I changed a lot of the talk today because there's been so many cyber-residians act presentations
in the last few days and in particular yesterday those are half-day devourum on the CRA in
practice and so to avoid duplicating what's already been said in those presentations I changed
a lot of the slides and so I hope I'm still within the scope of what I was meant to talk
about so the talk is aimed to be an introduction to the work that we're doing on the cyber-sidians
act and in particular we find that it's easy enough for the larger entities to get involved
and so the aim is to try and get smaller entities to also participate but I didn't want to give
the impression that actually the CRA is going to affect everyone so maybe it should have been
actually a question is the CRA for everyone or maybe it's CRA information for everyone
including smart projects so the other reason I changed the talk is because I've been talking
to so many people in the last five days about the cyber-sidians act and it's really surprising and
you have to be reminded of this constant how different the levels of awareness are and how different
the interests are in different topics and so once again I had to change a lot of slides and this
is a little bit of a mishmash of topics but I hope that's something in for everyone so one of the
topics that you know I generally forget is something you still need to talk about is the timeline
so this is important because the cyber-sidians act was voted on and adopted by the EU institutions
at the end of 2024 and so sometimes the media talks about it's it's done it's adopted
and it's entered into force and then people might look around and say well nothing really changed
and you might get the impression that the cyber-sidians act was no big deal but the the law is
in force but they find for not following the law are not yet applicable so there will be a smaller
part of the cyber-sidians act on September 11 will become applicable the fines for vulnerability
reporting but the main provisions are enough coming in until December 11, 2027 so we're still in the
phase of working out how we're going to comply and then what I'm going to show today is that we're
also still in the phase of drafting the cyber-sidians act so the so that as mentioned the reason
we want to focus on small projects is that the larger entities you know like I work for
it's foundation and we have policy people like myself and we have lawyers and we have you know
people who can work on compliance and then once we have to do this work anyway for the software
projects that we host then it's kind of easy to apply this to the other projects that we also host
so for us we're kind of the the easy case for doing a CRA compliance and what we want to do though
is the one of the roles of code hosting fast foundations is to benefit the ecosystem in general
and to bring you know stability to the ecosystem and so we try to make our materials available
in the way that's most useful for everyone and so what we did is we publish all our information
on our website and then also we went to be further and we created this coalition called the
Open Regulatory Compliance Working Group and that is a place where everyone who has to deal with
cyber-sidians act and that can be people who love open source and it can be people who hate open source
as long as you have to deal with cyber-sidians act compliance this working group is a place to
coordinate and make that work as at least least painful as possible so that's the open regulatory
compliance working group web page and there's a QR code and I'll show that at the end but not
going to dwell on that for the moment so in the cyber-sidians act the the main categories of people who
have obligations are the many factors and students and so many factors and stewards and then the
other category and the other category doesn't really get a formal name but the verb provide
provision or providing is used at some point so we could call them providers of software
and these are the ones that are most likely to be exempt and so I talk about exemption because
when you talk to small entities the the first thing some of them want to hear is you know
I'm anti-exempt or how do I get exempt and the focus is on you're maximizing the ability to
ignore the cyber-sidians act and so you can look into the text and so this is just a
little small introduction to your reading EU legislation because when you look at the text
the cyber-sidians act you have this sentence and says your pre-enopensor software is
only covered when and because of the word only there that sounds like this is going to be
this is the exemption now so what is the exemption? pre-enopensor software is only
covered if it's made available on the market and so that would look like the and then you could
start looking at you know what does it mean to be made available on the market but when you look at
the scope of the cyber-sidians act it actually only applies to software that's made available on the market
or digital products with products of digital elements made available so that's not the unique
criteria that makes free-enopensor software exempt so then you have to go back and then if you look at
well you know there's another part of that same sentence and talks about when projects that are
not monetized by their manufacturers and you know maybe this is the the actual parts that
the differentiates between free software and general software that has to apply this I resilient
and so the point is the word monetized is not really defined in legislation or at least
it's not not clear to us at the moment so making available on the market is a term and I'll come
back to where that can be found but monetized was new to us and so the the point here is that
even for people who've been reading this for you know two or three years you know the words are
not always clear so you might be thinking then well why don't we just ask for some clarity why don't
we ask some to fix this this apparent bog in the text and the issue is that it's not always
compatible with the objectives of the cyber-sidians act to to clarify these things because the
goal of the cyber-sidians act is to increase cybersecurity and so if there's a real focus on
how to get into the excluded category and how to define what's excluded then you know this is
nice because legal clarity is nice but then it also makes it easier for people who are focusing on
