Franziska Brantner believes that a complete decoupling from China is not the solution. But too much dependence could be painful. Diversification is thus necessary, she says. “We have to turn more strongly to the entire world again.” In an interview with Till Hoppe and Felix Lee, the Parliamentary State Secretary at the German Federal Ministry for Economic Affairs and Climate Action also talks about the pitfalls of a raw materials strategy, strategic stockpiling and a “fair and free trade policy.”
Computers, telephones, household appliances, cars or toys – each of these networked devices is a potential target for a cyberattack, said EU Commissioner Thierry Breton. With the proposal for a Cyber Resilience Act, the Commission wants to break new ground and secure even the last smart washing machine. This is probably necessary – but comes with enormous costs for the industry, Falk Steiner reports.
Friendly handshakes and warm words in Samarkand: At the Shanghai Cooperation Organization summit, Russia’s President Vladimir Putin expressed his gratitude for the “balanced position of our Chinese friends when it comes to the Ukraine crisis.” China’s President Xi Jinping called Putin an “old friend.” For Xi and Putin, the meeting came at the right time, for it was meant to prove that they are far less isolated internationally than many voices in the West claim. But Xi’s Central Asian trip also showed where Beijing’s limits are in its shoulder-to-shoulder relationship with Moscow. Michael Radunski analyzes the encounter.
Ms. Brantner, at the start of their time in office, the Greens announced a turning point for Germany’s China policy. What specifically are you doing differently?
Franziska Brantner: First, we need to analyze exactly what has changed on the Chinese side in recent years. We need an accurate picture of the country’s political and economic development to form the foundation of our policy. Second, we have recently experienced how painful overdependence on a single country can be and how necessary diversification is for our economy. We need to turn our attention back to the entire world. This does not mean that we will completely decouple ourselves from China. However, the changed global situation requires a new assessment.
Many fear another major crisis in the Taiwan conflict like in Ukraine – except that the German economy is far more intertwined with China than with Russia.
China has never been a liberal democracy. Nevertheless, the systemic question is more relevant than it was ten years ago, because Chinese politics have changed significantly, both internally and externally. It remains to be seen what direction the leadership will take after the big party congress in October. In certain sectors, we are highly dependent on imports and exports. These must be consistently reduced through diversification. In addition, greater attention must be paid to the human rights situation. We also have a clear interest in cooperating with China on climate protection. Beijing is a key player in international climate negotiations. The country suffered severe droughts and floods this summer.
Your ministry wants to overturn state investment guarantees for German companies operating in China. That is a very clear signal.
We are not overturning anything, but are examining it closely. If there is clear evidence that forced labor is present in a region where German companies are producing, there will be no state investment guarantees.
The question is what type of investments by German companies will still be supported by the German government.
If we as a government want German companies to diversify more, then we should do the same. And we should also do that with our funding instruments. This does not mean that German companies should withdraw completely from the Chinese market. But in certain key areas, some of them should become less dependent. But this diversification will not happen overnight.
The industry sees the onus on politicians: The Federation of German Industries (BDI) urgently needs new trade agreements to tap into alternative procurement and target markets.
The BDI is right: Only by turning to the world as a whole will we succeed and secure our wealth. But this must be done fairly and sustainably. We are in a rivalry with China, and the other countries are asking: What is our benefit if we cooperate with Europe? They don’t want to be mere raw material suppliers, but want to retain a larger share of the value added and also protect their environment. The water issue, for example, is very relevant in this context. This has changed compared to 20 or 30 years ago.
Is this the kind of free trade that even the Greens can get behind? So far, your party colleagues in the European Parliament have mostly rejected agreements.
We want a fair and free trade policy. The conditions under which the old trade policy operated were not particularly beneficial to us, our partner countries or the climate. We fight in Europe for every ton of CO2, and then we import products from other countries with lower standards. In the end, the climate doesn’t care where the CO2 is generated. To prevent climate dumping, the commitments made in the Paris climate protection agreement are now to be just as binding as other standards. This is already a remarkable success for green policy.
In the trade agreement with Canada, the German government is calling for clarification of investors’ rights to sue. Is the Canadian government open to this?
Yes. Canada ranks third of the countries that have been sued the most in arbitration courts. The arbitration courts were only included in the CETA treaty at the insistence of the EU and, for example, the German government at the time. That’s why the Canadians are telling us they’re okay with clarifications as long as we don’t open up the actual treaty to it, to avoid jeopardizing the ongoing ratification process. Both sides are keen to prevent abusive lawsuits.
The Energy Charter Treaty is to be revised to complicate investor lawsuits against climate policy. Does the German government support the outcome of the negotiations?
We are still in the internal coordination stage. As part of the new trade policy, we have defined clear criteria for the Energy Charter Treaty – it must not conflict with climate policy. There is also a lot going on at the European level right now as it is. The Italians have left the treaty, and Poland will now do the same. Other countries are considering it as well. Therefore, we should not make purely national decisions, but take into account how the opinion in the EU is developing.
You’re also working on a new commodity strategy. Can you give us an update?
We will present an update soon, but think this European right away. The EU Commission will present a Raw Materials Act, and we are providing our input here. But we have to proceed carefully and talk to companies and experts. You can quickly do a lot of damage on the commodity markets.
One of the ideas is strategic stockpiling of critical raw materials. However, the industry is demanding tax incentives for this.
The companies are responsible for the procurement of raw materials, not the state. And it is also in their interest to maintain resilient supply chains. We don’t want to provide state funding, for what is fundamentally the responsibility of the companies. We want to support them in this, through pooled expertise like at the German Mineral Resources Agency, competence centers at the foreign chambers of commerce, but also through targeted government cooperation with partner countries like Canada or Chile. Wherever there are negative government incentives, we will correct them as far as possible. However, stockholding only helps to a limited extent if you are dependent on one supplier. That’s why we must always diversify our sources and processing.
Another aspect is to expand domestic production in Europe, for example of lithium – a sensitive issue for the Greens.
I’m a supporter of it, if it’s done cleanly and sustainably, as is being tested in the Rhine Graben. There, attempts are being made to extract lithium with the help of geothermal energy. Geothermal energy is a good opportunity for heat and lithium – but it has to be handled professionally, charlatans can quickly cause a lot of damage. We therefore rely on the regulated framework.
Higher environmental and social standards usually result in higher prices: How competitive can sustainable mining be in Europe?
If we want to be competitive, we must set European social and environmental standards that also apply to imports. This is also in the interest of supplier countries. There may be far fewer people living in the Atacama Desert in Chile than in the Rhine Graben, but they too want lithium extraction to be water-saving and more energy-efficient.
What role does the EU Supply Chain Law play here?
The Supply Chain Law can help to enable European production and processing. We don’t want our raw materials to come from child labor, and we couldn’t compete with the prices. But we can be technologically superior, use less water and energy. What is also extremely important for us is the idea of circular economy, recycling and substitution.
What should happen here?
So far, we have been quite careless with some critical raw materials that are already available to us in processed form in Europe. Yet these are one of our major reserves. We have a big task here. That’s why we have to make progress with regard to legal foundations, standardization, funding opportunities, faster planning procedures for recycling plants, etc.
The industry is groaning under the high energy prices and argues: Please do not place more burdens on us. Would it be reasonable to put some of the Supply Chain Law on hold?
The law must be designed in such a way that implementation does not become impossible, especially for small and medium-sized enterprises. That is our common interest. But these days it is more important than ever to know where our products actually come from. After all, we can see what high follow-up costs we have to pay if the supply chains don’t work.
How can the documentation obligations be lightened for SMEs?
I hope that we will find good European solutions, and that is what we are working toward. We are also relying on digital support. And the second thing is, of course, that we avoid duplicate reporting obligations as much as possible. In addition, we are trying to coordinate with other Western countries within the framework of the G7, even though that is a bigger task. After all, many SMEs are active in several markets. They often tell me, okay, give me one standard, but not ten. I find that very understandable.
Franziska Brantner answers more questions about German China policy for our colleagues at China.Table.
What seems indisputable about power plants and Internet nodes is that they are critical infrastructures. But how critical are millions of Internet-capable small and micro devices when everything is interconnected?
This very question became acute in 2016, when hundreds of thousands of Internet-connected devices were integrated into the Mirai botnet without the knowledge of their owners and users. Webcams or routers became part of a digital army that was suddenly in the service of botnet operators. It was not only that each infected system helped to find other vulnerable systems.
No, the operators had a different goal: To use what is basically the simplest of all cybersecurity attack methods, the so-called denial-of-service attack. This involves triggering the largest possible amount of data traffic that the respective Internet connections allow in order to render a target either inaccessible or to trigger malfunctions to subsequently break into systems. And when a large number of different systems from different networks are attacked simultaneously, the detection and defense against such a distributed denial of service (DDoS) are a major challenge for IT security departments.
Precisely such end devices and their software are to be subject to clear requirements in the future. The Cyber Resilience Act (CRA) is a complex piece of legislation: It defines basic requirements for IT security – the so-called Security-by-Design principle. The Commission wants to distinguish between two categories:
The first product category with digital elements falls under comparatively few regulations, defined in Annex II to the proposed regulation. However, this already contains interesting aspects, such as an obligation to
An obligation to disclose security vulnerabilities as soon as updates are rolled out also already applies to this category – although criticism has already come from SPD and Pirate members of parliament that called it toothless: The argument is that the Commission has forgotten to stipulate that security updates are clearly mandatory over the expected lifetime of a product.
As expected, the Commission likes its proposal. “Just as we can trust a toy or a fridge with a CE marking, the Cyber Resilience Act will ensure the connected objects and software we buy comply with strong cybersecurity safeguards,” Commission Vice President Margrethe Vestager said Thursday. “It will put the responsibility where it belongs, with those that place the products on the market.”
Annex III of the regulation defines the obligations for products with digital elements that are classified as critical. These include software such as password managers, virus scanners, certain operating systems, microprocessors, application-specific circuits (ASICs) and network devices. This means that distributors will face far more extensive obligations.
In the future, companies will have to declare how they comply with the requirements – a declaration of conformity will become mandatory. But what standards do they have to apply? When do they have to subject products or subproducts to which tests? Parts of the business community are raising warnings about uncertainty in this regard.
“If companies can only launch such products or products based on them on the market with greater difficulty based on this classification, there will be major delays in the use of digital products and components in the EU,” says Wolfgang Weber, Chairman of the ZVEI Executive Board. Instead of purely high-risk lists, the focus must be placed on the concept of the intended use, he demands.
This is also demanded by the German Mechanical Engineering Industry Association (VDMA): Deputy Managing Director Hartmut Rauen is still not satisfied. To avoid manufacturers having to recheck every single element in every context, the proposed regulation stipulates that conformity should be considered met when there is an official standard that is recognized as sufficient. In principle, industry representatives welcome this. However, Rauen criticizes: “The timely availability of harmonized standards will be decisive for the success of the Cyber Resilience Act. In the absence of corresponding standards, bottlenecks in the availability of approved products are inevitable.”
Consumer advocates are pleased that the proposal is now on the table: “In the past, voluntary solutions and industry standards could not improve the situation,” says Ramona Pop, Executive Director of the Federation of German Consumer Organizations. It is “important that no mere self-declarations by manufacturers will suffice.” The consumer association demands that compliance with IT security requirements be certified and audited by authorized and independent bodies – which would once again go well beyond the scope of the current proposal.
The CRA is another building block in a whole series of interlocking EU regulations. The Commission’s draft is riddled with cross-references to other legislation, some of which – like the AI Regulation – are still at a relatively early stage of consultation. Added to this are specific regulations that the CRA is not intended to overhaul, for instance, everything relevant to vehicle type approval or medical devices.
“The central aspect is that the CRA is really more of a capstone and catch-all regulation, for all the areas where we don’t have hard regulations yet,” says Stefan Hessel, a lawyer at Reusch Law who specializes in IT law. “With the CRA, specific cybersecurity obligations will have to be met for every product that is distributed or put on the European market.”
