Episode 224: Ciarán O’Riordan on the EU's Cyber Resiliency Act

Guest
Ciarán O’Riordan
Panelist
Richard Littauer | Leslie Hawthorne
Show Notes
In this episode, host Richard Littauer and co-host Leslie Hawthorne engage with Ciarán O’Riordan, Senior Policy Advisor from Open Forum Europe (OFE), diving into the intricacies of the Cyber Resiliency Act (CRA) and its implications for the Free and Open Source Software (FOSS) community. Ciarán shares his journey from software development to policy advocacy, emphasizing the critical role of policy work in shaping the future of open source. He provides an in-depth analysis of the CRA, highlighting concerns about its initial draft, the involvement of the FOSS community in shaping its final form, and the potential challenges and opportunities it presents. The discussion also touches on other significant legislative developments in Europe, such as the Product Liability Directive and the AI Act, and their potential effects on open source software. Press download now to hear more!
[00:01:25] Ciarán explains how he became a Senior Policy Advisor, his passion for policy work, tracing his journey from a software developer in Dublin to his 20-year career in Brussels focusing on policy advocacy, including his recent position at OFE.
[00:06:08] Leslie asks Ciarán for a summary of the Cyber Resilience Act (CRA) and its specific implications for the free and open source software ecosystem. Ciarán contrasts the initial and final versions of the CR, detailing the changes made, the lightened obligations for free and open source software, and the ongoing compliance challenges for commercial distributions.
[00:11:02] Leslie inquires how software foundation’s responsible for producing commercialized software are impacted by the Cyber Resilience Act. Ciarán explains that the final version of the Act introduces a new category called “Open Source Stewards” for entities like software foundations, which have a reduced set of obligations without fines. He also mentions the timeline for the CRA, stating in will come into force around summertime 2027, after being officially signed.
[00:16:09] Richard asks about the CRA’s impact on individual non-European developers, like himself, who have repositories on platforms like GitHub or GitLab. Ciarán responds that the specifics of how the CRA will affect such developers will become clear once the standards are developed.
[00:17:55] Ciarán clarifies the role of software foundations is to provide services or procedures for compliance, which may vary across different foundations.
[00:19:36] Richard wonders who benefits from this Act, and Ciarán discusses the justification for the CRA, which is cost-based, comparing the cybersecurity costs with compliance costs.
[00:21:31] Leslie asks about the process of creating standards for CRA compliance and how average FOSS developers can influence these standards and questions the best ways for FOSS developers to get involved in influencing the outcomes beneficial to the FOSS ecosystem. Ciarán notes that working on standards and policy is complex and compares it to contributing to software development on short notice.
[00:26:07] Ciarán discusses OFE’s multi-layered structure and the FOSS community list, which serves as a base for information sharing and connection.
[00:27:24] Richard questions the impact CRA on individual developers with numerous dependencies in their projects. Ciarán reassures that there is no immediate cause for panic as the CRA will not come into force until summer 2027 and many details will be clarified in the coming years.
[00:28:39] Leslie shifts the discussion the Product Liability Directive (PLD) and its relevance to the FOSS ecosystem and Ciarán goes in depth about it.
[00:33:36] Find out where you can learn more about Ciarán and OFE on the web.
Quotes
[00:04:58] “We’d love to have better cyber security, especially if it just falls from the sky.”
[00:22:31] “Working on standards and policy in general is about as complex as working on software development.”
[00:24:00] “In terms of getting involved, two important things: First is getting in contact with other people, and the second is the need to do some work on your own initiative without having been brought into some of these groups.”
Spotlight
[00:35:35] Leslie’s spotlight is the Open Source in The European Legislative Landscape devroom.
[00:35:59] Richard’s spotlight is the book, “Better Living Through Birding.”
[00:36:42] Ciarán’s spotlight is two books: “Thy Neighbour’s Wife” and “The Life Show.”
Links
SustainOSS (https://sustainoss.org/)
SustainOSS Twitter (https://twitter.com/SustainOSS?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)
SustainOSS Discourse (https://discourse.sustainoss.org/)
[email protected] (mailto:[email protected])
SustainOSS Mastodon (https://mastodon.social/tags/sustainoss)
Open Collective-SustainOSS (Contribute) (https://opencollective.com/sustainoss)
Richard Littauer Socials (https://www.burntfen.com/2023-05-30/socials)
Leslie Hawthorne LinkedIn (https://www.linkedin.com/in/lesliehawthorn/?originalSubdomain=de)
Ciarán O’Riordan LinkedIn (https://www.linkedin.com/in/ciaranor/?originalSubdomain=be)
Ciarán O’Riordan- Presentation of the Cyber Resilience Act (YouTube) (https://www.youtube.com/watch?v=DuQ-QBNezLg)
OpenForum Europe (https://openforumeurope.org/)
OpenForum Europe Events (https://openforumeurope.org/events/)
OpenForum Europe Open Source (https://openforumeurope.org/open-source/)
Open Source Policy Community List (https://groups.google.com/a/openforumeurope.org/g/foss-community)
Sustain Podcast-Episode 125: Astor Nummelin Carlberg of OFE on the Economic Impact of Open Source (https://podcast.sustainoss.org/guests/carlberg)
Product Liability Directive 1985 (https://en.wikipedia.org/wiki/Product_Liability_Directive_1985)
Open Source In The European Legislative Landscape devroom (https://fosdem.org/2024/schedule/track/eu-policy/)
Better Living Through Birding: Notes From A Black Man In The Natural World by Christian Cooper (https://www.penguinrandomhouse.com/books/671722/better-living-through-birding-by-christian-cooper/)
[Thy Neighbour’s Wife by Liam O’Flaherty](https://en.wikipedia.org/wiki/ThyNeighbour%27sWife)
The Life Show by Chi Li (https://www.amazon.sg/Life-Show-Chi-Li/dp/7559421903)
Credits
Produced by Richard Littauer (https://www.burntfen.com/)
Edited by Paul M. Bahr at Peachtree Sound (https://www.peachtreesound.com/)
Show notes by DeAnn Bahr Peachtree Sound (https://www.peachtreesound.com/) Special Guest: Ciarán O'Riordan.

