This is in the panel on could compliance costs, sustained open source, a theory of voluntary
attestations under the CRA.
This is about Article 25, where in the Commission reserves the sort of delegated acts,
they describe attestations as a mechanism for open source, maintainers, developers,
stewards, et cetera, to provide something that helps the manufacturers have a reduced
cost of compliance, which is effort of compliance, with the presumption that the manufacturers
are then going to help support the open source community maintainers, et cetera.
And then we've all been discussing how to do that.
We have a, I'm able to black a former open source policy lead at CISA in the US now doing
consulting over here, and with good angle line.
Yeah.
Hi, I'm Michael.
I work at the BSI in Germany, the Federal Office for Cyber Security.
And when I started three years ago, one of my task was to give some comments to the CRA,
and from there I evolved into standardization, market surveillance for the CRA, and also
doing some stuff around open source, and so I get to see our real open source as well.
Hi, everyone.
My name is Greg Wallace.
Oh, thank you.
And I've been involved in open source a lot of different open source projects from independent
ones to corporate back ones to foundations.
And really, I'm involved in this working group because, you know, for me, open source
is really one of the most beautiful and important expressions of human ingenuity that we
have experienced in our lifetimes, and it needs to be protected.
And so, okay, thank you.
So that's why I'm involved in this open source sustainability is really under pressure right
now.
And so, I think that if we work together and collaboratively in this working group in this
ORC and bring all of our ideas together, I think we can come up with really good solutions
to the challenge and make open source more sustainable, which I think is a very important
infrastructure.
And good afternoon.
Thank you.
This is a, I'm Tomas Bernewan.
I'm one of the policy officers in the European Commission that is working directly
in the CRA implementation.
So I normally hold the pen on a lot of the guidance documents that have been published and
that will be published very soon, and that will hopefully also ease some of the concerns
that we've heard in this past couple of days of Fossil.
So keep my question as for you.
A little bit of a hot take answer to have you like, do you think this concept of voluntary
security and the organization will benefit or burden open source communities and maintainers?
Yeah, so, I think in the earlier part of the most of you listen, that there was the sentence
that ended up in the international security strategy of the US, and where you say that we need
to make sure that the burden is on the manufacturers and not on the open source developers.
And that's exactly what the CRA encodes.
There is no obligation for the developer to, in most cases, to do really anything.
But the reason obligation for those who take your project and put it in their product to do
what the CRA calls due diligence.
So to make sure that they know what they're putting in and that they have assurances
that what they're putting in is secure.
So there is a natural incentive for manufacturers to invest time and resources in making
sure that the projects that they rely on are adequately maintained and supported so that
their due diligence is simplified and made possible.
So that's really the starting point of the voluntary manifestation mechanism that the commission
can put forward.
And we want to make sure that it's something that doesn't burden.
That doesn't the manufacturer, I mean, if they come and ask you, so that's really when
we're coming from, and that's what we want to achieve, apologies.
And to do that, we want you to help us, because we want to make it right, we want
to make sure that it works for you and it puts resources back to you to make sure that
you continue to develop into projects and maintain them actively.
So yeah, I really think that it's a great opportunity on paper at least, so we need to make
it right.
Yeah, I think this is all a good example of what the last speaker was saying, the community
has a chance right now to get more involved and speaking with the public sector and here
it is in process.
So with that, question to Michael, how we do it?
So some coordination law, but when that is passed, we are the market surveillance for the
CEO.
So can you talk a little bit about the function that you're probably the best person that
I know to talk to, how does an MSA interact in the context of open source and compliance
with the community and with manufacturers?
Yeah, so the thing is that a manufacturer can put a product onto the market and with
the CEO market or on the European market and with the CEO market, he attests that his product
complies to the regulations and it's not just the CIA, there are a lot of other regulations
he has to comply to.
When the product is on the market, the market surveillance has then the opportunity or they need
to check those products and see if they are compliant to the regulations.
So what we will do, they are like to raise to do it, we can sample certain products and
just in coordination with other market surveillance on the national level and on the European
level, decide on products and product categories, take them and see if they are compliant
and there's also a reactive mechanism that if somebody says that a product might not be
compliant, then we also take those products and check if they are compliant.
