All right, so we continue with the server resilience act, and yeah, so focami, which I
in me will tell you in the next 20 minutes, something about our learnings from the
regulatory process, and we will go through some wild slides, and show you what we learned in
the, basically, last one, two years on this, and what we, or how we can reuse this information
for upcoming slides, upcoming legislation that is of importance for us. We do a bit of
like karaoke here, and as Carlos, the very first, a widespread, and I mean, it's important
for you to know whatever you see here, so this is sort of like, yeah, downscale to make it understandable
for you, so it's a bit more complex in reality, basically transformed into a policy debate one could
say, so it gets a bit more concrete, we start to talk about clear text, so we get a proposal,
discuss this proposal, we get wording, and we can discuss wording, we can discuss commerce,
we can move text up and down, and so with this, we basically, yeah, start, and this is
important for us, a process in the institutions, and basically, yeah, finally, come up then at one
point with something like what we call now the several resilience act or a file, which needs to
be an implemented in a certain time, let's say, two years, and this is basically the very
interesting part, so this is basically, we are now, so we are basically, so we got out of this
heated part here in the middle, and now I have a, have a, have a text here in the, in the blue part,
and now we start with implementing all of this, and this means we read the text again and try
to understand what we really do with this, so, and that's the fun part, since there are, I mean,
we already had some insights, but also many open questions, and these open questions will remain for
a certain time, basically, until we finish the implementation, and then we will still figure out
that there is still issues, and this is then the evaluation, and then we start again, so, and this
is I'm going to hand over to the next fun slide. So, yeah, that is not meant to overwhelm you,
there is just, and the main idea of that talk was to talk about what do you need to understand
complex things, and what helped us to navigate this, and what, that whole thing is here,
is it? So, what I did was I went through all of the those years that I kind of came across,
mostly from questions, from our members, or from, from, from another community, and,
and how it does that relate to open source. So, the first thing I did was, looking at what
law uses the term open source. So, and what you see is, there are three here, that is,
this is here, the AI Act and PLD. You see, the NISTU directive, you see the Cyber Security Act,
and the managed service, managed security service directive, and then you see here,
either, and EHDS, and then the thing in the middle, that is, into operator Europe.
So, so now we know these are things that are all like open source, and now the question is,
how does that relate to any what we do? So, since we focus on the CLA, so what is the CLA?
If you look at this picture, in whole, what you see here is that the CLA is not alone. It's not just
a standalone law, that, you know, it's disconnected to other things. It has a connection,
and that connection is the way how it's built, that is built within the so called new legacy
of framework. That is a nice, nice history in itself, but just to to to explain what the
how it actually trickles down into those years. So, CLA, AI Act, PLD, are the kind of software
regulations or directives that apply to products with digital elements, they do not necessarily
apply just to software, that is a little bit of an interesting discussion there. Then I left out,
for example, the machinery stuff for now. But what's important is the, the standardization regulation,
CE is an own, own, own directive, collective actions that's relatively new, that is also part
of the CLA, and then the market surveillance regulation. So, that is everything about how
the national authorities can like use their market powers to either investigate or to remove
products from the market. The other, like, and while this is NLF, and actually like, you know,
European product regulation, and that also comes with the understanding what a PLP, PDE's or product
with the digital elements is. Do we want to go into the nitty-gritty details of stewards already?
Okay, no. Okay, so I leave that out. But yeah, however, there are also other laws that are mentioned
by the CLA, in one form or another. So, either it immense things or it has carved out, for example,
you see here NDR and IVDR, they are medical devices. Medical devices do not draw their
conformity on the market from the CLA. That is what the CLA says. You know, these products do not
show conformity over the CLA as a process. The same is what's cars and planes. But other products do,
for example, those who are explicitly mentioned, and also from EHDS, electronic health record systems,
were also amended into the CLA just, you know, now by name because now the CLA has actually
a reference number. What is also in there, NISTU and the Cyber Security Act, NISTU is for
the database and for the vulnerability and incidence with an R reporting and the CSA is basically
for the certification of products. And these two relates in terms of NIST entities should
preferably use things that are certified, but at least things that are compliant to the CLA,
so that show CE for, like you know, as a product for what they do in their work or in their network.
