And while we are waiting to get set up here,
And while we're waiting to get set up here, just want to remind people, there's we have an open session where we can do it ever we want with it due to a cancellation at 430.
So if you have an idea for that session, I think at this point we have a few ideas, but they're very specific, so we might turn them into lightning talks.
But a very short lightning talks. We'll see how it goes. But if you have an idea for a session topic, you can enter it at SFC.
And that link is also on the Fossum calendar for that session. Also on your way out from this previous session that Denver gave their signups for Foss users EV up in front, if anybody wants on your way out.
And without any further ado, you'll introduce yourselves. Very excited for the next panel. Let's give them a round of applause.
Hello, hello. Okay, so it's working, right? People in the back, you can confirm that you're hearing me well. Okay, good.
So we are very, very happy to be here again in Fossum and to have here the members of the European Commission and also from data rights to discuss a very important topic, the digital markets act.
I think everyone heard about interoperability, right? But who has heard about the digital markets act? Here's your hand.
This is a very qualified audience and I'm happy. So in the beginning of this dev room, the first talk, we learn that copyright applies by default, right?
You know, every time someone writes a code, copyright applies by default. And then, you know, who creates this code already has legally speaking, some kind of monopoly over that creation, right?
And this crowd here, of course, we are always talking about a free and open source software, which is the opposite, right?
So we came with the terms like copy left. So we tried to disintermediate control over software, you know, so we can free, we are free to share to study the source code to redistribute, right?
And but free software doesn't apply by default, right? So we have to, well, some licenses, we need to put some effort in order to have this type of freedom over software.
Well, the same word less applies over interoperability, right? And interoperability is very, very much important, because this creates opportunity for everyone to interconnect between different systems.
But the problem with interoperability is, and this is the topic of our today panel, is that the incentives are kind of paradoxal. Why companies, they are small, you know, they pretty much love interoperability, because this gave them the opportunity to interact with other systems.
But as soon as you start to grow, your company starts to grow and you start to be very important to the extent that your services become subject of interoperability regulation, then you don't like interoperability anymore, right?
And the digital market sector is this solution, regulatory solution, that puts interoperability back on agenda, you know, in order to regulate this, the greatest companies in the planet, that they don't want to cooperate in the terms of interoperability.
So, my next question to our audience is, in order for us to contextualize the importance of this panel here together with the commission and the civil society is, who uses iPhone here in our audience, right? And who uses, well, default Android, you know, a lot of people, but who uses an alternative ROM, okay?
All right? Who doesn't use any of these two providers, so is there like only a Linux phone, perhaps? Okay, so yeah, and exactly, so I think, last day, one percent of the room uses something that is not iOS or Android or Android days operating system.
And this demonstrates exactly the relevance of this panel today, right? Different from other laws, like the cyber resilience act or the online safety laws that we just heard, that impose some of obligations on free software companies or providers, the DNA is a different kind of beast, you know, the DNA puts obligations on the largest companies on the planet, right?
And it helps free software to get access to the infrastructure, to the services, to the elements that are provided by these companies.
And, well, it's all a bit fendandy, but we have the members of the enforcement team, and I can assure you that it's up here battle, in order to get interoperability, in order to get this law enforced is an up here battle.
Therefore, I would like to take off this panel after this short contestualization, and to ask you there, the very first question, how free software projects can request interoperability from gatekeepers for companies like Apple, Google, Microsoft, Amazon?
Well, first of all, also, thank you for inviting us, we're happy to be in a room where there's people who actually noted it to Microsoft, usually we need to start to by explaining it.
And also people who know the different operating systems just to summarize, you might know the interoperability obligation in DMA, it's that you need, or you can request interoperability with the operating system that's designated.
Those are three different ones, the ones that you know, Android, iOS, and Microsoft's Windows.
It's very simple, in fact, the law, as you heard, says that you are supposed to get interoperability by design.
So they're supposed to provide it, it's supposed to be provided free of charge, but a few of them sold their chance to introduce a request-based process,
where they can sort of assess if they think it falls within the scope of the DMA.
That applies both for Apple, Google, and Microsoft, in fact.
You simply need to search for it when whichever search platform you use.
I think for Google, it's on the book report page for Android, for Apple, they've dedicated pays for the developers, where you can go in, if you're looking right now, for example.
And from there, you can go through the process of requesting interoperability.
What we saw in the beginning of the DMA when it came out about two years ago was that, for Apple, in particular, it was very difficult to request interoperability.
And so we issued what's called specifications, which we will tell you a bit more about later, where we told them to make the request process easier and more transparent, essentially.
And aligned with how we view this obligation.
And that meant that it was brought into a space with more accessible for all of you to request it.
So if that's how you want to do, you simply search for it, you go into that page, request it, and then you go through the process.
The process shouldn't take long, that's what they have promised us.
You can see the sort of deadlines that we have subscribed to them for Apple, I think it's up to 90 days, but I can't remember exactly how long before they have to respond to you, at least.
