Blog van Vrijschrift / ScriptumLibre

The European Parliament Industry, Research and Energy Committee (ITRE) approved its report on the Cyber Resilience Act (CRA). It also voted for a fast track process. (updated ¹) The CRA is meant to strengthen software security.

Prior to the vote, many individuals and free and open source software organisations were very critical: EFF, FossForce, Bert Hubert 1, Bert Hubert 2, Team NLnet Labs, Apache Software Foundation, Opensource org, GitHub, CNLL, Vrijschrift, major industry associations, overview.

After the vote, organisations are just as critical. FossForce: Bad News for Open Source: EU Committee Approves the Cyber Resilience Act

“I’m discouraged that the proposed legislation has made it this far, and concerned that industry response so far is not robust enough to counter what is likely to be very damaging if it is enacted,” Joe Brockmeier, head of community at Percona said in a statement after the approval was announced.

The German automotive industry is worried about the impact of the legislative proposal. Joomla is. Inter-CMS Working Group:

However, in their current form, the proposed regulations run the risk of reducing software security, as well as undermining the EU’s core aims and values, as we explain below.

I haven’t been involved with the CRA earlier, and others are more knowledgeable regarding this proposal. In this blog I will limit myself to

(i) argue that the ITRE text violates the EU Joint practical guide by putting safeguards in the recitals where they may be completely ineffective and as a result creates legal uncertainty which may be very damaging for the software industry, especially the free and open source software community;

(ii) conclude that fixing the text is of strategic importance; and

(iii) suggest an approach – a shared set of high quality amendments with broad support could make the open source community’s case more compelling.

Algorithmic transparency is a important aspect of artificial “intelligence” (AI) legislation. Unfortunately, a software code clause in EU trade agreements limits algorithmic transparency. After a short introduction to AI and lawmaking, I will argue the EU should reverse course on this clause.

The EU trade agreement with Japan undermines algorithmic transparency, the Vrijschrift foundation wrote in a letter to the Dutch Parliament, in 2018. The agreement’s software code clause would limit the possibilities to audit software and algorithms.

The EU ratified the agreement, and ratified more agreements with the clause. Normally speaking, with these ratifications, the fate is sealed. But with the perplexity about AI’s disruptive capabilities, there may be a window of opportunity to reopen the debate.

We need policy space to properly regulate AI.

The draft EU - New Zealand trade agreement contains a sweeping cross-border data flow commitment, which goes way beyond such commitments in earlier trade deals. The commitment comes with a safeguard – an exception to the commitment, a carve out – for the protection of personal data and privacy. This safeguard seems strong from one angle, and weak from an other. The digital trade chapter also has a weak right to regulate clause.

In 2012 the European Commission decided that New Zealand adequately protects personal data. As a result, in the case of New Zealand, the strength of the data flow commitment and of the exception to the commitment may not matter much.

However, the EU commission expressed its intention to use the sweeping commitment and the strong / weak exception also in free trade agreements (FTAs) with countries without adequate data protection. This seems imprudent.

Below I will discuss the right to regulate clause, the commitment, and the exception, and will note tensions between supranationalisation and democracy.