Normally on a panel I would introduce all of the speakers. I think I would rather have
you introduce yourselves and what your position and view is on standardisation and open
source. In the shortest possible time you've got like one sentence or less, which is of
course my standard of saying less than a paragraph. So let me pass that down to you. Hello everyone,
so this is Philippe Molau from DG Connect, the policy officer in the cybersecurity policies unit.
I'm working on the CRA standards and one of the reasons I wanted to join this panel with these
panelists was to show you that even though the current standards that we're developing for
European legislation, these harmonics standards, they now will have to be freely accessible
or at least readable at the end of the process. We know that there's still issues during the standardisation
development process and I wanted to try to give you as much as possible an idea of how it is that
you can participate. Some of the things that we've done from European Commission side to try to make
the voice of open source heard within that process which has been a complicated thing. But hopefully
within the introduction of the panelists you'll see that there have been some way some people have managed
to get a foothold and that will hopefully help you and give you some inspiration and some
some shed some light on and how you can make sure that your voice is heard in this process.
Thanks. Thank you.
Could you help me? We have not met you yet today, sir.
Hello, my name is Fukami. I work for the open SSF in Brussels and I'm primarily focused on the CRA
and within the work in the foundation that I do we like or I'm not a standardisation expert.
I would say so, but what my foundation does is that we produce tools to help
to help managing and securing the supply chain and that also includes a lot of life best practices
and yeah. Thank you. So my name is Lars. I work for a small startup.
Stecker will no one will refer to it. But I'm also a member of the Apache Software Foundation.
I'm O-Boss and in Germany the open source business alliance and we were in a webinar with
Philip together a year or so ago and he said, well if you want to change anything related to
this year, or be involved there, you need to be involved in this standardisation. So it took us about
nine months to get in there, but we are now a member or I'm a member of the San Treaty the 13
working group nine working on this standards and I'm also a member of the Ekme International
Organisation on working on the Cycle and Dex specification and a member of this CRA expert group as
well. Yeah. I'm not going to talk about my experiences standardisation. I think that's coming after the
introduction. Hi folks. So I'm here because I'm interested in both trying to find
pragmatic solutions to make this CRA standardisation process work and also have a longer term
view and trying to fix things at a longer time frame, forced standardisation and open source in
Europe and in general make sure that we are able to move towards harmonized compliance across
the different countries so that if you comply with regulations in one place, it also works elsewhere.
I'm a consultant and I have a number of clients, one of which is the open source initiative
for whom I engage in international standards. For their, I'm a member of the Etsy, which is one of
the two, the three European standards, but it's in the past I've also been a member of a number of
other standards activities including video codex standards and I'm also a member of the UK
British standards institutes IST-41 which is the mirror committee for ISO's document format standards.
And I've also spent a decade helping to lead the open source initiative so I straddle the line
between open standards and open source and may have views. So the first question that I'd like to
address to the panel is the world of open standards is really quite old. There has been a
form of standards process globally and in Europe for many decades. Do you believe that in an
era where open source software forms 80% of the software that is serving the public that our
standards process is fit for purpose? I'm happy to say no. I am happy to say no.
And I think I mean this is a fairly I think everyone agrees that this is a there is
it's not fit for purpose. I think we're on a panel on this Friday at open for a
Europe was someone from the commission who also came forward very openly to say we're trying
we understand we see the tension and the friction and you know help us help us help you or
whatever this thing is. So I think like no is the you know there's like quite a clear
understanding that like this doesn't work but you know again like what's hardest to make to
figure how to fix it and work together to make it work. So what's friends? I would like to add to
that and straight dive into the CRA issues there. So how to be nice to explain this that the CRA
is within the NLF. New index at the framework. So this is safety it has a safety
you know aspect or it comes from safety and when you look at software security it is like more my domain.
