Cybersecurity Regulations for Automated Vehicles: A Conceptual Model Demonstrating the "Tragedy of the Commons"

The integration of various stakeholders in the advancement of Automated Vehicles (AVs) has given rise to a range of technical, legal, and social challenges. Among these challenges, deterring cyber-criminal activities through the implementation of robust cybersecurity protocols and regulations stands out as the most urgent. Although individual stakeholders possess a solid understanding of cybersecurity regulations, there is a lack of a comprehensive decision-making tool that can dynamically visualise the macro-level implications of the AVs Cyber Regulatory Framework (CRF) among Intelligent Transportation System (ITS) stakeholders. To bridge this knowledge gap, this study employs the Causal Loop Diagram (CLD) to dynamically evaluate the progress of interdisciplinary ITS stakeholders in cyber-regulatory advancements. The CLD framework formulates the "tragedy of the commons" system archetype, wherein stakeholders prioritise their self-interests in enhancing cybersecurity, making decisions based on their specific needs without fully considering the potential consequences for others, AV adoption, and the long-term implications for CRF. The findings highlight three key leverage points for decision-makers to focus on. Firstly, establishing a CRF grounded in automakers' innovation is crucial. Secondly, sharing risks and addressing negative externalities associated with underinvestment and knowledge asymmetries in cybersecurity are essential. Lastly, capitalising on the vast amount of AV-generated data in AV operations and urban planning holds significant potential. Moreover, achieving an effective CRF requires striking a delicate balance among four factors: i) managing the limitations on data accessibility for AV automakers and ITS service providers; ii) establishing appropriate thresholds for regulatory command and control; iii) ensuring the safeguarding of automakers' business investments; and iv) protecting consumers' data privacy.