In combination with product liability law, the General Data Protection Regulation, the AI Regulation and the Data Act, Hessel sees two things in store for himself and his clients: A lot of work – and frustration. Small companies in particular, he says, are hardly in a position to comply with and implement all the regulations at once.
Circles familiar with the topic have very different opinions on whether the Cyber Resilience Act will make it through the consultation process and trilogue in this legislative period. Even if very different perspectives see a need for amendments: All those involved recognize the urgency of improving the security of networked devices.
And the transitional provisions envisaged by the Commission are long: Two years are to pass from the date of adoption until the legislation enters into force. Unless relevant changes are made to products on the market at that time, they will not be subject to it. Realistically, this means that the Cyber Resilience Act will probably not take effect until 2026, at the earliest.
Philippe Lamberts’ father owned a small company that produced sauerkraut. In Belgium. However, simply taking over the family business did not appeal to him, and certainly not a company that had to rely on the uncertainties of the weather for successful harvests. So he decided to study engineering and later worked at IBM for about 20 years – for those of you who are younger: Back then, IBM enjoyed an aura comparable to that of Apple today.
Then, the engineer, who also identifies as a Christian, decided to get into politics – with the Belgian Greens, who are united in the “Ecolo” party. In 2009, he bypassed the status of a voluntary party supporter and became a party professional directly when he was elected as an MEP. In 2014, he became co-group leader of the European Greens, alongside Germany’s Rebecca Harms and then Ska Keller, who is now stepping down from her post. Lambert has also announced his retirement after more than a decade on the European stage.
In the 2019 European elections, the Greens became the fourth-strongest political force with 75 MEPs – undoubtedly an electoral success. The rise from 52 to 75 MEPs has moved them from sixth to fourth place in the European Parliament. This puts them behind the Christian Democrats of the EPP, the Socialists and Social Democrats of the S&D, and Renew’s Liberals and “Macronistes”.
Mais voilà. Philippe Lamberts welcomes the fact that political influence within the EU is growing, “but it is still hitting a glass ceiling,” meaning that it is difficult to go beyond the traditional Green voters. In this context, he points to the situation in Sweden, where the Greens have still not broken out of their political niche 40 years after their founding. Or the situation in Southern Europe, where the Greens are still struggling to establish themselves politically.
The future duo will have to try to break through this glass ceiling if they want to reach the “Premier League” of European political parties. To achieve this, they will have to prove that social equity concerns are at the heart of the Green project – to make it attractive to a part of the social democratic voters – and at the same time emphasize that they stand for a free social market economy, which would allow them to score points with some of the liberal voters.
But this must be done while also taking into account the criticism of the Fridays for Future generation, which accuses the party of having lost its will to reshape the system and institutions. Not an easy task.
For Lamberts, reaching the Premier League of political parties means, among other things, electing a Green politician to head a national government. “The Liberals have (note: at the council level) a heavyweight with French President Emmanuel Macron,” Lamberts says. This figure would then serve as a potential magnet for candidates who are interested in the Greens but have not yet converted.
The Brussels MEP has made a name for himself during the financial crisis. In 2013, he launched an EU proposal to cap incomes in the financial industry. “We have reached the limits of a market left to its own devices, which revolves around demands for growth and accumulation of wealth,” he says today. “We are not calling for a state-centered economy, but a market economy” – an economy that does not focus on people living off their wealth and in which human happiness is not defined by the accumulation of wealth and possessions.
Lamberts not only reached attention for positions on the financial world, but also for his rhetoric. In Strasbourg in 2018, for example, he criticized the policies of French President Emmanuel Macron, who was visiting the European Parliament. Macron’s policies “call into question the motto of liberty, equality, fraternity,” Lamberts said, criticizing restrictive domestic policies, arms deals, nuclear power and the shutdown of refugee camps.
The Green politician used the expression “les premiers de cordée,” which translates to “lead climber” – a term that describes leadership qualities and one the state leader is particularly fond of. That is why Lamberts had Macron presented with a climbing rope. Paris still chokes on this rope to this day.
