The Senate Unanimously Voted to Ban a Car Threat That Has Killed Zero Americans. NHTSA Still Can’t Mandate AEB for Pedestrians.

On July 22, the Senate Commerce Committee approved the Connected Vehicle Security Act unanimously. Not a single dissent. The bill would ban connected vehicles manufactured in, designed in, or more than 15 percent owned by entities in China, Russia, North Korea, or Iran from American roads beginning January 2027.^[1] Software restrictions first. Hardware by 2030.

The threat this legislation addresses has killed zero Americans.

Not one. No Chinese-manufactured connected vehicle has remotely disabled an American driver’s brakes. No Russian-linked telematics system has steered someone into oncoming traffic. No fleet-scale cyberattack has materialized on any continent. The bill’s sponsors, Senators Bernie Moreno and Elissa Slotkin, cited vehicles that “transmit data and can even allow for remote control” as posing “substantial economic and national security risks.”^[2] Could. Can. Risks. Every word is prospective, a vocabulary of threat modeling rather than body counting.

Contrast this with automatic emergency braking for pedestrians. In 2025, 6,732 pedestrians were struck and killed on American roads.^[3] NHTSA finalized its AEB rule in May 2024 after eight years of rulemaking that began with a voluntary commitment from 20 automakers in 2016. The final rule does not require pedestrian AEB until model year 2029 for light vehicles. Full compliance for heavy vehicles: September 2029.^[4] From the first voluntary handshake to an enforceable standard covering every new vehicle sold in America: thirteen years. For a technology that IIHS research showed reduces pedestrian crash rates by 27 percent.^[5]

The Connected Vehicle Security Act moved from introduction to unanimous committee approval in four months.

I want to dwell on what makes this disparity so structurally revealing, because it isn’t hypocrisy. The Senate did something NHTSA has never done: it acted before the bodies. Every major federal vehicle safety standard on the books was written in blood. Rear-view cameras followed 228 documented backover deaths of children.^[7] Electronic stability control mandates came after the Ford Explorer rollover crisis killed hundreds. Side-impact airbag standards were revised after decades of T-bone fatalities. NHTSA’s regulatory model is fundamentally reactive: wait for the death toll, quantify it, propose a rule, gather comments, finalize, phase in, and hope fewer people die during the decade it takes to finish.

Congress just proved it can skip all of that when the threat comes from Beijing instead of Detroit.

Mercedes-Benz makes the political calculus nakedly visible. Mercedes is approximately 19.67 percent Chinese-owned: BAIC, the state-owned automaker, holds 9.98 percent, and Geely founder Li Shufu holds 9.69 percent.^[1] Under the bill’s 15 percent threshold, Mercedes-Benz vehicles assembled by American workers in Tuscaloosa, Alabama and Ladson, South Carolina would be barred from sale in the United States. Senator Cruz acknowledged the problem openly, then let the bill advance anyway.^[2] Mercedes-Benz has 835 fatalities in FARS across its entire US fleet history.^[6] Those deaths came from physics, not firmware.

Economic motivations barely bother to hide. GM announced it will move Buick Envision production from China to the US for 2028, and Ford committed to relocating Chinese-made Lincolns. Waymo pivoted from Chinese platform partner Geely to “a Detroit-based manufacturer.”^[1] The bill has support from GM, Ford, Stellantis, and the UAW. Cruz himself suggested the 15 percent ownership threshold was UAW “retaliation” against Mercedes for blocking unionization drives at its Alabama plants.^[2] Trade protection wearing a national security jersey.

None of which means the cybersecurity risk is fake. Connected vehicles are attack surfaces. A compromised over-the-air update system could, theoretically, affect every vehicle on a platform simultaneously. That is a different risk profile than a faulty wiring harness catching fire one Bronco at a time. Fleet-scale exploitation is the nightmare scenario, and the fact that it hasn’t happened yet does not prove it can’t.

Strongest counterargument: Preemptive action against systemic, catastrophic risk is rational even when the body count is zero. A successfully executed fleet-scale vehicle cyberattack could kill thousands in a single event. Traditional crash defects kill at retail, one intersection at a time, which allows reactive intervention. The Senate is not being hypocritical; it is applying different response frameworks to fundamentally different threat models. Additionally, the legislative process is inherently faster than NHTSA rulemaking because it bypasses the APA notice-and-comment requirements, and Congress has constitutional authority over commerce and national security that NHTSA’s rulemaking process was never designed to replicate.

Limitations: This analysis compares a legislative committee vote to NHTSA rulemaking timelines, which are structurally different processes with different legal requirements. The bill has not passed the full Senate, and Cruz indicated it likely won’t without amendments. Zero vehicle cyberattack deaths is a factual statement about outcomes, not a risk assessment; the absence of past attacks does not quantify future probability. Mercedes-Benz FARS fatalities are compiled from all model years in the database and are not adjusted for fleet size or exposure.

What to do: None of this changes what keeps you alive tomorrow. Check your vehicle for open recalls at nhtsa.gov/recalls. The 36,640 Americans who died last year were killed by mechanical forces, not malware. That will still be true next year, and the year after, while NHTSA gathers comments on whether pedestrian AEB should really be mandatory quite so soon.

Source: NHTSA FARS 2014–2023 for Mercedes-Benz fatality data; Reuters and Lansing State Journal for Connected Vehicle Security Act details; NHTSA preliminary data for 2025 traffic fatalities. See methodology for caveats.