I think I'm done with it in the moment and now we move to the next one.
I'm Michael from the market surveillance of the BSI, Germany and in this view, we see how different
stakeholders interact in the CLA and there are a lot of them. Luckily, not all of them have to
interact with each of the other one. So if you have a look at the open source perspective,
we do have on the top left the open source component, which a manufacturer can integrate.
At that moment, the manufacturer takes the responsibility for that open source component in his product,
which means, for example, if there's a vulnerability in that component, the manufacturer needs to find
the way to fix that vulnerability and then, as said, by the previous person, he needs to contribute
the fix back to the open source project, which developed the open source component.
Then, we also have the stewards and the purpose of the stewards is to support the development
of free and open source software, which is intended for commercial use. With that, in the CLA,
there are some obligations for the open source stewards. For example, he has to put in a policy
for the development of secure products with digital elements and he also has to put in the
policy for an effective vulnerability handling. He needs to first store the voluntary vulnerability
reporting. He has to work together with the market surveillance on how
the risk the cybersecurity risk can be mitigated and how that to maybe find the way that
everybody can work together and get something good out of the CLA.
So, then, do you have questions?
No, I mean, really, we also have another Q&A session afterwards, but I mean, I think it's
we're going to ask some questions. So, there we go.
So, what's the difference between an up-and-so-sporjectness stored?
Okay. So, in general, in general, is Stuart. My understanding nowadays, since I have
sent it in a little bit different, I believe that Stuart is not very helpful, as a concept
in the CLA, because it makes stuff extremely confusing, because the LLS is very clear.
We have products. Products you put on the market. If you have, I don't know, the open SSL library,
that is not a product. So, the question here is, how do you actually, what do you need to do
in order to make that a secure aspect of a product? It is not in scope. I'm very, very sure about
this. But a product, like a project itself, it can be called, it can just be text, it doesn't
even need to be something functional. A project is a project. Stuart is the idea that you have a
structure that maintains certain aspects of it either, just a distribution or the development
or maybe just a security of something. That is more, I would see it. It's not, oh, I'm a
manufacturer or I'm a steward. Usually, you are a manufacturer or just a maintainer and maintainer
do not have obligations this year. If you choose to be a steward, you choose to do something that
means I don't need to comply, but I want to. I want to have more obligations that I really have,
because I want to offer something in order to be interesting for the market. That is a whole
point. The difference between, do I choose this SSL library or that SSL library,
because of the different type of, you know, whatever is behind it, that I need or I want to have
for my product. The question then is, how can we use the steward to get something helpful out of it?
So the manufacturer has to comply and is responsible for all the open source components he's
putting into his product. Small, medium businesses, they might don't even know what open source
product components are in their products right now. So from the perspective of I, as a manufacturer,
then have to fix all those vulnerabilities and all those problems, I might not be able to do that.
So then there are two ways to counter that. On the one, one option is he's putting pressure on the
open source developers who don't really have the obligation to do something, but I mean pressure
can be quite high. And the other one is I don't use open source components, because if I buy
a certain product, then the commercial product, then the one who's manufacturing that one,
also has to apply to the CIA, and then I can shift my responsibilities to that sub party.
With the open source steward, there might be a way that the manufacturer can't put pressure
onto the open source developer, but he can interact with the open source steward,
and then the open source steward might be able to provide resources back to the open source project.
And that are things we can talk about right now, because it's not written down. So there needs
to be guidance on how all of these stakeholders interact, and we right now have to chance to
define that guidance and try to get our source into that. So there might be a way that open source
steward can be helpful.
Just quickly following up on that question, I'm all confused, because I thought that I understood
what an open source steward was from perspective of it's an organization that provides governance
of some kind for open source projects. So if there is a library or a tool that is being developed
in and then the by maintainers and the organization that provides governance is something like
the Open SSF or the Open JS Foundation, then that foundation is the steward. So am I wrong about
that? You are a human autism, but who determines that? That's the first thing. Who's
like do you declare yourself a steward or like you're already in the second part of the discussion?
