Cyber Resilience Act may seriously harm free and open source software

The OEIL page, the European Parliament Legislative Observatory, links to many documents and more information. ² The Committee report tabled for plenary, 1st reading/single reading is the text ITRE committee approved. ³

On 19 July, the EU member states also agreed on a text and to enter into trilogues, a fast track procedure.

(Before the Parliament updated the OEIL page, it was possible to find the ITRE text, but not that easy. ⁴)

ITRE also approved, with even more support, to open negotiations with the European Commission and the Council of ministers (fast track, trilogues), without first plenary amendments and vote on the draft. This decision will have to be approved by a European Parliament plenary vote.

As you may know, the Council of Ministers is intransparent, and trilogues are informal, non-democratic, non-accountable and non-transparent processes to fast-track legislation.

I see some ITRE amendments that seem improvements, but they mostly ended up in the recitals (the “whereas” clauses) that have no independent legal value; they mostly did not end up in the operative provisions, the articles.

The EU Joint practical guide notes:

The purpose of the recitals is to set out concise reasons for the chief provisions of the enacting terms, without reproducing or paraphrasing them. They shall not contain normative provisions or political exhortations.

European Court of Justice:

On this point, it must be stated that the preamble to a Community act has no binding legal force and cannot be relied on as a ground for derogating from the actual provisions of the act in question. ⁵

Den Heijer et al argue that recitals that are used to alter the normative content of EU [law] generate confusion, poly-interpretability and give a false impression of European consensus.

In this case, it creates legal uncertainty that may be very damaging for the free and open source community. By putting exceptions in the recitals where they may be completely ineffective, the ITRE committee created fake safeguards.

Note the applause after the vote at 10.15. Note the jubilant PR. Yes, the CRA is important legislation. But by putting fake safeguards in the text the committee endangers a critical industry. With European Parliament elections next year, the members want to show their accomplishments. But there is no reason yet to celebrate. They first have to fix the text.

The EU member states’s text also violates the Joint practical guide, creating fake safeguards.

This Bitkom paper does a better job at putting normative provisions in the articles, and could possibly be a starting point for shared amendments (see below).

The Joint submission of CZ.NIC, Internet Systems Consortium, The Network Device Education Foundation and NLnet Labs makes clear how important and vulnerable the development of open source internet infrastructure software is. Other organisations make the same point regarding their own field. The Cyber Resilience Act could make crucial software less secure.

Moreover, a major issue with our networked societies is that the winners take most. They have deep pockets and can deal with legal uncertainty. They can deeply influence politics, and our societies. Smaller companies and the free and open source community can’t deal very well with legal uncertainty. If we do not want to sell out to (mostly non EU) mega corporations, smaller companies and the free and open source community are of strategic importance.

The European Parliament could decide to not go into trilogues now, but allow plenary amendments and vote. This would create the possibility to move normative text in the recitals to the articles and solve other issues. It could even decide on a second reading (after a council position), in accordance with TFEU article 294.

With the broad support in committee for opening negotiations with the council this may not be a very realistic scenario. More realistically, we will see a messy fast track process to find a compromise between two messy texts. On the positive side, both Parliament and council expressed the intention to get things right.

The situation seems rather grim. I will make a suggestion.

Years ago, a European Parliament political group asked some organisations, that worked on the IPRED2 legislative proposal and had proposed amendments, to come up with one set of shared amendments. That would work better politically.

In the present case, the open source community could make a set of shared amendments, to the articles, and muster broad support for them. As a justification, the amendments would implement the Parliament’s and council’s stated intentions.

Furthermore, EU commission, Parliament, and council do not use specialised legislative experts. The texts may turn out technically deficient, like, in this case, using the recitals for normative provisions, where they may be ineffective. The open source community could let legislative experts rewrite their amendments. The community would then deliver better quality.

A shared set of high quality amendments with broad support could make the open source community’s case more compelling.