Guest

Ciarán O’Riordan

Panelist

Richard Littauer | Leslie Hawthorne

Show Notes

In this episode, host Richard Littauer and co-host Leslie Hawthorne engage with Ciarán O’Riordan, Senior Policy Advisor from Open Forum Europe (OFE), diving into the intricacies of the Cyber Resiliency Act (CRA) and its implications for the Free and Open Source Software (FOSS) community. Ciarán shares his journey from software development to policy advocacy, emphasizing the critical role of policy work in shaping the future of open source. He provides an in-depth analysis of the CRA, highlighting concerns about its initial draft, the involvement of the FOSS community in shaping its final form, and the potential challenges and opportunities it presents. The discussion also touches on other significant legislative developments in Europe, such as the Product Liability Directive and the AI Act, and their potential effects on open source software. Press download now to hear more!

[00:01:25] Ciarán explains how he became a Senior Policy Advisor, his passion for policy work, tracing his journey from a software developer in Dublin to his 20-year career in Brussels focusing on policy advocacy, including his recent position at OFE.

[00:06:08] Leslie asks Ciarán for a summary of the Cyber Resilience Act (CRA) and its specific implications for the free and open source software ecosystem. Ciarán contrasts the initial and final versions of the CR, detailing the changes made, the lightened obligations for free and open source software, and the ongoing compliance challenges for commercial distributions.

[00:11:02] Leslie inquires how software foundation’s responsible for producing commercialized software are impacted by the Cyber Resilience Act. Ciarán explains that the final version of the Act introduces a new category called “Open Source Stewards” for entities like software foundations, which have a reduced set of obligations without fines. He also mentions the timeline for the CRA, stating in will come into force around summertime 2027, after being officially signed.

[00:16:09] Richard asks about the CRA’s impact on individual non-European developers, like himself, who have repositories on platforms like GitHub or GitLab. Ciarán responds that the specifics of how the CRA will affect such developers will become clear once the standards are developed.

[00:17:55] Ciarán clarifies the role of software foundations is to provide services or procedures for compliance, which may vary across different foundations.

[00:19:36] Richard wonders who benefits from this Act, and Ciarán discusses the justification for the CRA, which is cost-based, comparing the cybersecurity costs with compliance costs.

[00:21:31] Leslie asks about the process of creating standards for CRA compliance and how average FOSS developers can influence these standards and questions the best ways for FOSS developers to get involved in influencing the outcomes beneficial to the FOSS ecosystem. Ciarán notes that working on standards and policy is complex and compares it to contributing to software development on short notice.

[00:26:07] Ciarán discusses OFE’s multi-layered structure and the FOSS community list, which serves as a base for information sharing and connection.

[00:27:24] Richard questions the impact CRA on individual developers with numerous dependencies in their projects. Ciarán reassures that there is no immediate cause for panic as the CRA will not come into force until summer 2027 and many details will be clarified in the coming years.

[00:28:39] Leslie shifts the discussion the Product Liability Directive (PLD) and its relevance to the FOSS ecosystem and Ciarán goes in depth about it.

[00:33:36] Find out where you can learn more about Ciarán and OFE on the web.

Quotes

[00:04:58] “We’d love to have better cyber security, especially if it just falls from the sky.”

[00:22:31] “Working on standards and policy in general is about as complex as working on software development.”

[00:24:00] “In terms of getting involved, two important things: First is getting in contact with other people, and the second is the need to do some work on your own initiative without having been brought into some of these groups.”

Spotlight

[00:35:35] Leslie’s spotlight is the Open Source in The European Legislative Landscape devroom.
[00:35:59] Richard’s spotlight is the book, “Better Living Through Birding.”
[00:36:42] Ciarán’s spotlight is two books: “Thy Neighbour’s Wife” and “The Life Show.”

Links

SustainOSS
SustainOSS Twitter
SustainOSS Discourse
[email protected]
SustainOSS Mastodon
Open Collective-SustainOSS (Contribute)
Richard Littauer Socials
Leslie Hawthorne LinkedIn
Ciarán O’Riordan LinkedIn
Ciarán O’Riordan- Presentation of the Cyber Resilience Act (YouTube)
OpenForum Europe
OpenForum Europe Events
OpenForum Europe Open Source
Open Source Policy Community List
Sustain Podcast-Episode 125: Astor Nummelin Carlberg of OFE on the Economic Impact of Open Source
Product Liability Directive 1985
Open Source In The European Legislative Landscape devroom
Better Living Through Birding: Notes From A Black Man In The Natural World by Christian Cooper
Thy Neighbour’s Wife by Liam O’Flaherty
The Life Show by Chi Li

Credits

Produced by Richard Littauer
Edited by Paul M. Bahr at Peachtree Sound
Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Ciarán O'Riordan.

Support Sustain