Suppose Alice develops some software and releases it under an open source licence. She receives just enough money to be counted as "commercial". This may be donations from users, it may be tokens for contributing to a cryptocurrency project, and it may be the software was developed for commission. She then retires, sells her computer, stops checking her email and tends to her garden. The software could be anything, example where critical tools are maintained by people who may want or have to stop working sometime include "The Internet is Being Protected by Two Guys Named Steve" who were largely responsible for OpenSSL (used by almost all servers and involved in the Heartbleed bug) and when the sole maintainer of the library core-js (used by 75% of the top 100 websites) went to prison for 18 months for lack of the money to settle. These would seem to fit the EU description of critical products.
Sometime later, but within five years and the expected product lifetime, a bug is identified that could count as a vulnerability that requires a security update. Alice knows nothing about it and does not provide an update or otherwise handle the issue effectively.
Assuming the EU passes the Cyber Resilience Act (CRA) as currently drafted, would Alice's behaviour breach the law?
As far as jurisdiction is concerned, assume that at least one user is in the EU, Alice may or may not be.
This is mostly based on the Cyber Resilience Act - Factsheet which says among other things:
- Once sold, manufacturers must ensure that for the expected product lifetime or for a period of five years (whichever is the shorter), vulnerabilities are handled effectively;
- Security updates to be made available for at least five years.