Franziska Brantner believes that a complete decoupling from China is not the solution. But too much dependence could be painful. Diversification is thus necessary, she says. “We have to turn more strongly to the entire world again.” In an interview with Till Hoppe and Felix Lee, the Parliamentary State Secretary at the German Federal Ministry for Economic Affairs and Climate Action also talks about the pitfalls of a raw materials strategy, strategic stockpiling and a “fair and free trade policy.”
Computers, telephones, household appliances, cars or toys – each of these networked devices is a potential target for a cyberattack, said EU Commissioner Thierry Breton. With the proposal for a Cyber Resilience Act, the Commission wants to break new ground and secure even the last smart washing machine. This is probably necessary – but comes with enormous costs for the industry, Falk Steiner reports.
Friendly handshakes and warm words in Samarkand: At the Shanghai Cooperation Organization summit, Russia’s President Vladimir Putin expressed his gratitude for the “balanced position of our Chinese friends when it comes to the Ukraine crisis.” China’s President Xi Jinping called Putin an “old friend.” For Xi and Putin, the meeting came at the right time, for it was meant to prove that they are far less isolated internationally than many voices in the West claim. But Xi’s Central Asian trip also showed where Beijing’s limits are in its shoulder-to-shoulder relationship with Moscow. Michael Radunski analyzes the encounter.
Ms. Brantner, at the start of their time in office, the Greens announced a turning point for Germany’s China policy. What specifically are you doing differently?
Franziska Brantner: First, we need to analyze exactly what has changed on the Chinese side in recent years. We need an accurate picture of the country’s political and economic development to form the foundation of our policy. Second, we have recently experienced how painful overdependence on a single country can be and how necessary diversification is for our economy. We need to turn our attention back to the entire world. This does not mean that we will completely decouple ourselves from China. However, the changed global situation requires a new assessment.
Many fear another major crisis in the Taiwan conflict like in Ukraine – except that the German economy is far more intertwined with China than with Russia.
China has never been a liberal democracy. Nevertheless, the systemic question is more relevant than it was ten years ago, because Chinese politics have changed significantly, both internally and externally. It remains to be seen what direction the leadership will take after the big party congress in October. In certain sectors, we are highly dependent on imports and exports. These must be consistently reduced through diversification. In addition, greater attention must be paid to the human rights situation. We also have a clear interest in cooperating with China on climate protection. Beijing is a key player in international climate negotiations. The country suffered severe droughts and floods this summer.
Your ministry wants to overturn state investment guarantees for German companies operating in China. That is a very clear signal.
We are not overturning anything, but are examining it closely. If there is clear evidence that forced labor is present in a region where German companies are producing, there will be no state investment guarantees.
The question is what type of investments by German companies will still be supported by the German government.
If we as a government want German companies to diversify more, then we should do the same. And we should also do that with our funding instruments. This does not mean that German companies should withdraw completely from the Chinese market. But in certain key areas, some of them should become less dependent. But this diversification will not happen overnight.
The industry sees the onus on politicians: The Federation of German Industries (BDI) urgently needs new trade agreements to tap into alternative procurement and target markets.
The BDI is right: Only by turning to the world as a whole will we succeed and secure our wealth. But this must be done fairly and sustainably. We are in a rivalry with China, and the other countries are asking: What is our benefit if we cooperate with Europe? They don’t want to be mere raw material suppliers, but want to retain a larger share of the value added and also protect their environment. The water issue, for example, is very relevant in this context. This has changed compared to 20 or 30 years ago.
Is this the kind of free trade that even the Greens can get behind? So far, your party colleagues in the European Parliament have mostly rejected agreements.
We want a fair and free trade policy. The conditions under which the old trade policy operated were not particularly beneficial to us, our partner countries or the climate. We fight in Europe for every ton of CO2, and then we import products from other countries with lower standards. In the end, the climate doesn’t care where the CO2 is generated. To prevent climate dumping, the commitments made in the Paris climate protection agreement are now to be just as binding as other standards. This is already a remarkable success for green policy.
