Radio Lockdown Directive Major threat for Free Software on radio devices
Channel: FOSDEM
Date: 2018-03-11

by Max Mehl

At: FOSDEM 2017

Since June 2014 we face an EU directive that threatens all wireless devices.The Radio Equipment Directive requires all devices that are able to send andreceive radio signals to be locked down. This goes much further than the FCClockdown in the US since it doesn't only affect routers but also mobilephones, GPS receivers, and amateur radio operators.

From June 2017 hardware manufacturers will be forced to install technicalmeasurements to protect the devices from being flashed with "non-compliant"software: firmware that hasn't been checked by the manufacturer to comply withapplicable radio regulations (e.g. signal strenght, frequences). Many Europeanstates already have implemented the directive in national law without manyways how to circumvent the major lockdown.

However, we have identified possible ways how to excluded certain classes ofdevices from this directive. The speaker will evaluate the current situation,present additional findings and opinions of political and economic actors, andexchange ideas and knowledge with the audience.

More and more devices connect to the Internet and each other using wirelessand mobile networks. These include countless devices such as routers, mobilephones, WiFi-cards and laptops. All of them, as well as all Internet-of-Thingsdevices, today and in the future, fall under the regulation of the RadioEquipment Directive 2014/53/EU (hereinafter ‘the Directive’), adopted in May2014 by the European Parliament and the European Council. The main purposes ofthe Directive are harmonisation of existing regulations, improving security ofradio spectra, and protection of health and safety.

Many people agree to general purpose of the Directive. However, we express ourconcerns over the far-reaching consequences of Article 3(3)(i) of theDirective, which require device manufacturers to check each device software'scompliance in order to comply with the Directive.

## Threats of Radio Lockdown

We believe such requirement has negative implications on users' rights andFree Software, fair competition, innovation, environment, and volunteering –mostly without comparable benefits for security.

Article 3(3)(i) require device manufacturers to assess software for compliancewith existing national radio regulations, a requirement which will keep usersand companies from upgrading the software on devices they own, unless thatsoftware is assessed by the original manufacturer. This not only is a severeburden for device manufacturers themselves but also violating the customers'rights of free choice.

The requirement enshrined in Article 3(3)(i) will impact the freedom toconduct business of many companies relying on the abillity to providealternative and Free Software firmware on devices. Alternative software is thefoundation of many companies' products, and we should prevent economicdisadvantages for these businesses.

Burdensome requirements to check every possible software's compliance willalso have negative implications on innovation and charitable non-profitorganisations who rely on software other than the manufacturers'. Efforts ofvolunteer associations helping people in need to connect to the internet, maybe rendered void or severely handicapped.

Furthermore, alternative software on radio devices also promotes a sustainableeconomy. There are many devices still in working order which do not receiveupdates from the original manufacturers anymore, hence alternative softwaredeveloped and improved by community efforts (such as Free Software) has a muchlonger support period which prevent users and customers having to dispose ofstill working equipment. In return, this also improves the security of userssince older hardware still receives security updates after a manufacturerstops supporting those.

We are in favor of the Directive's aim to improve security of radio devicesbut not at the unbalanced expense of users' freedom and security in otherareas. Firstly, upgrading the software of a device mostly helps increasing thedevices' security. Secondly, we are convinced that such strict regulations arenot necessary for typical consumer products with limited radio output power.And thirdly, we believe that such technical restrictions will not hinderpeople willingly violating applicable radio regulations.

## Our Proposals

Therefore, we ask EU institutions and the Member States to take these concernsinto consideration and ensure that the Directive does not place blanket,unnecessary and disproportionate restrictions on the rights of consumers andbusinesses when implementing the Directive into national legislations.


Room: H.1301 (Cornil)
Scheduled start: 2017-02-04 16:35:00