I'm a software security professional. You see quickly that there is something that does not really match
in terms of safety standards and security standards are actually fairly difficult fairly different
spaces and also the way how you think about the needs for safety standards. It's a lot
lot higher than it is for security standards in terms of having one particular way of how
you are supposed to you know make something safe while in security space it's because it's
software so it can be freaking everything. It is a lot more there's a lot more that you might not
even like you know that you can't cover because it's also something that is way more fluid than
then stuff that is in the safety space that is like usually something that developed already over
like used decades and it is not the same in the surface security.
So I focused on something different on our journey to actually get involved. I was like a random
person from get up basically and I want to get involved in standardization and I mean I'm from Germany
I did expect like a fax machine to be involved it wasn't but I had to send multiple physical
letters of like invitation and signed by people before I got access to dean in Germany which is
our national or to court standardization body or something and things where they decided that yes
I'm fit for purpose to be sent to the European standardization process in sand and then over there
I was overwhelmed with I don't know how many meetings do we have 12 meetings per week on this year
A standard everything happens synchronously so I run my own business and I don't have time for that
everything like everything happens in meetings you can't do anything asynchronously and that's I think
doesn't fit very well to the to this ineffirm sick I can't even send a replacement
like this is tied to me as a person and that that I think doesn't work very well I mean we're
doing it now because we want to be involved somehow but I think this is something that should
change because yeah what I'd like to do and I'm not even allowed to do that I'd like to share
the drafts that we get now with like my community get feedback and then basically presented but
I'm not even sure if I'm allowed to share any of the documents so I don't know yeah which is
dumb I'm sorry but this is stupid I mean I'm part of a business association they sent me
and I can't even talk to the rest of the association to give feedback so this is
stupid and I hope it can change it into due course but why we why we have the system we're trying to
work with what we have so I'll add on to that I mean those are those are all very practical
things about participating in standards there is another problem as an open source practitioner
which is the the European standard organizations that send send leg and Etsy all have intellectual
property policies that allow the participants to insert patented techniques into the standard
which they are then able to charge royalties on when the standard becomes part of the law
and that means that far from what we as open source practitioners would think of as open
the resulting standards are closed in every way they are they're closed in the sense that you can't
have free access to the document without subscribing to a paywall and they're closed in the sense
that to implement them you have to negotiate with patent holders for the necessary permissions
even if you don't pay you have to negotiate for permission to implement them and so the reason
that I would regard the system the due jury system that's the official one associated with the law
does not fit for purpose is that in this room most of us are simply unable to implement standards
we can't read them we can't implement them without negotiating with multilateral multinational
corporations and now they are the pathway to the presumption of compliance with the law it means
we can't obey the law either and so this this seems to me to be a fundamental problem
so it's actually very
yes I mean it's a deep experience to hear all of these problems again all in one place
but but so we've started this journey for the cyber resilient act and we now need to develop
this legal harmonized standards and we need to kind of figure out the best way that we can use the
existing structure to make sure that these standards are fit for purpose also for the open source
community and the people who are going to use open source throughout the supply chain so maybe a couple
of of points that that help to soften a little bit the observations that have been made it's not that
the observations that have been made are not true it's that I think they don't necessarily give you
the the full picture so one is that these harmonized standards they should always be product
and so that makes it harder to encode standard essential patents I mean not to say that there
aren't standard essential patents in certain European standards but not for the harmonized
standards they shouldn't be and certainly for the CRA we will be paying attention to that and
we will try to avoid standard essential patents wherever that's possible which in theory it's just
a language game you just have to abstract away from a specific technology and talk about it in a
different language and and here again I think we we we hope and and count on your expertise and
everybody's expertise to say hang on why you're talking about this specific system that is patented
when you can just be talking about it in a more abstract way so I hope that that one's an easy one
to solve and that we can avoid that bitful in terms of of participation I mean it's certainly true
that there's a lot of hurdles and it's a shame that you can't use your position as part of a business
alliance to increase your reach and I would also love if you could do that but for instance it's
and it might be true that the participation is in your own name I think there's no legal obstacle
to you sharing the document within your company to other expertise that you have within your company
