The federal government is acknowledging that modern connected vehicles, including electric vehicles, pose real cybersecurity and espionage risks, but it has not conducted a country-specific assessment, even when asked directly about vehicles linked to the People’s Republic of China.

In a response to order paper question Q-882, submitted by Conservative MP Leslyn Lewis, Transport Canada confirmed it has conducted broad assessments into cyber threats involving connected vehicles. However, those assessments were not targeted at any specific country.

Instead, the department said its analysis focused on general vulnerabilities, including how vehicles could be exploited through software, data systems and supply chains.

That analysis, conducted in coordination with Canadian Centre for Cyber Security and Public Safety Canada, identified several key risks.

Go Ad Free

First, connected vehicles are described as “high-value, data-rich technologies” that could be accessed by threat actors.

Second, Ottawa acknowledged that vulnerabilities can be introduced through supply chains, particularly in parts and components.

And third, while ransomware and cybercrime are the most common threats, the most serious national security concern comes from “hostile activities by state actors.”

Despite those findings, the government says enforcement largely relies on manufacturers self-certifying compliance with Canadian safety standards under the Motor Vehicle Safety Act.

Transport Canada also pointed to non-binding guidance and existing privacy laws, including the Personal Information Protection and Electronic Documents Act, as safeguards against unauthorized data transmission.

Notably absent from the response were any concrete restrictions, bans, or enhanced scrutiny targeting vehicles or components tied to foreign adversarial states.

Questions about oversight of software updates, telematics systems, and protections for government fleets were deferred, with Transport Canada stating those issues fall outside its mandate.