In the trade agreement with Canada, the German government is calling for clarification of investors’ rights to sue. Is the Canadian government open to this?
Yes. Canada ranks third of the countries that have been sued the most in arbitration courts. The arbitration courts were only included in the CETA treaty at the insistence of the EU and, for example, the German government at the time. That’s why the Canadians are telling us they’re okay with clarifications as long as we don’t open up the actual treaty to it, to avoid jeopardizing the ongoing ratification process. Both sides are keen to prevent abusive lawsuits.
The Energy Charter Treaty is to be revised to complicate investor lawsuits against climate policy. Does the German government support the outcome of the negotiations?
We are still in the internal coordination stage. As part of the new trade policy, we have defined clear criteria for the Energy Charter Treaty – it must not conflict with climate policy. There is also a lot going on at the European level right now as it is. The Italians have left the treaty, and Poland will now do the same. Other countries are considering it as well. Therefore, we should not make purely national decisions, but take into account how the opinion in the EU is developing.
You’re also working on a new commodity strategy. Can you give us an update?
We will present an update soon, but think this European right away. The EU Commission will present a Raw Materials Act, and we are providing our input here. But we have to proceed carefully and talk to companies and experts. You can quickly do a lot of damage on the commodity markets.
One of the ideas is strategic stockpiling of critical raw materials. However, the industry is demanding tax incentives for this.
The companies are responsible for the procurement of raw materials, not the state. And it is also in their interest to maintain resilient supply chains. We don’t want to provide state funding, for what is fundamentally the responsibility of the companies. We want to support them in this, through pooled expertise like at the German Mineral Resources Agency, competence centers at the foreign chambers of commerce, but also through targeted government cooperation with partner countries like Canada or Chile. Wherever there are negative government incentives, we will correct them as far as possible. However, stockholding only helps to a limited extent if you are dependent on one supplier. That’s why we must always diversify our sources and processing.
Another aspect is to expand domestic production in Europe, for example of lithium – a sensitive issue for the Greens.
I’m a supporter of it, if it’s done cleanly and sustainably, as is being tested in the Rhine Graben. There, attempts are being made to extract lithium with the help of geothermal energy. Geothermal energy is a good opportunity for heat and lithium – but it has to be handled professionally, charlatans can quickly cause a lot of damage. We therefore rely on the regulated framework.
Higher environmental and social standards usually result in higher prices: How competitive can sustainable mining be in Europe?
If we want to be competitive, we must set European social and environmental standards that also apply to imports. This is also in the interest of supplier countries. There may be far fewer people living in the Atacama Desert in Chile than in the Rhine Graben, but they too want lithium extraction to be water-saving and more energy-efficient.
What role does the EU Supply Chain Law play here?
The Supply Chain Law can help to enable European production and processing. We don’t want our raw materials to come from child labor, and we couldn’t compete with the prices. But we can be technologically superior, use less water and energy. What is also extremely important for us is the idea of circular economy, recycling and substitution.
What should happen here?
So far, we have been quite careless with some critical raw materials that are already available to us in processed form in Europe. Yet these are one of our major reserves. We have a big task here. That’s why we have to make progress with regard to legal foundations, standardization, funding opportunities, faster planning procedures for recycling plants, etc.
The industry is groaning under the high energy prices and argues: Please do not place more burdens on us. Would it be reasonable to put some of the Supply Chain Law on hold?
The law must be designed in such a way that implementation does not become impossible, especially for small and medium-sized enterprises. That is our common interest. But these days it is more important than ever to know where our products actually come from. After all, we can see what high follow-up costs we have to pay if the supply chains don’t work.
How can the documentation obligations be lightened for SMEs?
I hope that we will find good European solutions, and that is what we are working toward. We are also relying on digital support. And the second thing is, of course, that we avoid duplicate reporting obligations as much as possible. In addition, we are trying to coordinate with other Western countries within the framework of the G7, even though that is a bigger task. After all, many SMEs are active in several markets. They often tell me, okay, give me one standard, but not ten. I find that very understandable.
Franziska Brantner answers more questions about German China policy for our colleagues at China.Table.
