34

Suppose Alice develops some software and releases it under an open source licence. She receives just enough money to be counted as "commercial". This may be donations from users, it may be tokens for contributing to a cryptocurrency project, and it may be the software was developed for commission. She then retires, sells her computer, stops checking her email and tends to her garden. The software could be anything, example where critical tools are maintained by people who may want or have to stop working sometime include "The Internet is Being Protected by Two Guys Named Steve" who were largely responsible for OpenSSL (used by almost all servers and involved in the Heartbleed bug) and when the sole maintainer of the library core-js (used by 75% of the top 100 websites) went to prison for 18 months for lack of the money to settle. These would seem to fit the EU description of critical products.

Sometime later, but within five years and the expected product lifetime, a bug is identified that could count as a vulnerability that requires a security update. Alice knows nothing about it and does not provide an update or otherwise handle the issue effectively.

Assuming the EU passes the Cyber Resilience Act (CRA) as currently drafted, would Alice's behaviour breach the law?

As far as jurisdiction is concerned, assume that at least one user is in the EU, Alice may or may not be.

This is mostly based on the Cyber Resilience Act - Factsheet which says among other things:

Manufacturer’s obligations

  • Once sold, manufacturers must ensure that for the expected product lifetime or for a period of five years (whichever is the shorter), vulnerabilities are handled effectively;
  • Security updates to be made available for at least five years.
Improve this question
14
  • 2
    The law does not say that Alice has to write the fix, merely that she is responsible for the fix being written. She could hire Bob to write the fix on her behalf.
    – user1937198
    Commented Oct 30, 2023 at 23:28
  • 1
    Where I'm from donations as a legal tax concept is reserved solely for non-profit organizations. These organizations by the very definition of there founding statements don't make profits and by law are required to serve some sort of humanitarian purpose.
    – Neil Meyer
    Commented Oct 31, 2023 at 10:48
  • 3
    I am not a lawyer, but the phrasing "once sold" seems like it would exclude most FLOSS software that is freely given away by its creators. Perhaps commercial firms that incorporate libre software in their products might incur an obligation to provide security updates.
    – bjmc
    Commented Oct 31, 2023 at 14:43
  • 5
    "went to prison for 18 months for lack of the money to settle." I'm confused by this. The article you reference says he went to jail for killing a pedestrian with a motorbike.
    – JimmyJames
    Commented Oct 31, 2023 at 15:15
  • 7
    Note that in the interpretation suggested in this question, Alice is not only prohibited from retiring, she is not even allowed to die!
    – Hagen von Eitzen
    Commented Nov 1, 2023 at 9:15

3 Answers 3

Reset to default
32

An obvious workaround for individuals would be to operate through a front company and then simply dissolve that front upon retirement.

Provided it is the front which offers the product to market and not the individual developer, the obligations will lapse with the front.

I suspect people who make a few bob as gigging developers are not the main target of this law however. Corporation with serious resources are.

It's worth noting that these rules are not unusual for anyone trading directly with the market.

If you lay brick for money, then you are potentially on the hook for a number of years afterwards for the quality of your workmanship and so on. You can't simply retire suddenly from your legal obligations.

These proposals simply begin to bring commercial software development (as distinct from hobby or employed development) into same world that other trades and professions operate in.

Improve this answer
18
  • 12
    What does "make a few bob as gigging developers" mean?
    – Azor Ahai -him-
    Commented Oct 30, 2023 at 23:19
  • 17
    @AzorAhai-him- “bob” is another term for a shilling; “a few bob” is roughly equivalent to “a few bucks”. The phrase “gigging developers” refers to the “gig economy”, for developers. A specific task for a short-ish period of time, in this case for software development. So put together, “making some money doing temp/freelance work as a software developer”
    – fyrepenguin
    Commented Oct 30, 2023 at 23:51
  • 11
    The difference between brick laying and software development is that it's typical in the construction industry to have defects fixed by a different contractor than the original builder, not the case for software development. So while you're not exempt from legal/financial consequences of a mistake on your last day laying bricks, you're not mandated to go fix it yourself 3 years after retirement.
    – Aubreal
    Commented Oct 31, 2023 at 13:00
  • 5
    @Aubreal, you're not obligated to physically fix the code either - only to arrange a fix. Just like a bricklayer. It's really quite normal in the commercial world that selling things is accompanied by legal responsibilities.
    – Steve
    Commented Oct 31, 2023 at 13:21
  • 27
    "not the main target of this law" -- This dodges a core concern of the question. Laws have consequences beyond the intent of the original drafters.
    – Indigenuity
    Commented Oct 31, 2023 at 14:20
23

The essence of this question is whether Alice, a natural person, is exempt from the EU rules for "economic operators". The EU definition of "economic operator" in the CRA specifically includes natural persons. Therefore, Alice falls under the obligations of the CRA.

Improve this answer
5

I think you are thinking about this in the wrong way:

The act does not make it illegal to retire after having sold software.

It makes it illegal to sell software just before you plan to retire, unless you arrange for someone else to maintain it.

If you want to sell software then you are expected to plan in advance for how that software is going to be maintained. If you plan to not retire for 5 years then you will have to either stick to that plan, or else make sure that someone else maintains the software. Having been paid (including asking for donations) then you are responsible for paying for the software to be maintained.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .