anurag can be reached at (301) 642-3082 or AnuragMaheshwary.Esq@gmail.com. End-notes are on file with author and will be fur-nished upon request.

16 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

Although much uncertainty persists from developments over the previous twelve months, the

next twelve are certain to be even more momentous.

1

I. Introduction The trucking, motor coach, motor carriers, moving industries, and their representatives must familiarize them-selves with the intricacies of U.S. De-p a r tmen t o f T r anspo r t a t i on (“USDOT”) and its operating admin-istrations’ laws, regulations, and inves-tigatory powers – specifically the Fed-eral Motor Carrier Safety Administra-tion (“FMCSA”) – if they wish to re-main in compliance and avoid en-forcement actions.

A regulated party’s privileges and im-munities, as guaranteed by the Consti-tution, are not always obvious during a government review which takes the form of an ordinary safety audit, re-view, or investigation. Prudent counsel needs to take care whenever interact-ing with government personnel to protect their client’s broad range of interests, as agency personnel are au-thorized to obtain evidence relevant to administrative, civil, and criminal cas-es, even if seemingly unrelated to the interaction at hand. Specifically, agen-cy personnel are authorized to obtain evidence including oral and written statements of employees, former em-ployees, and third-parties. They are also able to perform an in-depth re-view and analysis of a multitude of business documents and records, which appear to have little to do with direct motor carrier operations.

II. FMCSA Investigatory Power The Secretary of Transportation has delegated to FMCSA significantly broad authority to carry out its prima-ry purpose of ensuring a safe and effi-cient transportation system. The FMCSA may begin an audit, review, or investigation under its “own initiative or on complaint.” It may also obtain “from motor carriers … information

the Secretary decides is necessary to carry out” its functions. The FMCSA “may on demand and display of proper cre-dentials, in person or in writing in-spect and examine the lands, buildings, and equipment of a carrier” and “inspect and copy any record of a car-rier.”

Generally companies falling under FMCSA jurisdiction have a duty to “make all records pertaining to [the] accident available to the FMCSA,” and

to “provide all reasonable assistance in the investigation of any accident, in-cluding providing a full, true and cor-rect response to any question of in-quiry.” If Hazardous materials are in-volved, the FMCSA “may inspect and investigate, at a reasonable time and in a reasonable manner, records and property relating to safe transportation, includ-ing security of hazardous material in intrastate, interstate, and foreign com-merce.” The agency may also “gather information from the offeror, carrier, packaging manufacturer, or tester, or

other person responsible for” a ship-ment.

Any oral or written communication provided to the FMCSA may be used in an administrative, civil, or criminal proceeding. Companies are not re-quired to create new documents, alter software, or create new templates to display data in a manner not con-sistent with their normal business practice, but they must produce rec-ords they are required to be main-tained under current regulations. For example, many companies utilize GPS tracking systems, but they cannot be required to conduct specific analysis to aid a FMCSA investigation. Similarly, the FMCSA cannot require records to be kept in a certain medium; but a company must produce those records in whatever format they are main-tained.

The FMCSA has an express obliga-tion to “consult, as appropriate, with employers and employees and their authorized representatives and offer them a right of accompaniment.” The FMCSA is not afforded unfet-tered access to testimony, property, or equipment, and motor carrier counsel should always remain dili-gent and ensure all FMCSA person-nel are escorted at all times during an inspection or investigation. Compa-nies are not required to give the in-vestigator unrestricted access to company facilities, data systems, and etc.

Regulatory language also limits the scope of an inspection to records and property except as discussed further below. FMCSA personnel routinely seek to interview employ-ees without company supervision and without counsel present and usually ask those interviewed to cre-ate a sworn statement. In these situa-

THE FINE LINE: MOTOR CARRIER INVESTIGATIONS & CLIENT RIGHTS

BY: BRIGHAM A. MCCOWN*

17 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

A regulated party’s privileges and im-munities, as guaran-teed by the Constitu-tion, are not always obvious during a gov-ernment review

which takes the form of an ordinary safety audit, review, or in-

vestigation.

2

tions, companies are not required to allow interviews with employees and can designate who will speak on be-half of the company. The company also has a specific right for counsel to be present during all interviews. Keep in mind that records and con-versations may be disclosed pursuant to Freedom of Information Requests (“FOIA”).

If FMCSA personnel desire to ob-tain testimonial evidence without counsel present, the company can require the agency to follow proper administrative procedures regarding subpoenas or notices of deposition. Under no circumstances should FMCSA personnel contact a regulat-ed party’s employees directly without the regulated party’s consent. III. Subpoena Power and Right to

Counsel FMCSA is authorized to issue admin-istrative subpoenas to require testimo-nial evidence and oral information. It has authority to “take testimony of a witness by deposition and may order the witness to produce records” dur-ing a proceeding or investigation. An operator may require the agency to issue a subpoena and have it enforced by an appropriate United States Dis-trict Court. Furthermore, there is no penalty for refusal to comply with an administrative subpoena not yet en-forced by court order. An administrative subpoena has im-portant implications regarding the right to counsel. The Administrative Procedures Act (“APA”) provides that a person compelled to appear is enti-tled to be accompanied, represented, and advised by counsel. In some in-stances, requiring a subpoena is pref-erable given ambiguities concerning individuals who voluntarily appear before investigators. It is important to caveat however that in response to a challenge of its investigative authority (sans subpoena or notice of deposi-tion), FMCSA could attempt to rely on the breadth and vagueness of the

language used to grant its general au-thority over motor carrier safety mat-ters, and counsel should be prepared to respond appropriately. While plau-sible, the better reading is that a regu-lated entity has every right to require the agency to meet its burden of proof to obtain a court order enforcing a subpoena or require the agency to en-gage counsel to request a deposition. Another important factor is that the initial FMCSA enforcement process is conducted without the involvement of counsel. Most enforcement decisions, including whether to bring a civil pen-alty action, are generally decided with-out the input of counsel. For most USDOT enforcement actions, there is no separate legal review as one would find with a district attorney. Requiring the issuance of a subpoena will require the involvement of agency counsel at a much earlier stage, often a positive development. This is not to say every information request should be met with a request to issue a subpoena, but keep in mind that a court should en-force an administrative subpoena only to the extent that it is:

1) Issued pursuant to an investi-gation undertaken for a legiti-mate purpose;

2) Relevant to that investigation; 3) Not unreasonable, overbroad

or unduly burdensome; and 4) Proper administrative steps

have been followed.

In seeking enforcement of an adminis-trative subpoena, the agency is re-quired to articulate and justify the ba-sis and breadth of the information sought. Unreasonable requests are generally resolved just prior to hear-ing, and prevent the imposition of an undue burden on the carrier.

IV. Subsequent Criminal Action Information gathered during an FMCSA investigation may be used in a parallel or subsequent criminal action. Anything discovered by FMCSA is accessible to the OIG and may be re-ferred to the Department of Justice. If an investigation includes the in-volvement of the OIG, one should generally assume a criminal investiga-tion is pending and criminal defense counsel should be immediately con-sulted. Keep in mind constitutional protections may be invoked in any proceeding, civil or criminal, adminis-trative or judicial, investigatory or adjudi-catory; and it protects against any dis-closures which the witness reasonably believes could be used in a criminal prosecution or could lead to other evidence that might be so used.” V. Conclusion Good manners are never waived and common professional courtesies al-ways apply when dealing with federal agencies who are, after all, just people too. Most USDOT employees believe in the mantra that voluntary compli-ance with safety regulations is pre-ferred over enforcement actions and most are eager to assist companies in improving safety. However, knowing and understanding the rules helps to create a level playing field, reduce cli-ent stress, and keep all interested par-ties focused on safety.

* Brigham McCown previously served as the first chief counsel of the Federal Motor Carri-er Safety Administration and the first deputy administrator and administrator of the Pipe-line and Hazardous Materials Safety Admin-istration at the U.S. Department of Transpor-tation in Washington, DC.

18 ABA S���� � A�������� L�� T���������� Q������� V��. 1 N�. 1 S���� 2016

"Most USDOT em-ployees believe in the mantra that voluntary compliance with safe-ty regulations is pre-ferred over enforce-ment actions and

most are eager to as-sist companies in im-proving safety."