If they are not compliant, then the first thing would be that we try with the manufacturer
to make that product compliant again and that can go to the way that market surveillance
can take products of the market of the European Union and can be very costly because
there are eye substantial fines for manufacturers if they are products don't comply and
if they did a lot of damage on the European market.
This sounds really interesting to me as someone who has done a lot of open source developing
and sometimes hacking on things. If I found a manufacturer was using my open source projects
but they clearly modified it in ways that fix the vulnerabilities and never share those upstream
is that the kind of thing I'd call the NSA for? Yes. Wonderful. With that to Greg,
I think you did a bunch of work with the 3BSD project back when I was at CISA to figure out
how to do attestations issue them and you built a collaboration with manufacturers to do exactly
what to also and Michael are talking about. Can you tell us about that?
Yeah, happy to. One of my previous jobs was at the 3BSD foundation and my job there was to work
with the downstream commercial users. Also with the community but principally with the downstream
commercial users. When CISA was coming up with the policy that Abit described earlier,
it included a mechanism for open source projects to work with the companies that use their software
to basically help them be compliant. So I sort of went to my colleague who's a director
of technology at the foundation. I said, hey, what do you think about this? I looked at the
attestation form and it looks like this is all stuff we already do. Would it make sense for us
to create a program where we basically add this as a partnership benefit. So if you partner with
the 3BSD foundation at any level, right, and the entry level was $10,000 US dollars, you would get
access to this attestation. And my colleague Ed said, well, that's interesting but let's first
talk to some of the companies that use 3BSD whose products are based on 3BSD and asked them
what they would it help you. And so we did. And so these are very large technology companies.
And we said, if we gave you this, would it make your life easier that we're already involved
in the project already donating to the foundation? We also though, and I'll wrap up quickly,
we also went to donation to the foundation and we said, hey, you know, we've got this new benefit.
And I will tell you that the advocates for being involved, right, the champions for 3BSD
in those manufacturers, it was a great thing for them because it gave them something that they could
take to the bean counters, right, and say, hey, you always wanted to know why we should contribute
to the upstream open source projects that we use. Here's a reason. And it was in their language,
right? It's sort of something that they could say, oh, I got it. That's, you know, going to help
us with our compliance. So yeah, we did do it. And I was really happy with it. And I think that
with CRA, it's another opportunity to do something similar. So I'm hoping that through this
working boat that is leading, we can come up with something that can be really scalable and
replicable across the industry. Thank you. To rapid-fire questions, first for Michael and
then to Masso and or however you both want to, do you agree? Do you think manufacturers should
really care about these organizations? And what do you think about open source projects that
don't have a foundation, don't have a legal entity, and by the current text as I understand it,
wouldn't have a steward? Would they also benefit from this and how it manufacturers engage?
So first on the point, should they care? They are responsible for everything in their product,
including free and open source. So they should care. Now they have to, they have to do
due diligence. And if the agitation is something which helps them to easier comply or show compliance
in their products and if that's something which makes it even cheaper when they have an agitation
instead of doing the due diligence and other stuff themselves, then I think it should be a
business decision for them to use it. So just business and capitalism and why not use that
for the advantage of open source? Yeah, I mean, on should they care? Obviously, if we
agree with Michael, I mean, not only should they, but they have to. They're legally required to care,
but I think to your question on how do we address the developers that are not really incorporated
into foundation. I think where we're coming from, it's very, very important that this
attestation project works for the big foundations, but especially works for the small projects.
The ones that are so critical, they're critically understuffed and underrefrersed.
And so the mechanism needs to cater, needs to be designed with the small developers in mind.
And to one of the points that was on the on the slides earlier, will this trigger
commerciality considerations? Like, if I give out an attestation, will I become the
manufacturer of that project? I mean, I cannot obviously commit the commission as to an interpretation
right now, but it would kind of defy the purpose of the attestations if that were the case.
So I think we can be quite reassured that we will make it work in such a way that the
maintainers really can leverage this on a voluntary basis and use it to get resources, to get better
maintenance for their projects. And that also integrators will be happy for it because their
due diligence will be easier and simplified. Now, you both said that you think manufacturers should
or must care about this. A lot of the manufacturers I speak with, especially in behind-close
doors, they don't seem to be taking s-bonds all that seriously, even though we're, I don't know,
six, seven years down, journey of s-bonds. And so, so what do you, what do you think about that?
Are many factors going to be ready for this? Then you'll be really good.
So, should they care? They should care. And the CIA states or essentially requirements for the CIA
it stated that manufacturers need to provide an s-bonds or a half an s-bonds at least top level.
So, they might not have every components in the s-bonds still, they're responsible for
everything in their product. So, even if they don't have an s-bonds and they don't need to
provide it publicly, they need to show it to the market surveillance if they requested.
Even if they don't have it, that doesn't mean they're not responsible for the stuff in there. So,
again, they should care. And they must care.
I'll just briefly comment. So, in the European Open Source week, I attended the
open source software compliance and tools workshop that was put on by about code and a number of
others. And what came out loud and clear is that the s-bonds and other tooling landscape is
pretty immature right now. So, it's a critical ingredient to making everything work
but the consensus seemed to be pretty clear that the tools have quite a ways to go before they are
actually going to do what we expect them to do.
Maybe just to other words, that I mean from the commission side and also our
the European Union agency for cyber security is also supporting us in the reflections of
S-bonds and of course, we are aware that special, traditional sectors as bomb uptake is a bit more
limited and so it definitely there needs to be a path towards better integration of S-bonds.
So, it's not something from tomorrow, it's going to be perfect but there's such an essential
and critical tool for vulnerability management and for everything that is in the CRA that I mean,
the future can only be moving in that direction and again, yeah, so not only should they care
because they're legally required to but because it really makes life easier.
Great. Another question to any or all of you, this week at Faustem and the events before Faustem
there's been so much talk of digital sovereignty in Europe and the essential role of open
so these hopefully for European digital sovereignty, do you think this concept,
voluntary security administrations, has any relevance or essential role to play in encouraging
growth of this European sovereign tech stack? Regardless of what it is.
Yeah, maybe it's good looking forward.
Yeah. So, yes, I mean this has been talked about so much and I'll maybe not directly answer
your question to you of it because it's a little bit not super directly related to attestations
but but I do think that open source is digital sovereignty.
You know, I had a mentor when I was at the Linux Foundation
who would say that open source is a dueocracy. That means the people who do the work get to
make the decisions, right? It sounds obvious. So, if any organization, any institution, any group
of countries wants any open source project to do something different than what it's doing now,
there's a really direct simple way to change that, get involved.
And if you can't get it to do what you want for whatever reason and this happens all the time,
you fork it. It's really that simple. So, so I think open source is digital sovereignty.
I guess the last thing I will say on this one is there's also a lot of talk about open source
procurement and I really don't like that word because if all you're doing is procuring open source,
you're missing out on the biggest benefit which is internalizing expertise.
Because if all you do is procure open source, you won't really have, you won't have as much sovereignty
than if as if you have the expertise internally so that you can maintain that software internally.
Maybe from my side just to say that, of course, this CRA does not directly address these
discussions because it's a technical type of legislation so it doesn't really concern itself.
We're sovereignty discussions. I don't know personally, I haven't really made up my mind of
whether the attestation itself should be a tool around that but what I can definitely encourage
you if you have thoughts about it is the heavier sake consultation that was shown earlier
that's really it's the commission that has put out a call for evidence reflecting exactly around
this topics and I saw that there's already a lot of input that we received so a lot of work for
as and the team working behind it but that's really the chance to indeed maybe try and
tie all these topics together, the attestations, the CRA and more general sovereignty considerations.
Then I guess I have one more question for all of you with ARCs. If all of this goes well,
the CRA implementation goes all according to plan, attestations eventually have a mechanism
that is defined, what do you see as sort of what will be achieved in the next five to 10 years
and any other thoughts you have on the topic and then we'll take some questions from the audience
after that. Well from my side I really hope that you know a part of the fact that everything
goes well that in five to ten years we will look back and we will see that a lot more of this
critical tiny blocks that support the entire ICT ecosystem have more people behind it have more
resources they don't have to rely on just one random guy that does it how to goodness of his heart
or her heart but actually gets supported to do it so that would be really the big achievement
aside from better security for those thing integration but for the open source world if we can
really achieve that I think it will be the CRA would have done its job quite well and probably also
you with the attestation program and all of us together working on it.
Yeah I don't have much to add to that I think you know this is a great opportunity to
up level security across the board and I you know security cost money it doesn't matter what type of software
it is that you're making and so independent maintainers in particular but really all open source creators
need and should get support to do that work it's important work that has to be done and I think
CRA is a really great step in our direction yeah and I hope that the CRA helps that manufacturers
take more responsibility about the things they put into the products and a lot of them already do
but for some might be a bit more they need to do and that they realize how open source helps
in their products and then that they also realize it's a good idea to support the open source
community so that they can do better even better open source and then the products itself also
will get even better so we get winning side on the manufacturer side they can integrate easily
all the open source they want and the winning side of the open source community they get more
resources and more funding and more vehicle condition by the manufacturers who put dust off
and their products right so I want to thank my panelists and then we'll take a question we have
about 12 minutes I think and the questions so thank you all for joining me
and feel free to direct your questions at the panelists or me since I didn't take questions on
my presentation earlier as well I saw hand hand hand hand roughly in that order so I guess
no third night great shouted out I'll repeat it back for the for the audience online
so that was that was not a question but a compliment directed at Greg and the
VBSD net BST community of which I only understood about a third of it so Greg if you want to
summarize this yeah so I'll ask the small of it in some potentially many cases an
organization's core competency is very different from the open source and so there's an opportunity
to do both to have some internal expertise around some of the open source or maybe
some level of internal expertise that's more shallow across all the open source so it can be a mix
of approaches including having some vendors that that you know come in and bring their expertise
yeah great so they had a question on the right side and then two questions on the middle
and then a front so we have four in the queue still shouted out and then I'll repeat it back
and try and keep your question short and only a question so we can get through all these in 10 minutes
do you see any way if you need that over yeah I mean it's it's a question first
I'm sorry I need to repeat the question the question is that according to the gentleman
open source projects in Europe are less accountable than open source projects
particularly in the US because the legal framework allowing for incorporation
informations and similar things is different and it's yeah it's obviously it's a recurring
question and some of the ever often talks about as well and she also mentioned it in the previous
panel I mean it obviously as you can imagine it depends a lot on national lows there is limited
competences at the U level to change that because it depends on how the different member states of the U
define the that their tax treatment of of not for profits we will of course also start to
reflection together with the attestation projects to see how to make it work and not be
compromised by the fact that the foundations themselves maybe cannot charge for
attestations or stuff like that yeah I'll add to that I think accountable may not translate
as well into my model of these things but certainly engaging with the market is quite different
as as to also was saying it's it's still really unclear from our research how to
generalize these principles across each of the member states of the European Union and
their local tax laws and business laws there's differences between them and I would hope
there can be a global solution to this but I also don't know what that would be either so
we had two questions in the middle nope nope they were a pathway if they're gone then
nope oh you you came down okay it is you wait go ahead
I don't have any theater background so I need to need the mic so first of all thanks for
great presentation and great panel now we know much more about attestation actually this is
not the question it's the same as black so in the same way as as we understood that the community
will benefit hugely from ever's work on attestation we also recognize very recently in
in operator compliance working group that the community might benefit equally from a better
description of what the manufacturer offers of dual-relitms is and we heard from the presentation
and from the panel that dual-relitms came up like many times so they are sort of a sibling
papers I would say and this is the invite for anybody to join the fund on the dual-relitms
as well thanks thanks Timo to the recap I think Timo was inviting you all to come
participate in the eclipse ORC working group yes yeah great cool we have another question up here
you understand the mic because you're right here it's an easy thank you thanks for the great
talk from my side also open source is developed in open ways so all the information about the
development of the resource is already available publicly can you share some of the examples
what the open source projects could give for funds so what is the information what they could
give as the attestation for money for the manufacturers I see okay first I'm going to
respectfully disagree there are plenty of open source projects where some aspects the development are not
open during the open stack projects I used to to be on the technical committee and do a
much of work there we coined a term a corollary to the four freedoms of open source the four
opens of open source development yes the source has to be open but also the development process should
be open the roadmap should be open and the community should be open to anybody with those three
additional components I think what you're saying is true and then it's very easy for a consumer
of the open source or a business or a government to look at not just the code but also all of the
other artifacts and make a sound assessment of the product health and safety without the other
three opens with just the code that's really difficult but I think your question at its core was
what else can an open source project give that help the manufacturer reduce their compliance I think
for that I'm going to turn to the market surveillance authority manufacturers have to take care of
the product for the complete life cycle of the product so there will be a support period and they
have to fix vulnerabilities in that support period if in an open source component they integrated
vulnerability devices they have to take care and mitigate that so at some point might be a good idea
to go to a manufacturer if they can and ask if they can help manufacturer don't have to do it if it's
just first then they have to find some other way to mitigate it but that could be something
which open source developer could provide if he wants to and it's the institutions of
the manufacturer for the company to increase we have five minutes for any remaining questions I saw
hand hand hand yeah for four minutes five or four questions five minutes rapid fire just like
really compressed your question we can't hear you down here sorry
I'm sorry I didn't fully you're I'll repeat it okay I got it what happens if a
foundation stands up and does this and provides some sort of an attestation and then a manufacturer
comes forward later and says they got the attestation somehow but never paid for it what do you
do to make sort of make sure or manage the relationships between the the foundation and the
companies okay thank you thanks great question so that is a great question and I think that
that's an area where we as a community have to do some work the way that we tried to approach that
was sort of the honor system right we when we did it at the free BSD foundation
for the sister regulation using the SSD F attestation we basically just signed it right so it was signed
and each one was each attestation was unique to the manufacturer we didn't use that term but
the manufacturer that received it right so there are much more sophisticated ways to solve this
problem we do this all the time today with you know encryption mechanisms and things like that and I
think that's what is probably going to be the easiest but I think it's it's it's it's a really great
question I don't know that it will ever be a hundred percent solved I mean there's always going to be
people who would rather go to great lengths to avoid this than and you know but I think if we can solve
it for the 80 20 I think we will be in a good place it's an extra question and I think that's
really where work has to happen or on mechanisms like that I've seen at this point just to final
comment on this in the technical question I've seen a couple other folks in our our working group
proposed vastly different models for how to address this it is really an area where we all do
need to work together to figure out and and there may not be one answer there may be different
models that work for different industries different sciences of of of stewarder projects don't
know yet so please bring your ideas to the work there was a question on this at the room shout it out
some people to be very good in front of the main activity can you say a little bit about why
I think I might know the context of what about your asking I'm not going to point at it and
the question was some people out there seem to be quite opposed to the idea of voluntary security
organizations even though they're written in the CRA and and you know this is also had a program
like this several years ago and the ideas out there plenty of manufacturers already do this with the
open source in their products I think there might be some opposition to a diversity of economic
models to sustain open source some people really like their model and don't want to change it
I don't know might be other reasons, but yeah, not just on the comment on that next question
Sure
I'm going to repeat that now because excellent question the the separation between manufacturer
and steward in my slides seems to be artificial there are plenty of companies that seem to be both
for example Google with Chromion this is an example we've talked about in the CRA implementation
and just policy discussions for years so I'm going to connect over to Samantha
Yes, I mean the series of product specific legislation so what really matters is the individual product
or project and that determines your legal entities role with regards to that specific thing
so you might be a manufacturer for the thing that you commercialize and you make money out of it
and you might be a steward for the thing that you open source and you let everyone use or you might
be nothing if there is something that you're not really placing on the market
I mean a man who fact somebody who is making money from something likely would qualify as a steward
for the things that they open source so I don't really see a scenario where they're nothing to
affect project but they might have caused something for hobby purposes and in that case they would
be nothing to the project because it's not covered by the scope of the CRA so yeah it is possible
to have these multiple roles depending on the individual product slash project that we're talking about
That seems like a great place to end because we also just hit time so thanks for all the questions