Another issue with the Cyber Resilience Act: European standards bodies are inaccessible to Open Source projects

One of the proposals in the Cyber Resilience Act (CRA) is that European standards bodies should develop suitable standards that help simplify conformance. Bert Hubert explains how this might work in his extensive CRA explainer.

There’s a crucial issue here for Open Source. EU policy experts say not to worry about CRA compliance because the EU standards bodies will streamline it. But the European Standardisation Organizations (ESO) are corporate-controlled, patent-loving and expensive to engage. Shouldn’t the EU address this if they want Open Source accommodated?

In Europe, standards requests from the European Commission are handled by bodies which have been designated an ESO under EU law. There are only three of these; CEN, CENELEC and ETSI. None of these standards development organizations are accessible to Open Source projects per se.

CEN and CENELEC are largely controlled by national standards bodies which in turn are dominated by national industries, while ETSI is a  member organization with high membership fees and largely secret proceedings (although laudable with free specifications) that is directly controlled by its members, predominantly from the telecoms industries but also including the European states. In addition, ETSI celebrates its role as a pioneer and proponent of FRAND licensing, which is fundamentally incompatible with Open Source communities. As with all de jure standards, participation in each of these standards bodies is expensive, both financially and in time, and engaging in their governance is beyond the scope of small players.

Given this context, when the European Commission requests standards that will be applied for conformity assessment, it’s not clear how they will take into account the development workflow that applies to Open Source software. Like the European Commission itself (as I commented recently), Europe’s standards bodies have no functional relationships with Open Source charities and do not consult them.

It is very important to find ways to give a voice to the true community and not just its corporate members. As things currently stand, Open Source will only be considered through the lens of its corporate uses. Since Open Source is a social movement with software artifacts for which the applications are diverse, paying heed only to the attributes of the software and the needs of the companies consuming it is an inadequate approach. You can’t even proxy through small business, let alone multinationals and their lobbyists – many of them are unaware of how communities work and without community understanding, fundamental errors can be made.

As a result, I believe whatever legislation arises from the CRA (and related instruments) needs to specify that standards bodies making related standards must include effective measures to consult and include the Open Source community. If this doesn’t happen, as NLnet Labs explained, “The only alternatives left available are the conformity assessment procedures that involve paying for third-party process auditors.”  And Open Source developers definitely can’t afford that.

This article first appeared on Webmink in Draft.

Image Walls Within Walls by Simon Phipps.