because usually you are yeah you represent also a company and so it's not just you as the CEO
of the company it's your company who is there and so you can share the document within your company
and that's you TAP already a small small pool of a smaller pool of expertise that you can tap into
and that's in general I think how most companies who participate in the process to it they have
a standard office or whatever but then you know the the discussion can happen inside of the company again
I'm I don't want to defend an old school industrial model but I think we need to be a little bit
aware in a in a in a balanced way of what it can achieve so that we can make the most of it right now
because right now we need to develop the standards and they're going to be under discussion and
development over the next few months and this process has already started but the people who are here
are some of the people who have actually managed to already get in and they will be able to participate
and I really want to be able to point to them so that you can say few have suggestions for this work
speak to them so that they can then come and put your things onto the table and that was really
again one of the the public citation aspects that I wanted of this panel thanks
I want to comment on that so you know to on a positive note since the CRA came along
many people in the open source community who have followed last and said we ought to try and
engage and and it has been profoundly frustrating for a lot of people trying to do that
but nonetheless the eclipse foundation has joined in and consequently it has access to
sin as a process and if you are a part of a member company of eclipse they would be willing
to assist you in representing the open source community at din and OSI is a member of Etsy
and we have we're in the process of negotiating with Etsy that OSI is able to send any
member of out one of our affiliate organizations such as Apache or Debian to go and participate in the
CRA standardisation activity so we are looking for routes for access to overcome the inherent
bus against access that the legacy system has got now that doesn't mean it's going to be either
fun or easy or effective but at least it's possible and so if you're interested in doing any of
those things do come and speak to me or the who's from eclipse here oh here come if you can
come I mean like whatever whatever the like you know it's still does not we move the fact that a lot
of people do like like seriously 12 meetings per week so for me personally it's just insane
so it is not just because that it is like like too much meetings it is also again like the
how much it needs to like you know and now everybody is there and what you can do as an individual
whatever you are there is still very limited so and I find that very strange process
but maybe to say so I think it's okay so the standardisation request for the cyber resilient
fact is still under the process of adoption hopefully on Monday it will be adopted by the commission
at that point it will be sent to the European standardisation organizations so that they can
accept it or not they have a month to decide we hope me because this all of this has been discussed
so long with the experts in cents and a lack and even with with the organizations also with
XE that we hope that this standardisation request will get the acceptance and therefore the work
can sort of that has already started can finally have you know the official request at the table
but so as this process has slowly become more concrete in the beginning it was very much about
say discussing what would be the right architecture for this exercise we're going to be developing
standards for at least 25 different product categories we also want to kind of horizontal framework
to ensure that sort of there's some coherence in all these different product specific standards and so
what can this all look like from a high level and I think at till now it's been a lot of conversation
but slowly the first documents are starting to appear and I think that's when this work can
get more concrete and you don't necessarily have to be in all the meetings because you can now start
to see the drafts and that's partly why it's so important that there is an entry point because
the people who have the entry point they can see the documents circulating and they can see the
documents in the document area and they don't need to be in all the meetings I hope in order to
be able to see the documents and to be able to provide written comments so again I think that has
been a little bit that experience whilst was true has been the nature of this early stage
which you've started and so going forward I think is going to all become much more concrete
and it's going to be scary for different reasons because then there's a document and you're like
ah this language I don't agree with what can I do but that's going to be an important moment as well
a very concrete in a different way okay so oh so don't go anywhere so this is the boundary
between the panel and the fishbow so the fishbow session is like a panel but it's a panel that you can
be on so if you would like to join the conversation if you would like to come down and stand
outside this box and somebody who is inside this box will then leave it and let you into the box
so that you can participate in the conversation and we're not the we're doing this because
none of you know how to ask a question for goodness sake this is instead of questions okay so
you get the opportunity to come down here and give your short talk and possibly to
ask a question okay so so no need to put it in the form of a question so what I'm going to
do now is I'm going to carry on the conversation and then if you do want to participate you
don't have to raise a hand you just have to politely form a line to to come into the box
down in this area by the door okay and we'll do that until either it gets out of control or we
run out of time