What seems indisputable about power plants and Internet nodes is that they are critical infrastructures. But how critical are millions of Internet-capable small and micro devices when everything is interconnected?
This very question became acute in 2016, when hundreds of thousands of Internet-connected devices were integrated into the Mirai botnet without the knowledge of their owners and users. Webcams or routers became part of a digital army that was suddenly in the service of botnet operators. It was not only that each infected system helped to find other vulnerable systems.
No, the operators had a different goal: To use what is basically the simplest of all cybersecurity attack methods, the so-called denial-of-service attack. This involves triggering the largest possible amount of data traffic that the respective Internet connections allow in order to render a target either inaccessible or to trigger malfunctions to subsequently break into systems. And when a large number of different systems from different networks are attacked simultaneously, the detection and defense against such a distributed denial of service (DDoS) are a major challenge for IT security departments.
Precisely such end devices and their software are to be subject to clear requirements in the future. The Cyber Resilience Act (CRA) is a complex piece of legislation: It defines basic requirements for IT security – the so-called Security-by-Design principle. The Commission wants to distinguish between two categories:
The first product category with digital elements falls under comparatively few regulations, defined in Annex II to the proposed regulation. However, this already contains interesting aspects, such as an obligation to
An obligation to disclose security vulnerabilities as soon as updates are rolled out also already applies to this category – although criticism has already come from SPD and Pirate members of parliament that called it toothless: The argument is that the Commission has forgotten to stipulate that security updates are clearly mandatory over the expected lifetime of a product.
As expected, the Commission likes its proposal. “Just as we can trust a toy or a fridge with a CE marking, the Cyber Resilience Act will ensure the connected objects and software we buy comply with strong cybersecurity safeguards,” Commission Vice President Margrethe Vestager said Thursday. “It will put the responsibility where it belongs, with those that place the products on the market.”
Annex III of the regulation defines the obligations for products with digital elements that are classified as critical. These include software such as password managers, virus scanners, certain operating systems, microprocessors, application-specific circuits (ASICs) and network devices. This means that distributors will face far more extensive obligations.
In the future, companies will have to declare how they comply with the requirements – a declaration of conformity will become mandatory. But what standards do they have to apply? When do they have to subject products or subproducts to which tests? Parts of the business community are raising warnings about uncertainty in this regard.
“If companies can only launch such products or products based on them on the market with greater difficulty based on this classification, there will be major delays in the use of digital products and components in the EU,” says Wolfgang Weber, Chairman of the ZVEI Executive Board. Instead of purely high-risk lists, the focus must be placed on the concept of the intended use, he demands.
This is also demanded by the German Mechanical Engineering Industry Association (VDMA): Deputy Managing Director Hartmut Rauen is still not satisfied. To avoid manufacturers having to recheck every single element in every context, the proposed regulation stipulates that conformity should be considered met when there is an official standard that is recognized as sufficient. In principle, industry representatives welcome this. However, Rauen criticizes: “The timely availability of harmonized standards will be decisive for the success of the Cyber Resilience Act. In the absence of corresponding standards, bottlenecks in the availability of approved products are inevitable.”
Consumer advocates are pleased that the proposal is now on the table: “In the past, voluntary solutions and industry standards could not improve the situation,” says Ramona Pop, Executive Director of the Federation of German Consumer Organizations. It is “important that no mere self-declarations by manufacturers will suffice.” The consumer association demands that compliance with IT security requirements be certified and audited by authorized and independent bodies – which would once again go well beyond the scope of the current proposal.
The CRA is another building block in a whole series of interlocking EU regulations. The Commission’s draft is riddled with cross-references to other legislation, some of which – like the AI Regulation – are still at a relatively early stage of consultation. Added to this are specific regulations that the CRA is not intended to overhaul, for instance, everything relevant to vehicle type approval or medical devices.
“The central aspect is that the CRA is really more of a capstone and catch-all regulation, for all the areas where we don’t have hard regulations yet,” says Stefan Hessel, a lawyer at Reusch Law who specializes in IT law. “With the CRA, specific cybersecurity obligations will have to be met for every product that is distributed or put on the European market.”