The same goes for Google more or less, five to six weeks at a maximum, but, ultimately, they should respond to you way before, especially if it's something that's easily provided by them.
I think that's it, basically.
Right, yeah, it sounds quite straightforward, but again, this very powerful company is, they fight very well in order to not provide this.
So I think it is good that the European Commission is here having contact together with the community, and I'm very happy to see already some alternative, you know,
the app, app started developers here, that, you know, are facing a lot of challenges, you know, when we interact with Apple in order to have their own services running.
So I think that this dialogue together with smaller developers, and the regulatory is very, it's very useful.
But we heard also today in this dev room, that the free software movement is already 40 years old, right?
And since the beginning, we always heard some escape routes, kind of, you know, motives to not open the ecosystems, not to open the infrastructures.
And the basic, the these two elements have been around for way, way earlier than the DMA, you know, is our security and integrity, you know, and, and of course, I completely agree that there are several risks,
and this risk should be properly assessed, but also we need to, we need to be mindful that the elements regarding, you know, security and integrity of the practices should not be over estimated in order to impair each other,
So my next question is for Alexander, right?
What are the concerns regarding integrity and security regarding the operating system in moving to the availability of grants and the DMA?
Yeah, thank you. So yeah, the gatekeepers, they really like to show that if we would impose full availability on them,
then it could be that that would reduce the security privacy and integrity of the users of their users, and that's why they want to keep full control of their ecosystem.
And is this a bit more than that, and it's a bit more nuanced than that. So first, I think it's good to just talk about the three different definitions, like if you have integrity, just purely concerns the hardware and the operating system as it is defined in the DMA.
So it's about that the security of the operating system is protected. So if I install some third parties software on my operating system,
I don't want that it gets like really deep access and can control everything, and that the user choice is still taken into account.
And when we look at security, it's more that I as a user want to protect my data, so I put potential security measures in there like a passcode.
And then the integrity of the operating system would provide that the passcode cannot be bypassed easily.
And if you look at privacy, it's that I as the user want to use user choice to define which data or which pieces of hardware can be accessed.
So if I want to give access to an app to my camera, that would go into this bucket.
And then integrity basically goes around all that and just ensures that my user choice is enabled.
And that is why only intervability is actually for intervability, only integrity is mentioned here, because it's about the operating system and protecting core of the operating system.
And not just the user's privacy and security choices, because it's up to the user to decide how they want to share data, how they want to give access to other software under operating system.
So when we look at the DMA, then the gatekeepers, they are required to ensure that the integrity is protected even when they provide intervability.
And that part is then often used to say, oh, we cannot provide intervability here, but it's more than that as we just go went through the definitions, right?
We have integrity protection in intervability, it can both go together. It's not like that I lose all my security because I provide intervability.
So that's also really critical to really think about the background of operating systems, because operating systems in the past have been more open and more accessible.
And then that also lacked user control and user choice. So when I had the old operating systems, I installed an app, it had access to all my data, just because I installed this application.
And now we have sandboxing and other mechanisms that protect apps from accessing just all my data.
This evolution not only made things more secure and also protected the integrity of DOS, but also some things were basically left on the path to go there.
So some features are currently not only available that have been available in the past, and that might be relevant to be re-enabled or to find new APIs that provide intervability here.
And what's also good is to take a look at article 64 of the DMA, because here this is about installing fair party app stores on your device, and here it actually mentioned security as well.
And security here means that the user has to have the ability to use to secure their device, and potentially use extra security measures to protect their device from malicious apps they could download.
But this is not about imposing security on the user. It's about enabling the user to use security.
And as a last thing that I could maybe say is like when we look at the cyber resilience index also coming, this is also not preventing intervability in any way.
It's also just it goes hand in hand. So when we provide intervability, we must provide it also in a secure way now, which just in makes interoperable solutions better for everyone.
And the GDPR also always still applies. It's not that the GDPR or the cyber resilience would prevent anything in the DMA intervability part.
Yeah, I'm amazing and I'm very happy that you mentioned the other loss, especially the cyber resilience act, because I followed the regulatory process is called the specifications.
But a bit of specification decision that the commission took in order to help Apple to comply with the DMA.
And exactly you will explain the different concepts, like under the U-law security integrity and how this relates and how this is not impairing interoperability.
I think this was very, very enlightening for us in order to, you know, to, to understand that indeed. Yes, okay, so interoperability may affect this, but not in the legal sense that the gatekeepers are trying to make us believe that that is so I really appreciate that the commission shuts some light on there.
But since I, I still, I have to there, Alexander, I would like to dive in on an example, right, that we are having and last year, last year was a hard year, let's put, like, mutely for the free European source community in relation to Google, right, because Apple is very easy, Apple has this very, you know, adversarial type of attitude approach towards.
Free and open source software, right, but Google the situation is a little bit more nuanced, right, the Android operating system.
