WEBVTT
00:00:00.000 --> 00:00:20.009
36C3 preroll music
00:00:20.009 --> 00:00:26.269
Herald: The next talk is "5G & Net
Neutrality". The status of the net
00:00:26.269 --> 00:00:30.869
neutrality reform in Europe and the
presenter is Thomas Lohninger from
00:00:30.869 --> 00:00:35.760
epicenter.works and I'm very happy he's
here today with us. So please give a big
00:00:35.760 --> 00:00:40.769
applause to Thomas Lohninger. Thank you.
00:00:40.769 --> 00:00:43.559
Applause
00:00:43.559 --> 00:00:50.090
Thomas Lohninger: Hello. Here we go again.
Yeah. Hello and welcome, everybody. I'm
00:00:50.090 --> 00:00:56.229
going to talk a little bit about net
neutrality. This is not my first talk
00:00:56.229 --> 00:01:00.770
about this issue here at congress. I
originally joined the net neutrality
00:01:00.770 --> 00:01:06.170
debate because I really found it to be an
important issue. I liked it as a
00:01:06.170 --> 00:01:11.299
philosophical concept of the Internet
serving the edges and also because back
00:01:11.299 --> 00:01:15.070
then it was still a very young debate. You
could still read up on all the legislation
00:01:15.070 --> 00:01:20.340
around the world because there was so
little about it. And a decade later, there
00:01:20.340 --> 00:01:25.150
is more legislation, the debate has moved
on a lot. Of course, in the U.S. it has
00:01:25.150 --> 00:01:30.600
been first and foremost after Trump
repealed the Obama era rules. And in
00:01:30.600 --> 00:01:35.030
Europe, we feel like we're a little bit
stuck in time. And I also want to explain
00:01:35.030 --> 00:01:39.370
where we currently are and where we are
heading. So it is an update, but it's also
00:01:39.370 --> 00:01:43.400
an update with little bit of a
perspective and might even have a silver
00:01:43.400 --> 00:01:48.700
lining. But before we do that, we first
have to go back to the beginning and
00:01:48.700 --> 00:01:53.520
explain what net neutrality is. If you are
in the U.S. and you ask anybody serving
00:01:53.520 --> 00:01:57.290
coffee on the train, they will know it.
But in Europe, it is still something that
00:01:57.290 --> 00:02:02.760
maybe needs to be explained. In general,
net neutrality means that all bits should
00:02:02.760 --> 00:02:07.470
be created equal, that the network should
not make distinctions about our data
00:02:07.470 --> 00:02:12.400
packages, how important they are if the
checksum is correct. Of course, if to
00:02:12.400 --> 00:02:17.280
check some is correct but also a lot like,
is this a valid feature for this
00:02:17.280 --> 00:02:22.950
application? Is this a legal transmission?
All of these decisions should not be made
00:02:22.950 --> 00:02:26.890
in the network because they should be made
by the end points by the applications on
00:02:26.890 --> 00:02:32.680
either side. The easiest way to understand
net neutrality is if you compare it with
00:02:32.680 --> 00:02:38.810
previous global telecommunication
networks. In the television system you
00:02:38.810 --> 00:02:42.980
also have a global communication network
but it takes a lot of money to actually
00:02:42.980 --> 00:02:47.560
have a voice there, to start a television
channel. So you're just consuming, it is
00:02:47.560 --> 00:02:52.750
not a bidirectional network. Telephony
allows that, it's a global network system
00:02:52.750 --> 00:02:57.590
but you have a central entity that decides
if you're allowed to make that call and
00:02:57.590 --> 00:03:02.470
what the cost of that call per duration
will be. That's not the case with the
00:03:02.470 --> 00:03:06.280
Internet. And in a way, net neutrality is
just trying to protect these inherent
00:03:06.280 --> 00:03:11.080
principles that the Internet was born with
from undue discrimination of network
00:03:11.080 --> 00:03:16.820
operators, of telecom companies, or ISPs.
And telecom companies can discriminate or
00:03:16.820 --> 00:03:21.310
interfere with our traffic more or less in
two ways. The first is technical by
00:03:21.310 --> 00:03:26.200
prioritizing or throttling certain data
packages, also modifying them or blocking
00:03:26.200 --> 00:03:32.830
them completely. And the second way to
influence them is by so-called zero rating
00:03:32.830 --> 00:03:37.911
by making certain data more or less
expensive, cheaper, or more expensive, or
00:03:37.911 --> 00:03:43.420
as exempting certain applications from
your monthly data cap at all. And that all
00:03:43.420 --> 00:03:50.290
creates a system where certain big players
have it easier to get rich, to grow, to
00:03:50.290 --> 00:03:56.030
innovate, and others have a harder time to
even being noticed or growing. And it can
00:03:56.030 --> 00:04:00.210
also be summarized by the principle of
innovation without permission so that you
00:04:00.210 --> 00:04:05.290
can just start a new service, you don't
need a license to start an app,
00:04:05.290 --> 00:04:10.580
you don't need to network to support your new
functionality. The open layered
00:04:10.580 --> 00:04:17.079
architecture of the internet is protecting
this innovative capacity, and that even
00:04:17.079 --> 00:04:25.360
allowed this young man in 2004 to create the
Facebook.com in his college dorm. The
00:04:25.360 --> 00:04:30.229
total cost of operating the server in the
beginning was 85$ per month. And you would
00:04:30.229 --> 00:04:32.879
ask yourself: "OK but isn't Mark
Zuckerberg and Facebook really a horrible
00:04:32.879 --> 00:04:36.790
person, the company?" Yes, they are.