how do I get into this category of you know not having to deal with the cyber security act
as I'm a civilian act and so that's you know does not the the objective objective is to increase
cybersecurity and so so it's not something that's necessarily going to be fixed by asking questions
or more legislation and then you know another example is there is a part of the cyber-sidians
act that says that unfinished software is not covered by obligations and so in the early days
we thought maybe we could say that all free software is unfinished because but yeah the the problem
there is that unfinished software is defined as software that's available for a limited period and
that's you know that's not how we make our software available so it's probably not of any use to
us and we've it's been told to us that we probably shouldn't try to use it so so then the the bits
of clarity we do have in the text folks on on these above things the idea of charging for software
or charging for support beyond just covering your own costs and then processing personal data and
that's just you know if if that's your business model around them directly getting cash then
you don't you can't claim to be non-profit if you're scooping up lots of personal data and
selling that later so these are these are the criteria they're again it's not always clear
I thought point the connection has to exist for the obligation to exist you know if I have
ads on my website does that make every download my website I can select so some of these things
are still being defined and one of the challenges is that product legislation in the EU
never generally applied software in the past and so it's all been developed with physical products
in mind and so now we're trying to use all these terminologies that it's being shoehorned into
the software context so the what we're doing to get the smaller projects to be better represented
is that we don't expect smaller projects to be able to get involved and have a full-time person
spending lots of time in and giving lots of attention to this but what we would like is to be
able to raise the level of awareness and make enough information available so that at least small
entities when they see the work that's being published by for example where he gives foundation
or but also other entities we'd like to be able to get feedback and you know here whether this
information is useful is sufficient and you know in general what are the needs of smaller projects
and smaller companies so that we can better serve the needs of the community as a whole
so I had two topics and then I inserted a quick topic number zero so the while we're working on
this I resilient act I kept on thinking about this idea the policy is the new licensing and it's
important because in the free software world you know for 40 something years we always defined our own
legal context because we had our licenses and that was most of the legal discussion and then
small amount of discussion done trade marks and association law maybe you know contribution policies
but in general it was something we did internally and that was nice and comfortable and we could
define the timeframe and then what's changed now is we're getting all these piece of regulation
which impose obligations on us from the outside and this is it's you know on one hand it's
completely new the other hand the timetable is imposed as well so if we choose not to participate
then it's it just means that we don't get taken into account during the drafting of the text so
really we have to change the way as an ecosystem we we organize and participate in in the
development of our legal infrastructure so then getting on to the real part one what I'd like to
talk about is the idea of why we should be in favor of doing more than the minimum so we you know
I started off by saying that people sometimes try to get into the exemption and the idea is that
you know nobody likes to have obligations imposed from outside especially ones that we didn't
like and we might really like the way they're written and so then you know the default mindset is
well how do we how do we get into a situation where we can ignore that and do our own thing
but so I'd like to make the case for why we should try and do more than the minimum so the the first
point is that the smaller projects may get into maybe exempt from so resilience like
however in general I think it's true that projects are largely motivated by having a great user
base and having a large and interesting user base preferably also a user base that pays for the
software let's see the ideal situation and so one thing that we can improve by doing some of the
CRA work even when it's voluntary is that it makes it easier for upstream or downstream to then
use your software and so if you want to make yourself a more attractive this is a good way to do it
and so we can we can do that in our own way but there's also a mechanism in the cyber resilience act
which allows you to get recognition for the compliance work that you voluntarily don't and
the attestation system and my colleague Eva is going to present the details or a proposal for
how that could work in the next sessions or I'll leave the details there. The second reason why it's
probably a good idea to voluntarily do some compliance work is that as I you mentioned at the start
it's not always clear what the words mean and so we may optimistically look at some text and say
nope that doesn't apply to me and therefore you can ignore this but we might find that the text doesn't
mean what we thought it meant and we might also find that you know court cases in the future will
change the interpretation of certain clauses and so maybe it's better to just take a look at the
text now rather than ignoring it and so you want to talk about voluntary compliance this isn't
doing the full compliance the maximum of our cyber resilience act it's more looking into the
various obligations and seeing which ones you would choose to do depending on how interested you are
in making yourself for more usable further projects. The third thing is that we as I mentioned
the European Commission's goal is to increase cyber security so the two things they want are
cyber security and compliance with the regulation. If we have our own system and it gets widely adopted
and you know can be shown to increase cyber security then this will you know tick the boxes
that the European Commission is interested and they'll see that that job is now done. If we focus