It's consistent also with a very important free and open source element, the Android open source project, right, and well, and Android is the most used operating system in the world, right, and it's maintained,
measured by Google, right, and due to the free and open source characteristics of IOSP, we have a plethora, we have a spectrum of alternative operating systems.
Many of you here in this room are developers of this alternative operating system, right, I can name several of them, right, but last year it was, well, there is a blow right on interoperability when, you know,
Google stopped for an example to take pixel phones as reference device, right, and then alternative operating system, we didn't have, I have more access to device trees and other information like source code history, and there was a several of hurdles imposed on alternative,
operating system that are based on Android, and well, diminishing their capacity to compete with Google, right, so Alex and of course the other members of our panel would like to just start.
In our view, what are the main challenges posed by the changes in governance that Google introduced on Android open source project and how this affects the MA and special interoperability.
I think this is a hard question, right, Android itself is still kind of an open platform, we have pixel devices that are still open to be modified, we can route them, we can put alternative software on them, but the ability that has been taken away is the device trees and that makes it harder for third parties to develop alternative versions of Android,
because it's just lacking the parts that they had access to before.
And to me it's still a complex problem to see how this can tie into with Article 6-7 in interoperability,
I know you have written an entire paper on that, and this is your main interest, but I think it's taking away this ability for developers, for sure.
But we can definitely see that there is a different governance that Google is doing over Android over the past years.
Yes, I appreciate that, and that's why my question started that, this is new ones, and that's why we are here today, because we don't also just to bring you, you know, ready answers to the questions, but we want to establish a dialogue, right, and we want to hear, because as you mentioned,
I have been involved in the LX-6 months on a study that we interviewed a lot of research, not to research, I'm sorry, developers working for alternative operating systems based on Android,
and we want to understand better how this impacted their work, how it impacted their capacity to compete with Google, stock Android, right, so this is the beauty of this dialogue, because we are still formulating some question.
Gabriel, perhaps you also have some inputs on this.
Yeah, sure, I think it's a good conclusion of foundation, as Alex said, that there is no direct answer, and this needs to be addressed in this way.
And if that was the case, we probably already had done something about it.
Yeah, it's as I'm good.
I think like it.
All right, then we interact with the community on a regular basis, I hope you people are aware of that, that we often meet not just with you guys, but also with the other people who operate on, you know,
to operate these operating alternative operating systems, however you want to turn them, to understand what the challenges are for you guys, and to understand if the DMA is applicable in any way to that.
And that's something we spend a lot of time on looking into, and something that we simply need you guys help to understand, because we're not developers of an alternative operating systems, so not me, I'm a lawyer, so I would know how to.
But that's the starting point, as you saying, to have this dialogue and something that we welcome from anyone who is interested in it.
We're confined by the the limits and the scope of the DMA, which means as Alex was saying, that legally we can only act within what six seven provides us for interoperability.
And so we need to think in how it's applicable to the problems that you described to us.
We need to be aware of the problems, of course we also, I would say at this point, up to date on them, as Alex said, described.
And so I think that's the show that, or the long answer actually.
Yeah, so we heard already in the panel several times the term six seven, right?
So just a question, of course, on our article six seven, it's a article that concerns, you know, interoperability of the operating system,
the features and functionalities controlled by the operating systems in the DMA.
And my analogy, my personal analogy that I like to use, this article is like a Ken opener, you know, because it is an opening access to alternative providers to to interact with features and functionalities that are controlled by the operating system.
And the general mention in the beginning, this type of European ability to be provided free of charge.
And in the same level of control that the gatekeeper has, Apple and Google has to the feature and functionality, should be granted to third parts.
So this is a very powerful type of, of article, and I'm very happy that this made it to the DMA.
So where's the, your micro league there?
Gabriel mentioned something important, we need your input, we need your what the community says, right?
So that is a FIKI KIDOF interoperability survey. So if you are ready to request the interoperability with Google, Microsoft or Apple,
please reach out to Daniel, he's here again, and he's conducting this type of survey. We are happy to, and many of you are ready to contribute and then we are very grateful.
Yeah, moving along, because interoperability does not only concern the software, right?
In this audience, of course, the majority of interest is software, but I would like also to talk a little bit about data, because the data is as important as a software, right?
And there are provisions in the DNA that concerns also data, data interoperability, data portability, right?
And therefore, I'm very happy that we have our representative of the data rolled in our panel.
And Laurie, I would like to start asking a question to you, is how the DNA provides other obligations and how can free software developers rely on to facilitate switching?
Because switching, I think you can explain a little bit about this, especially related to data interoperability and portability issues, and how the free software scan profit from that.
And I'm also interested to know what data rights this, you know?
Maybe I can present data rights in the question, so hello world, I am apparently the data world.
So maybe, because also coming from a legal background, we love definitions, so I thought I would start with that a little bit.
So interoperability, basically, is about having two systems, they're able to communicate between each other.