In combination with product liability law, the General Data Protection Regulation, the AI Regulation and the Data Act, Hessel sees two things in store for himself and his clients: A lot of work – and frustration. Small companies in particular, he says, are hardly in a position to comply with and implement all the regulations at once.
Circles familiar with the topic have very different opinions on whether the Cyber Resilience Act will make it through the consultation process and trilogue in this legislative period. Even if very different perspectives see a need for amendments: All those involved recognize the urgency of improving the security of networked devices.
And the transitional provisions envisaged by the Commission are long: Two years are to pass from the date of adoption until the legislation enters into force. Unless relevant changes are made to products on the market at that time, they will not be subject to it. Realistically, this means that the Cyber Resilience Act will probably not take effect until 2026, at the earliest.
Philippe Lamberts’ father owned a small company that produced sauerkraut. In Belgium. However, simply taking over the family business did not appeal to him, and certainly not a company that had to rely on the uncertainties of the weather for successful harvests. So he decided to study engineering and later worked at IBM for about 20 years – for those of you who are younger: Back then, IBM enjoyed an aura comparable to that of Apple today.
Then, the engineer, who also identifies as a Christian, decided to get into politics – with the Belgian Greens, who are united in the “Ecolo” party. In 2009, he bypassed the status of a voluntary party supporter and became a party professional directly when he was elected as an MEP. In 2014, he became co-group leader of the European Greens, alongside Germany’s Rebecca Harms and then Ska Keller, who is now stepping down from her post. Lambert has also announced his retirement after more than a decade on the European stage.
In the 2019 European elections, the Greens became the fourth-strongest political force with 75 MEPs – undoubtedly an electoral success. The rise from 52 to 75 MEPs has moved them from sixth to fourth place in the European Parliament. This puts them behind the Christian Democrats of the EPP, the Socialists and Social Democrats of the S&D, and Renew’s Liberals and “Macronistes”.
Mais voilà. Philippe Lamberts welcomes the fact that political influence within the EU is growing, “but it is still hitting a glass ceiling,” meaning that it is difficult to go beyond the traditional Green voters. In this context, he points to the situation in Sweden, where the Greens have still not broken out of their political niche 40 years after their founding. Or the situation in Southern Europe, where the Greens are still struggling to establish themselves politically.
The future duo will have to try to break through this glass ceiling if they want to reach the “Premier League” of European political parties. To achieve this, they will have to prove that social equity concerns are at the heart of the Green project – to make it attractive to a part of the social democratic voters – and at the same time emphasize that they stand for a free social market economy, which would allow them to score points with some of the liberal voters.
But this must be done while also taking into account the criticism of the Fridays for Future generation, which accuses the party of having lost its will to reshape the system and institutions. Not an easy task.
For Lamberts, reaching the Premier League of political parties means, among other things, electing a Green politician to head a national government. “The Liberals have (note: at the council level) a heavyweight with French President Emmanuel Macron,” Lamberts says. This figure would then serve as a potential magnet for candidates who are interested in the Greens but have not yet converted.
The Brussels MEP has made a name for himself during the financial crisis. In 2013, he launched an EU proposal to cap incomes in the financial industry. “We have reached the limits of a market left to its own devices, which revolves around demands for growth and accumulation of wealth,” he says today. “We are not calling for a state-centered economy, but a market economy” – an economy that does not focus on people living off their wealth and in which human happiness is not defined by the accumulation of wealth and possessions.
Lamberts not only reached attention for positions on the financial world, but also for his rhetoric. In Strasbourg in 2018, for example, he criticized the policies of French President Emmanuel Macron, who was visiting the European Parliament. Macron’s policies “call into question the motto of liberty, equality, fraternity,” Lamberts said, criticizing restrictive domestic policies, arms deals, nuclear power and the shutdown of refugee camps.
The Green politician used the expression “les premiers de cordée,” which translates to “lead climber” – a term that describes leadership qualities and one the state leader is particularly fond of. That is why Lamberts had Macron presented with a climbing rope. Paris still chokes on this rope to this day.