on trying to undermine all these obligations and trying to squeeze ourselves into the various
exemptions then what will happen is that we will probably not increase cyber security or not
very much and that just makes it more likely that in the future the European Commission will look
at the situation again and say well our previous attempt didn't work as much as we would have
liked and therefore let's have a CRA2 or some other similar law and so this is the idea that
maybe we should do a form of enthusiastic compliance and actually try and share the objectives
of increase cyber security and this could avoid the situation where we then get follow on legislation
and then the the fourth thing is that we could also do cyber security policy just because it's
a good idea it might so those are the four reasons why I was just that we don't focus on trying
to aim for the minimum that we have a broader discussion of what's the purpose of putting
any effort in and you know what's the the overall outcome of having good cyber security versus
having a system that we put work into and it takes boxes and doesn't really achieve much so
so the idea of slides and the specific obligations of manufacturers and stewards but yeah
as I said there was presentations about that yesterday so those videos will all be online so
I removed those slides but I just wanted to show you know one quick table which talks about the
stewards you know the various obligations and one obligation is for a reporting of actively
exploited vulnerabilities and for this one obligation you then have to check well what are the
relationships between the steward and the software users and the left-hand side you have different
types of relationships and then you have ticks or NA to say whether the obligation applies and so the
purpose is just to show that it's not as simple as it might appear when you hear a summary
and it mentions you know steward have very few obligations well you do have to still dig in and
figure out what are the obligations for a specific case so coming back to the timeline the the other
topic I want to talk about and maybe I'll focus more on this is how much of the CRA is still being written
because this is something that hasn't been covered in the other presentations as far as I know so the
the actual text the CyberZidin's Act was adopted I think I think I've mentioned December
2024 and so that is the that is the law the law entered into force but the law says that to explain
how to comply with the law the commission will have standards bodies draft a certain number of
standards I think it's 41 or 44 and so the standards are for example the you know the first obligation
in the CyberZidin's Act is an obligation that you can you can publish software if it contains
I hope you have the words right no known exploitable vulnerabilities and so what do each of these words mean
how do I be sure that you know when I'm shipping myself where if it complies with this obligation
and so the standards organizations will draft a standard for how to determine this and how to do a
risk assessment maybe as well that shows whether you've done enough work on this and so that's
an example that's a one sentence that will be then explained by a standardization document which
we multiple pages and very practical so there are 44 standards there is a document on just the
general interaction of the CyberZidin's Act and free no resource software such as the guidance
document there is another guidance document on remote services because there is an exemption
exemption from these in the CyberZidin's Act the then there is delegated acts to to find
special categories so special categories are things like if you're making passwords managers I think
there's a special category there and it says you you have a standard for extra security
procedures you have to do and in a way that's more difficult because you've extra
obligations but at least you get a document which explains your obligations so in some ways it's
beneficial so it's not good or bad just being in or out of the category but these are things that
are still being worked on now and this is you know why I'm saying the CyberZidin's Act
the original text was finished but it actually in the text it says we're going to continue
working on these for the next two or three years. Gadestations program as well which I mentioned
is also part of a delegated act that will be developed and then if everyone is happy with it or
if the right people are happy with it a delegated act will be created to actually put this in
place and then the last one is S-bombs and this is a it's kind of a funny topic because it
got so much coverage but in the CyberZidin's Act there's very little about what an S-bomm actually
has to contain it's you know more or less in a lot of situations you could have a one line S-bombs
saying I got this software from that person there however there is a clause and my colleague
Madeline Nague probably in the rooms that were found before you found for him this morning
the there's an implementing act which says that the European Commission can change what are the
requirements for the content of an S-bomm so on one hand we have very little in terms of
obligations but it can very quickly be changed and so we may indeed need all the masses of work
to put into that so then I have to come back on what I said so I said that the CyberZidin's
Act itself is you know finished and published and you know that's you know done and it's
the various adjectives you can use but it's not never going to change again in fact there was
a very important typo in the CyberZidin's Act where the clause that says that S-bombs don't have
will not be find for ignoring their obligations in power routes two through nine
the accidentally wrote three through nine and so the you know this is a typo that still will be
corrected I'm not sure if I have the procedure name corrected a random procedure but more importantly
there is the digital products omnibus and so this is going to do something that sounds like a very
obvious good idea this is for if you don't compliance for a different regulation in particular this
is this two if you don't compliance for that then you automatically take the box of compliance for a
CyberZidin's Act and vice versa it's you know the proposal is more or less it's to avoid
people doing the same compliance you know twice basically the it sounds like an obvious good idea