And the communication can also involve exchange of data in two ways, but it doesn't have to be the case.
And so that's where I would say portability is quite different, because portability is basically one way.
You will have data that flows one way towards another entity.
And I think it's interesting here because, of course, you know of the GDPR, but so it's interesting to know that the GDPR created for the first time the right to data portability.
The problem of the GDPR is that it created one of kind of data dump, which was a huge problem, because then users would just be sitting with their data and thinking, okay, right now.
And so that's where the DMA then takes the stick from the GDPR and goes further and says, okay, now we're going to actually establish dynamic portability.
And as in you have a flow of data, so typically I think the example that helps me the most is you know aggregators of plane prices, you go on the website and you have up to date prices from different websites.
Okay, so now that this is done, in terms of the GDPR, so by law, the rules are fairly fairly clear, in terms of portability, it has to be free.
And it has to be based on the authorization of the user because, of course, we're talking about personal data here.
And also very importantly, there is a tool that needs to be provided by the gatekeeper. I think this is something very important for developers to be aware of.
And this has to be the flow of data has to be continuous and real time when technically feasible.
I want to highlight this point because this is where they will have you.
And you know, they will say, oh, actually, unfortunately, we're very sorry to say that this was not technically feasible here.
So this is where a lot of interactions with you are really needed because even if it is true and we would need to check whether this is true.
Even if it were to be true today, it might not be true tomorrow.
So this is something where legally this is very important to keep an eye out.
And then in terms of the data that we're talking about here, it's the data given by users, but it's also the data generated by users.
Okay, so now we're looking at interoperability, a bit of a mouthful.
So it has to be by design.
And as we mentioned already, it has to be free of charge.
And I actually want to pause it a bit on this because it also means no hidden costs.
That's actually what this means.
And so typically when we're starting to hear, you know, competitors saying, oh, but meta is requiring that I do X or YZ.
Well, actually, that's a hidden cost because this is going to cost you a lot to implement.
So that's a hidden cost.
So just to throw this out there.
The interoperability has to be effective.
So here again, if you have some weird barriers, then ask yourself, wait, is this supposed to be like this?
Because probably the answer is no.
And then your software has to be treated has to not be treated less favorably.
So this is a bit of a legal concept, but yeah, ask yourself this question.
Do they actually have to treat to be treated like this internally?
Because again, if you feel that the answer might be no, then the answer might be no.
And now in terms of building on this to disruptive rights, we have other aspects that are obligations that support this rights for switching.
So I'm going to talk now about strong access rights.
And then I'm going to talk about anti locking measures.
So in terms of access rights, so they really build on what I was talking about.
And this is really meant at helping the switching.
So the interoperability access has to be associated with APIs interfaces and important documentation.
And again, as a lawyer, this is really interesting that it just says important documentation because that leaves a lot of room to specify and say, well, actually,
we used to consider that this was not important.
And now we realize that technically this is fundamental.
So please now consider that this is part of what the law actually requires.
And there's also, yes, also I wanted to point out this aspect about, well, we talked about cybersecurity, but I love to think about how can we also turn this against the gay keepers.
Because if they don't give the documentation, then you know you're on your own and you reverse engineer.
And that actually opens the door to creating vulnerabilities.
So I want, yeah, just to stressing this out there.
And then in terms of also access to performance and usage data, I think this is very important because, well, first of all, that enables for your software to not actually be used to compete against you.
So that's that's what I'm driving ball.
And it has to be also real time and continuous.
So now the types of data that are covered by usage and performance data are aggregated.
And non aggregated data.
And we're talking also about data generated through the interactions with the users.
So we're talking about a lot of data.
And in terms of also how that data has to be looking like it has to be very high quality, machine readable.
So again, this is interesting because with the GDPR we had huge problems with individuals being given scans.
So that the gay keepers actually didn't really have to follow the law.
So yeah, stressing that one as well.
And provided on a fair reasonable and non-discriminary basis.
I think this is a bit of a mouthful that you will need to turn to lawyers in the future to make sure you understand to be honest.
And now in terms of the anti-locking measures, I just wanted to stress, but I'm sure you probably heard about this.
But the DMA is also here to say, okay, the whole dense where you had to, you know, as a developer pay some sort of a weird fee just for the pleasure.
Of existing in the platform, that's gone.
So you know, you are allowed to actually clearly communicate with your users, invite them to go outside, practice your own prices, use your own payment system.
So these are all solutions that are meant to actually prevent, you know, for example, so the bundling.
Oh, to actually use the service, you have to sign up to this other service.
So this is also illegal now.
And so yeah, these are all anti-switching measures that are pretty strong.
And maybe just to finish, there's actually an article that says, and by the way, it's also illegal in general to prevent users from switching.
So I'm just, I'm just throwing this because even if there's something where you feel, oh, I don't really recognize the situation here.
There's also a safety net here.