That is what they're actually going to discuss later, but there is, I think there are a lot of
misconceptions around the steward, and it is very clear why it is so like such a misconception,
because many people don't understand that it is a market regulation, a market regulation,
something that built up over 40 years, and after 40 years, the the legislator introduced in
new market actor that is actually derived from something that used to be the work of voluntary,
no volunteers. You cannot just chew on them into a regulation that addresses exclusively
a certain actor in an internal market, you have the market rule, it is not this or it is
not in a like the security here is just a product rule, not more or not less. So and the steward
it is only like it is kind of a wild card where you can solve certain problems that may or may not
be like you know not, not so, but in any other way. For example, when you have let's say a product
or like you are not a manufacturer because you don't put up on the market, but what you put out
has marked like a product product like properties. And the point here is a different between
steward and the manufacturer in that regard is I guarantee you certain properties for that product,
and if I monetize that then I'm a manufacturer and if I don't then I'm not this is how I see it,
it's a little bit more complex and just saying oh I do governance. And also the other thing is you
can also as I said, I believe the steward for certain aspects, which means for example I say okay
I'm whatever we only do a certain aspect of what is required or wished by manufacturers and we
had to actually implement that. And the last thing I was leaves steward are very useful for
example in a sector context so that you have manufacturers in the same sector that think about how
they deal with their common supply chain. Their manufacturer is a very, very powerful actor actually
to get like you know problems done that you have in a certain area and this is where a lot of
security I believe can come from you know in order to you know like yeah make sure.
Maybe to add to this so I mean that's go back to the first slide and so the idea to come up with
this hybrid resilience act was basically we had things like this look for take case and then we also
figured out ah maybe a better idea to put pressure on these two people. But how do we how do we
make it happen that they can contribute to security and if we flip it right we can make manufacturers
like supporting stewards to help them so and there needs to be in the action and I mean in the
in the first part of the double resilience act it was like the commercial activity which was
the threshold and then we figured out that this doesn't work for the open source community and that's
why we came up with the steward thing so and that's why we are and also as I said we are still
writing a lot of things so there is still a lot of things that need to be written so and and this
is happening now so and your question will be defined in the next year I'd say.
One thing that you can do to help us as moderators is if you have a question and raise your hand please
don't lower it again because then it's difficult to find you and it's also some kind of a selection
process how urgently you really want to ask the question so.
Well I'm that note I have two questions if you may. So right now it's a little bit health confusing
what it's all about and my question is now how much how long do you think to
fine tune all this so it's becoming more clear what everyone's roles and responsibilities
and following up on that on roles and responsibilities you impose actually with the CRA a lot of
obligations to several of these parties but do you offer also any assistance in achieving those
those goals otherwise it will become like a dead letter or legislation because you scare people off
in actually contributing to this you say like for example a this this person we need to put pressure
on to fix the security vulnerability but they have no obligation to do that how do you
will positively achieve this yeah so guidance and there's the timeline.
I mean it's like most most questions are like you know we offer on software so they are a million
answers to this there's not the answer. I mean like there are very many like you know entities
that produce guidance one one part will be the expert group of the commission then there is
all then the open one is F there is like and then like the project themselves very likely for
whatever is there the question is here who helps them in effectiveness and who helps them as
MEs it is like where I believe read the biggest questions are for the because they have the most
headaches but but yeah that is like so and for manufacturers the actual guide is going to be
the answer and speed to five years and call blue guide timeline so yeah we run a little bit of
time but so the the part from the first that was very empty at the end this part here so I
started to think about or like we actually started to think about sometime ago what that actually
means if you want to if if so the question that that needs to be answered is what is the impact
of that regulation on the ecosystem and that is not something that you start to answer in 2030 or
something that is what we have to assess now and everything that is going on there you know like
ultimate the ends here or like in two things actually the one thing is the question here that is
like the the time when the CMA will be up so yeah but it will be renewed and this is a moment
like latest where you we also can now put a lot of pressure on the commission
okay twenty nine twenty twenty nine is the latest moment to do a hard pressure I believe
okay and after this session to something completely different yeah thank you all
you