but at the same time there is then a body needed to verify this has been done and then the
the the competence in some way moves from certain member state bodies up to any you agency and
this of course is not something that everyone thinks is a good idea so you know there will be a big
long discussion about but modifying how the CyberZidin's Act is implemented via the digital
products omnibus and then finally the text itself will be completely and wholly up for review
by December 2030 so by the time we have the CyberZidin's Act actually in place and in full effect
at the end of 2027 we will have maximum of three years of living under that regime before
a review gets opened up to see if it should be changed maybe drastically so the the reason
going to the details of how many ways in which the CyberZidin's Act is still changing is because
this is something that we can still influence and it's something that we can still work with
these underization bodies and work with the Commission to improve how it applies to us and so
again the purpose of this talk is to encourage people to take a look at the CyberZidin's Act and even
if you think it doesn't apply or if you don't think you have the time to you know become an
expert in in the various parts it would be good to take a look so that you can see how it does
affect you or how it could be changed and may affect you in the future so at least you can provide
input so that organizations like each other's foundation who are working on the the legislative
side so we know what what changes to push for what would be good for the FAFSA ecosystem
so then the the third I think is the the final section I want to raise about the ways in which
the CyberZidin's Act is still changing is that even when the text itself doesn't change
there are a lot of regulations that are related to the CyberZidin's Act which will be changing and so
the first one is the Standards Regulation 1025 and so I'm going to go through each of these
only very briefly because they're you know they're all deserving of a presentation or a half day
dev room and so I just want to mention the names really but the Standards Regulation 1025 defines
how the European Commission interacts with the Standards Regulation bodies and so there's Etsy
and the Sincenilec and they write the actual Standards but there's a procedure going back and forth
and you know who who gets involved and who gets to approve or or come in on the various drafts
that's that's just being worked on and that's one of these piece of legislation that's then
it's important for every other file that we work on that includes Standards and so it'll have
massive importance but the changes that I've made there may arrive too late for the
situation with the CyberZidin's Act another one is the new legislative framework and this is the
terminology of product regulation in the European Union and so formally it's limited to product
regulation but it often influences other piece of legislation as well and so this will define
things like you know when is yourself for distributed in a commercial context or when is it
placed on the market these terms that we don't really know how to interpret they will be defined
in the new edge of framework and definitions already exist in the index that text in the
new edge of framework but they're focused on physical products the last thing is the rest of the
world but I'll I'll come back in that in a second so the other side then is that we have
well we've been dealing with the EU institutions for a different piece of regulation for just over
20 years and the you know one of the complaints we had in the past was that they were creating
regulations that would limit or would would affect freedom opens or software without talking to us
and so then in the last 10 years we've been the same to them you know if you're going to
regulate freedom opens or software please talk to us first we surely have some input and so the
good news now is that they do and they honestly listen there are multiple people from the European
Commission in the room right now I won't identify anyone but they are among us so they come to
fast them now this is this is what's changed like this is a huge difference compared to even five
years ago five years ago there were a handful of people from the Commission in the first time but
it was because in their you know they were hubbyists but now this is this is something we are now on
the actual where part of the EU legislative mechanism so it's fantastic that we we're now involved
but we have the new problem then that we have limited resources and we have to try and participate
in your calls for input and you know the various procedures on not just the cyber resilience
act but also the AI act and and the interrupt will you're back to the data act and the DMA and the
DSA and all these different things and so it's some of the we you know we still have to improve
by you know by growing the pool of people working on these topics and then we also have to improve
but by just working on our efficiency and making sure that we're coordinated and sharing information
so
so one of the things that i think is important message and for for a conference like this is that i have
how can people help so funding is always you know massively important but that's a complete
different slide deck i don't have the all those slides so that's not the focus of this presentation
but when people do want to participate in the these various procedures I would say
you know because on one hand you know we're we're really enthusiastic about having more people
involved but on the other hand you know we do have limited resources and so when we're trying to
onboard or help people to get involved you know it does help a lot if people come already prepared
or if people have you know some kind of commitment to actually stay involved
the policy work that was done by the free software ecosystem up until about five years ago
was often done by individuals who took an interest and so there's a lot of particular managers
of you know CEOs who would see something and they say this is absolutely critical and they
work on it for two years and then once it gets finished they go back to their their real jobs
and you know they often did fantastic work but the knowledge they got gained during the work
they did on an entire cycle of legislation then just you know disappeared and then for the next