Yeah, I mean, things a lot for this very comprehensive overview.
Well, it's pretty interesting that everything that Laurie was just explained right now.
You know, many of our, in our community, in the free software community, people that work with open data takes different granted, right?
So you're switching, you know, and all other elements.
But, but gatekeepers, they, they try to fight it.
You know, there is an interesting writer.
I like his work a lot, a card doctor of, and he writes about the right to general purpose computers, right?
And I think gatekeepers, they don't like this, right?
And they came up with some terms like side loading regarding to software, right?
Let's think, for example, side loading means installation of software.
If we could make some analogy, right?
Side thinking when I'm not using AI or perhaps side listening, when I'm not listening to Spotify, right?
So I think that, well, we are accustomed to, to some things that in the proprietary world, in the world of this gatekeepers, this is not the case.
And that's why we need some law, like the DMA in order to remind us that in fact, this is good for competition, this is good for healthy digital markets.
But then let's talk a little bit about the, the teeth of the DMA, right?
Gabriel, perhaps you could help us to understand what happens.
If gatekeepers do not comply with the law, right?
So Apple or Google doesn't, or Amazon or Microsoft, one of the gatekeepers, they don't comply with the law.
What happens to them?
Yeah, so you've gone in now, you sent you requests for interrability and 90 days pass, and there's still no answer.
Once you finally get it, you don't get the interrability you're expecting despite the fact that it's written in the law.
Then what do we do? Our day-to-day work is very much what we call regulatory dialogue, which is a fine word for that we meet with these companies very regularly, sometimes on a weekly basis, but at least on a monthly basis.
And then we talk with them and we tell them the, for example, the problems that we hear from older companies and organizations that we interact with.
And through that dialogue, we also, of course, pressure them. We tell them, look, this can't be, this is not how we see the DMA, you will have to change this, this and this.
And a lot of the time they actually do, we already achieved a few things through that, I think, for example, the data portability was achieved through that, as well as the switching between Android and iOS, which will come out soon also, I think, actually concrete solutions from that.
And that's come from this dialogue. So that's most of our work that is not confrontational in the sense of you, we hear from this and then we send a fine right away.
But otherwise we have other tools in our toolbox and they also include what we told about earlier, the specification.
Specification is that we work with the company for six months where we also interact with you guys, for example, to find out how they can best comply, for example, with the interrability.
So we tell them, look, you need to set up a request portal that's accessible, you need to answer within these days, you need this, this and this concrete measures that are open for anyone to read actually.
We're already good for that for Apple and we just started last week, a new process for Google in relation to AI services and online search data also.
Once we start these, the clock starts ticking and that means that we have three months to issue what's called preliminary findings and measures which is then published for everyone to read also.
After that's released, everyone can comment on it including everyone in this room, even people who aren't residing in the EU, I think, comment on it, you just go into our webpage and you leave a comment.
And we have to take that into account and then we have three months more to issue the final findings and then they have to comply with it.
The last thing we have in our toolbox is of course noncompliance which is proceeding that doesn't have a final deadline, so that can take a little bit longer than half a year.
But essentially what will happen is that if we find noncompliance, we can find the companies and we've also already done so we find Apple and Meta.
So that's the ultimate sort of teeth that we have in the DMA.
Yes, just what's maybe interesting to know the difference between the noncompliance and the specification is that while the noncompliance just identifies that they're not compliant.
The specification would actually impose the measures as Gabrielle said, so when we have noncompliance, we cannot tell the gatekeeper what they have to do to comply.
They have to come up with a compliant solution on their own and then we can check that while the specification is really for these tricky things where, okay, how do they, like, how for AI, like, this we just started how AI features can be accessed on Android, like, it's not a simple answer to that.
There's multiple layers you need to understand and there's different interpretations from the gatekeepers and from us and we just it's more like a guiding tool that tells them, look, you have to do this and that and that's when we think you are or compliant and these are the, this is the main difference between these two things.
Excellent.
Yes, we have some questions afterwards, but I'll keep you in mind.
We are hearing a lot about digital sovereignty, right, so this is one of the topics that we have been hearing a lot.
And there is one element in this debate that I don't particularly like is when people say that, yeah, we need some European solution against North American solutions or against the Chinese solutions, because sometimes we forget that the free software movement is a global movement, right,
and imagine we have alternative free software-based projects like FDRIED, they have developers all over the place.
We interviewed alternative, alternative ROMs, alternative Android-based operating systems and they have developers all over the world and the GMA, when we are discussing the GMA, the political impact of the GMA, the future of the enforcement of the GMA, people say, oh,
GMA is an anti-American law, you know, they are targeting anti-American law, it's a discriminatory law.
And I don't agree with this assessment, you know, I do think that we should train this debate into big tech versus small tech, you know, because monopoly, it's a bad thing not only to you, it's better for North American citizens and consumers, it's better for, you know,
Well, consumers and citizens in China are in the other country, right, and I do think that the future, you know, the enforcement of the DMA should prevail if we had this mindset that we are not targeting
National companies from whatever place, you know, but your target companies that are so big, that they become gatekeepers of digital markets, they basically do whatever they want on digital markets.
Well, it happens to be that mostly of the gatekeepers nowadays are not from American, but it could be from anywhere else, right,
the FSA fee for an example has been engaged in other companies, initiatives like router freedom, where we try to liberate routers,
and there the monopolists were the Internet service providers, the Europeans once, right, they don't allow you to run free software on your router, right,
So coming back for the DMA, and I would like to disembark strategic long term thinking type of question, and Victor perhaps this, you could help us to start thinking about this type of answer,
as does the DMA effectively shift gatekeeper control from Apple and Google, do you think so or not?
Yeah, and of course also other gatekeepers, it's not even just them, it's any gatekeeper which has been identified,
also we are now even in a process where we're trying to identify additional gatekeepers, especially in the cloud space,
so to kind of identify all of these companies who have to be subject to the DMA, and also the strength of the DMA in that sense is that they kind of try to not have this
almost subjectivity of which companies we target, like are we waiting for them to be too big, which is kind of more the remit of traditional competition,
or you kind of wait for the problems that happen, and then you resolve it, this is really meant to be what we would like to call on legal terms X&T,
which means that it sets out like obligations upfront, so whenever you, whenever you even get to the certain size,
imagine a new company or a new business or a new developer kind of grows and grows and needs the thresholds,
then they become subject to those obligations which again try to make sure that there's no kind of monopolies and digital markets that people switching is a lot in this form.
In terms of shifting gatekeeper control way, I think that the DMA has kind of effects on two levels.
You have the direct effect, which is the obligations that the DMA sets out, so it causes changes to the services that the DMA regulates,
like an operating system features are opened up and are made intropiable for others to access.
You now on ALS have for the first time the ability to have an alternative app source, so the app also required to introduce this into the operating system.
You also have the ability to set an app as a default, so before maybe you're forced to use the gatekeeper app,
now you can set that you want to use an app from a third party.
So that's the direct effect, that's what actually will be this change that the demand,
that kind of also we as a team at the commission can cause, that's what will happen.
Then there's the indirect effect.
These change that create opportunities opportunities for developers, for also the software community,
to kind of seize those changes that have been made, build on top of them and through that action,
reduce the gatekeeper influence, so it's about developing a smartwatch that interoperates with the operating system and it uses those features.
It's about creating the alternative app store and putting it out there for people to install and use.
It's about creating the open source software that you can now set as your default app,
and that's like much better cares for your privacy and your security.
But that's an indirect effect, that's kind of what we have to wait for other people to do,
and what we have to kind of see people do in order for it then this control to be produced.
So it's really about enticing users, enticing people in the EU,
to switch to these other platforms to have the ability to choose for platforms that better care for privacy,
or security that meaty goals of digital sovereignty.
But it's really about something that is like a commission we can all directly influence,
we're not going to be an advertising bureau and kind of try to do this.
But of course, the experiences that people who try to buy it away at the gatekeeper power,
experience that they have and kind of, of course, the hurdles that they might face,
of course, that's something that we can take back.
I think also very strong in the DMA is that it sets out these obligations,
but that basically has kind of a catch-all obligation that gatekeeper shouldn't try to circumvent this,
so shouldn't try to make it super difficult to interpret a certain feature,
just to try to make it super difficult for users to switch a default,
just to kind of again try to retain that power and prevent this action from happening.
So there are certain tools there, but at some point we have to wait and see what happens,
and how users are going to be switching to these other platforms,
but I think that there are these very strong arguments for people to do this.
So let's hope that we can see like a brighter future where this control.
So we have our homework, right?
So the first of the communities are communities of makers.
We don't wait for others, we do ourselves, right?
So we have our task.
The holds in the infrastructure are being open, right?
And we need to few this open.
Actually, I think that what you just said is very important,
because we are on the verge of a strategic thinking,
you know, so when this holds our open, what should we do here in Europe?
Should we have a European gatekeepers,
or should we have ecosystem that are based on free open source,
and open data in open protocols, open standards?
You know, that we respect people's freedom, people's rights.
I subscribe to the second one.
I really think that the free software community is up to the task.
You know, in order to size the moment,
to size this type of regulation that tries to, you know,
to set up a plain field for competition, you know,
so we can build upon it.
And, Laurie, perhaps we could go to the last question
because we would like some time for a question as well.
On your view, what would be the community responses
to make this happen, you know, in order to preserve software freedom,
especially on mobile devices?
I think this is one of the main challenges for the free software community.
Thank you.
So maybe just to start off a comment,
but I think you put it very well earlier.
It's interesting to see how in the data rights environment,
we see how much there is a call from big authorities
and big companies to have data to flow,
but then you realize they mean every data,
except the one they set on.
So that's always very enlightening.