cycle of legislation we get to start from scratch again so it is it's a very positive thing
that we now have policy people we even a recent years it's growing a lot I think in 2022 we
had three people in Brussels for various organizations we now have I think roughly 11 people
in you know spread across the different organizations and so the everyone else's slides
had a banner along the top which had the logos of all the organizations that are involved
in organizing this devroom that's pretty much the group of organizations that also has people in Brussels
so there are the people that I think at the end of this so the so we're happy to have people join
out we don't always have much in terms of resources for onboarding people but so if you can come
with the you know a bit prepared or at least you're ready to stay involved that's great
in a lot of cases joining many of these organizations like for example the open regulatory
compliance working group for many categories in particular for small entities and for self-referendations
as far as I know joining is free and you know we're happy to have a communication and interaction
with these entities and we're also happy to have logos on the website so we can show
this you know these are the people that we're working with and it shows the the European
institutions as well that we are representing an larger group and we're in communication rather than
just the narrow interests of of Warner or one sector so the I'm just coming quickly back to the
topic of of the rest of the world so this is something that we don't really have people working on
because it's it's complicated and it takes it requires a network that takes years to make so
the the worst case scenario would be if the rest of the world looked over and said this is a
fantastic idea that's also have cyber security regulation and then developed their own
regulation with the same objectives as the CRA however with you know a completely tailored
set of obligations so if this would happen we would have for example 10 different countries or
regions with imagine each one of the 10 different obligations in their law a lot of companies will
then not be able to comply with all 10 laws and then you'll find companies that are focusing on
okay I'm I'm commercializing myself for a Europe or I'm commercializing in Asia and therefore I
focus on you know these these subsets and you know this then means that you're doing more and more
work to comply with Japan and South Korea and India but you're actually ending up being able to
distribute fewer of your countries because if you focus on the Asian countries and some of the
else is focused on the European countries then no big combined those two software packages and
create a you know a larger product because you wouldn't have the the compliance documentation
that covers both regions so that would be the worst case scenario and to to to counter the effort to
reduce the risk of ending up in that scenario this is also this comes back to the idea of voluntary
compliance and even enthusiasm and enthusiastic compliance if we can develop a system that
ticks the box and the CRA and also makes everyone happy that they are working on something useful
and increase inside this security then it's a lot easier to go back to the other governments of the
world and say you know here's a system that really works maybe you can put this into your your law
in general it's it's not pill battle because countries often don't like being recommended to
copy what some other countries don't everyone likes to do their own thing and so we have to find
different ways to convince them that staying compatible would be a good idea and so if everyone
would adopt something similar to the CRA that would be one way of doing it but not everyone
will like every part of the CRA but maybe we can ask other company and countries to consider
it take the bits of the CRA that you do like and implement that and then that that confirms
each country's autonomy and choosing their their legislation but you know we end up with something
that's compatible and we can still do you know one procedure for compliance and then commercialize
and distribute everywhere. A second possibility is mentioned in the CyberZilings Act is called
a mutual recognition agreement and by this we would we could have completely different laws but we
could sign an agreement with for example South Korea say and to say if companies in your country
follow your law then we accept that as also taking the boxes CRA and countries in countries following
the CRA you accept that as taking the box for for your law. I've heard this is more difficult than
it sounds because you then need agencies set up in the other country to verify that the laws
being applied correctly and I haven't looked into the details but it's not just because it's mentioned
in the CRA doesn't mean you can actually implement it easily at all. Then another possibility
would be if we do develop our own procedure and it's wildly popular and effective then maybe when
the CyberZilings Act is being updated in 2030 maybe it could be added into the CyberZilings Act
that you can follow the traditional CRA program or you know this other thing that's working
very well and you know we'll accept that so this is another another way that it could be
be on in a global scale. So with that I'm then I think I've got just five or six slides but I'm
not going to actually go through the details. The reason I put these slides together is to show
the type of files we're working on starting this month and last month. So the European
Commission generally has a five year cycle and the first year I spent on asking people there for
info about maybe should be done the second year which we're now entering is when they start publishing
actual proposals and then we have to do more substantial work to you know create unified positions
on what's a good idea. So stuff we're working on at the moment is does the EU long-term budget
and within that is the European Competitiveness Fund which is where a lot of funding for for the
the Free Software Programs of the European Commission will probably come from. Does the DC edic
and digital commons there's a new and accelerating industry actor to have it looked into and
there's a gore EU for a public sector then there's a big call for input on
open digital ecosystems which you may have heard of and the deadline for that is Monday midnight.