And so in terms of the needs in the space,
so as I said, the GDPR really planted the seed,
but users were alone, and this is really where the DMA
is bringing the developers and the nonprofit projects
and the companies to the rescue.
And so to my, I would say that there's two needs
that really need to be tackled right now,
enforcement and governance.
I'm also going to mention the commission.
In terms of the commission, of course,
they need to continue to do what they described,
which is investigate, but also sanction and form,
inform developers and inform users.
And in terms of governance,
I think this is exactly the approach that they're taking,
which is once they see that the gatekeepers
incapable of actually playing fair,
then they will go and sit and say,
okay, so these are the things that you're going to follow
in terms of starting to standardize the governance
and how certain APIs, for example, are going to be dealt with.
So in terms of the first community,
and I would say also the NGO community,
so I'm also going to talk about enforcement and governance.
So in terms of this community,
I think there's a lot to do in terms of really making sure
that you have a rough understanding of your rights,
and that you start also informing your users.
And most importantly, that you start testing the tools,
and by testing, I'm in testing and documenting what happens,
because this is really where NGOs,
we really want to help,
but if there's no hard evidence, we cannot.
And so maybe to go a little bit deeper on this,
something that feels weird,
something that feels incomplete,
that's also something that you should document.
As long as you're not overwhelmed by how well this is working,
you need to document basically.
And so in terms of NGOs,
I think there's really a,
we're really in a moment where NGOs need to set up their game
in terms of technical savviness,
because this is really difficult.
And this is also where you document,
also helps NGOs to actually follow you,
and figure out how they can help.
And also, I would say,
if you're working with companies,
maybe suggest that they give money to that space,
because at the moment there's not much.
And then in terms of enforcement,
I think the NGOs,
they should really try to force themselves to advise
as much as possible,
your community, too.
Yeah, as I said,
to really get into the nitty gritty details of what is not working,
to be able to actually fight.
Okay, but actually that sounds like a hidden cost,
where you know,
you're dealing with the day-to-day challenges,
and you actually don't realize that maybe this is something
that the DMA is already saying is illegal.
I also think that NGOs should start researching
what are the priorities of users and users in terms of,
you know, all the services that are covered by the DMA,
which are the ones that users really want to switch from
and priority.
And of course, of course,
the OS environment is a strong one.
And we're working on it to try to figure out what are the priorities.
And then in terms of governance,
I think this really also builds on evidence.
I think there's a space here where NGOs need to monitor
a little bit of different cases
that are going to be started by entities like the ones
that you might be representing,
to figure out which ones they can actually help to make sure
that they infuse in the legal process,
the chance to actually have judges to interpret the law
in the way that actually helps the free software community.
You know, for example, by saying,
oh, actually,
we realize that open formats are how we need to understand
mesh and readable transfers.
So we realize that open standards are really what
needs to be considered as the best.
You know, this is something that I think is also ahead of us
in terms of how we develop this space together.
Yes, perfect.
Before we open up for questions,
I would like to,
you join me in a round of applause.
These people here,
they have a very busy schedule,
but they,
you know,
I would like to thank you for your presentation.
Thank you very much.
Thank you.
for your input.
My question is kind of about the interoperability,
because I use Apple products, and I hate it.
I would like to open up one by one still using other stuff.
My question was, for example, Arctic.
Anyone here using Arctic?
Like, is it, within the law, is it planned that those devices
or Apple Watch or other devices that could come in the future
are also regulated within interoperability that you can use
to stop with Android or that you could use your iPhone
with a Linux system.
For example, there is a thing you cannot use that with an iPhone.
And I hate it.
And I feel like maybe there could be, like,
this could really open the system to free software.
So I think it's very fine that you ask about AirTex,
because that was what I did before I joined the commission.
I was researching AirTex.
And yeah, there is, for example, they,
so first, you can use AirTex without an iPhone.
There's an open source version that we made that basically
makes a possible, there's a little bit of work to do
to enable it for AirTex, but there is alternatives.
It's called OpenHasteStack.
And from the DMA side, the interoperability is not just about
software, it's also about hardware.
So if they add tech into operates very well with the iPhone,
then a third party checker should
interpret the same way with the iPhone,
but it doesn't work the other way around.
So I'm not, the, the, the, the, the, the, the DMA does not
have the airTex as a separate product that's designated.
It's only iOS.
So things that work with iOS, the other things should work
from Apple, that should work the same,
from third parties should work the same way with iOS.
But the airTex itself should not, does not have to work
with Android.
I have to get a phone, can shoot to it.
I'm very far from home.
But then how, how is it, like a little bit?
But it's, but, but there is, then how is it secured that?
But I'm, I have brand it.
So, it's okay.
Thank you.
You can ask me later.
Here was the next one.
I have a question about an aspect of interoperability
that I'm not sure if it's covered by the DMA,
because it wasn't discussed here.
And it's not the case of running free software
on Android or iOS.
But proprietary software that refuses to run
on alternative Android distributions for the classic example
that is my banking app refusing to run on graffinoes,
because graffinoes doesn't Google, the Google play
integrity API refuses to, like, admit that graffinoes
is secure, so my banking app says, oh, this doesn't look nice.
I'm not going to run on graffinoes.
So, is that covered under the DMA
and if not, what can we do about it?
Yeah.
Well, so this is one of the issues that we are very well aware
for and have been informed of by multiple parties.
We're thinking about whether it falls
within the scope of the DMA.
And that's what I can say at this point,
because it's not the sixth, seventh, the article
that was mentioned a lot during this S, not necessarily
clear how it applies to it, but that doesn't mean
that we're not considering it.
One quick request from the moderators, if you have a question
and you raise your hand, keep it up, because else I assumed
that it was answered already in some of the other questions.
And it's very difficult to remember who had hands up.
And keep me short, please.
Yeah.
OK, I'll try to make this as brief as I can.
But basically, to me, it just seems like,
so I'm from the US, and you mentioned, you know,
this is a global thing, but it's not.
Because I live in the US, and even though I like iOS
is supposed to allow different browser engines
and this isn't that in Europe,
doesn't do it in the United States.
And we're facing a lot of a global uncertainty
where Apple and Google have turned off
like international court access to their services.
It seems to me, y'all are taking the hardest possible way
to why does it be you just fund a mobile operating system
instead of begging companies to just do the right thing
when they'll always drag their feet and always make it harder.
Well, we are talking about a law here, right?
So I think that the DMA is not our miracle instrument
that will resolve all the problems of the digital market.
I think there is, in this room,
there's a lot of people working for funding a free software.
Public money should be, you know, invested in free software.
So I do think that the DMA is one element
in a strategic approach for us to change the nature
of digital markets, right?
So DMA takes the real-glotter level,
but we need a strategy.
We need the public money on open standards,
the public money on open software, you know?
So I think if we think strategically,
then we can approach this type of question.
Thank you.
So the next one, call either.
Regarding 64 with App Store, opening up the app
for us physically with regards to Apple,
the only real exemption that the DMA offers
to the gatekeepers is based on security arguments.
But, for example, with Apple,
it's been well established for over 10 years
that they have their enterprise developer program
where you can directly take a application
and install in your device.
Presumably, they make security arguments
that are private to discussions with you.
Is it possible that they might someday come out
in the open where there can be a debate
about whether or not these security arguments
are actually reasonable and accurate?
Or is that always gonna remain an internal dialogue
that is not open to public scrutiny and feedback?
It would be great to have.
I don't know if we have kind of the regulatory power
to force them to open up about this.
I think what you will actually see
is that over the course of us engaging with them
and then actually also going towards proceedings
and procedures, you might actually see some
of that argument trickle into what we write about it.
So if you would look at the decisions
that we write about the specifications decisions
that we put out about like interoperability
with connected devices, there's a whole section.
There's like 10, 15 pages.
There's just security arguments, security arguments,
security arguments.
And of course, it will also say Apple says that
and we say that and I think just to distill it,
it's really about yes security privacy integrity
are important issues, but they are also kind of important
to all and any security measures that are being taken,
security privacy integrity is always a short hand.
Actually, they would benefit both Apple and third parties
if they were kind of implemented across the board.
So that's how we kind of distill
and also from this competition angle.
They still principles about it.
Yes, I just can be applied, but it should be like
not the screen at all.
It should be objective.
They should be transparent.
They shouldn't depend on Apple being Apple.
They should, if any, they should depend on really
so many kind of being able to prove that they take certain measures
that they kind of have the right, I don't know, encryption standards
that they apply.
So it also boils down to the user having the choice trust
who they want, the person here, they might want to trust Apple
for, say, the hardware, but not for certain of the software
on it, and it's really about enabling this.
And not having Apple as an argument, our software
couldn't do different things because we are Apple
and we trust ourselves.
That's kind of the principle that we want to go beyond
it's really about empowering users, not only in the choice
of their advice, but both in their choices
about privacy security.
Also, just to be transparent about the process that I
explained with the dialogue that we have with these companies,
for example, Apple, it functions that we meet with them
maybe every week every month.
Then we meet with you guys.
I think we've also met with F-troid if that's
where you're from a few times.
And then we try to reconcil what we hear because a lot of the time
it's not the same thing we hear from Apple
and then what we hear from F-troid, for example, you guys.
And that forms the full picture of how we do our work, right?
So it's very important that you actually
interact with us and tell us, as I said earlier,
what's your problems, what you've used, that will help us
also when we engage with these companies to say,
that's funny because we heard actually from third parties
that this, this and this, and that makes it easier to count
the academics that are not necessarily vented.
Thank you for your own divide attention.
And again, join me in our round of applause.
It was a pleasure.
APPLAUSE
Thank you very much.
Thank you.