So that is a document to make a strategy for how the European Commission would use free software
internally and also how to support the the private sector ecosystem outside so that Europe gets
maximum benefit from fast. So does that does a public procurement director's cloud narrative
outlet is also public procurement? We have then what's the private sector is the EU chipsack
to the EU quantum there's also lots of AI factories and an interest in wanting to interrupt
but Europe act those from the last three years but once again there's a there's a council and a
community and we can participate in it if we can find people to take the time to do so.
On AI there will of course be a new legislation. In implementing the AI act will be
quite quite difficult it's not it's comparable in many ways since I was it in fact but
there will there could be a new legislation on AI liability which has lots of interesting
questions and then there will also probably be a revision of the copyright directive and that is
probably going to turn into a talk of war between the technology and the culture sectors
about whether copyright should be able to limit the development of AI models. That would be big.
So then on mark and regulation and security we still have implementing the Cyber Zealand Act
we have the Cyber Security Act is an interesting one that was published two weeks ago and so
this will deal with things like supply chains which are always complicated because
a lot of legislation considers supply chains in a very traditional sense which are kind of
unidirectional but in the free software context we often have supply chains that
or people downstream can become the suppliers or the customers of people upstream and
people end up looking like they're in supply chain without even realizing that the supply chain exists
and so that's a lot of work we have to do to ensure that these piece of legislation are
you have a sense of outcome when applied to free notes or software and then there's just
I wasn't able to categorize everything into five categories so then there's still the
as mentioned standardization regulation the digital networks act and an expert group on
encryption. So that's the new wave of legislation the massive amount of work that we have.
The work that we did in the Cyber Zealand Act was very useful because it helped us to
to realize bit of urgency and to convince some foundations and companies that they need to have a
policy personally to engage in a sustained way and so as I mentioned in 2022 we had three
people in Brussels there's now roughly 11 so as I mentioned the the other slides have five or
no so they've got nine or eleven logos along the top and those are the other organizations that
are also doing fantastic work on all these topics and so it's it's very much it's a it's a group
effort but it's also it's a group that's growing visibly by the year. Most of the work that
e-tips is doing on Cyber Zealand Act is for the open regulatory compliance working group so this is
the website and QR code for small projects as far as I remember it's free to join we would
be delighted to have your input your feedback on whether the work we're doing is as useful as we
hope it is for you we'd like to hear more about what needs are of small entities and how we can
possibly interact with your being commissioned and other agencies to encourage them to help
in a way this is good for everyone but in particular smaller entities. With that I think I've got
two and a half minutes if anyone has a pressing question thank you very much Karen I have one question
theory how's that very good like this how's the CRA applying and helping a maintainer which is
not backed by organizations and is software or software is widely used the CRA is effectively going to
block that software from being used by organizations isn't it how can the because my question is how can
that maintainer comply to all those security regulations. Well generally the maintainer won't
have to comply if the if the maintainer is not part of a company that's commercializing then they
probably won't have to comply and usually the company that is commercializing hopefully they will
have the finances to be able to work on compliance but I see Simon seems to be
okay I've deployed an expert on that one for you excellent yes thanks Simon you could probably
you could do one more yeah no one of the back ones need to run up there no I think you're done
we don't have a question but I want to add to CRN's message we want to know can do to help you
I'm working for the ORC League to produce training materials that will be freely available
on the topic of CRA if you have any ideas or questions or things you need in your
organization please tell one of us or team over here thank you