That's also why they are against net
00:04:36.790 --> 00:04:43.090
neutrality these days. Facebook is one of
the most violating companies around the
00:04:43.090 --> 00:04:49.230
world because their program free basic,
is really the opposite of net neutrality.
00:04:49.230 --> 00:04:52.330
What they are doing there is basically
creating a walled garden for the global
00:04:52.330 --> 00:04:57.090
south. The most vulnerable people on this
planet that do not get the full internet
00:04:57.090 --> 00:05:03.919
access but what they got is a way of being
marketed to via their Facebook services,
00:05:03.919 --> 00:05:09.160
of course, without any privacy. And
similarly, also, Netflix was once a
00:05:09.160 --> 00:05:14.710
company strongly on our side supporting
net neutrality. And then when it was clear
00:05:14.710 --> 00:05:19.730
that Trump would repeal the Obama era net
neutrality rules, the Netflix CEO said to
00:05:19.730 --> 00:05:24.380
their shareholders: "Don't worry, we are
now big enough that we can survive without
00:05:24.380 --> 00:05:28.690
net neutrality." So inherently, this
principle protects the underrepresented
00:05:28.690 --> 00:05:35.020
voices and the small players, the ones
that still need to grow. And it is not the
00:05:35.020 --> 00:05:38.850
silver stick that will solve all of the
problems from the previous talk to
00:05:38.850 --> 00:05:43.331
problems we have with the big platforms
but if we lose net neutrality, we more or
00:05:43.331 --> 00:05:47.389
less freeze the current dominant players
forever because it would be really hard
00:05:47.389 --> 00:05:53.970
for anybody else to ever become as big.
And so it's all about that right column
00:05:53.970 --> 00:05:59.710
here. Where are we in Europe? In Europe,
we started the discussion around net
00:05:59.710 --> 00:06:03.790
neutrality in 2011/12. There were the
first non-binding resolutions of the
00:06:03.790 --> 00:06:10.020
parliament calling for net neutrality
protections. And it all culminated in 2013
00:06:10.020 --> 00:06:13.759
when the commission released their
proposal for really an anti net
00:06:13.759 --> 00:06:19.350
neutrality bill. So we have to turn the
ship 180° around to get it back on track.
00:06:19.350 --> 00:06:23.979
And we did that with the
savetheinternet.eu campaign, which was
00:06:23.979 --> 00:06:28.670
hosted by big coalition of NGOs all around
Europe. And we followed the legislative
00:06:28.670 --> 00:06:33.419
process for two and a half years with
seven iterations of that campaign always
00:06:33.419 --> 00:06:38.490
changing our means from faxing to the
parliament to making phone calls to just
00:06:38.490 --> 00:06:43.180
mass bombarding the embassies to sending
comments to the regulators in the
00:06:43.180 --> 00:06:48.200
consultation period. We also demonstrated
in Riga, in Barcelona, in Bonn, in
00:06:48.200 --> 00:06:53.539
Brussels, in Vienna. And at the end we got
a net neutrality law. The open internet
00:06:53.539 --> 00:07:00.419
regulation was adopted in 2015 and it was
further, then, implemented by the BEREC
00:07:00.419 --> 00:07:04.840
guidelines that are kind of the handbook
for the guys who actually have to enforce
00:07:04.840 --> 00:07:09.039
the law, telecom regulators. And telecom
regulators will be important in the rest
00:07:09.039 --> 00:07:15.320
of the talk because that's where the
action currently lies. And so this was in
00:07:15.320 --> 00:07:20.260
2016. And in January of 2019, we released
this report, which was really more
00:07:20.260 --> 00:07:26.610
academic exercise of summarizing
everything that has happened since. So
00:07:26.610 --> 00:07:29.511
it's really the one thing you should read
if you want to know how a t neutrality
00:07:29.511 --> 00:07:34.289
has played out over the past two and a
half years. That's a table of content and
00:07:34.289 --> 00:07:39.720
there's a lot of it in there from
analyzing 800 pages of annual reporting,
00:07:39.720 --> 00:07:44.740
going through case law, and looking ahead
about 5G. But the most important thing
00:07:44.740 --> 00:07:48.350
was the chapter about zero rating, because
that's where the debate currently is
00:07:48.350 --> 00:07:53.620
focused on in Europe. And in order to
bring this debate back to a factual basis,
00:07:53.620 --> 00:07:59.420
we actually did a lot of work. With doing
a complete survey of all zero rating
00:07:59.420 --> 00:08:04.710
offers in the European economic area. I
don't think that anything like this was
00:08:04.710 --> 00:08:11.789
ever done before also because it wasn't
easy. We went through 32 countries. So all
00:08:11.789 --> 00:08:15.840
of the European economic area that this
law applies to, including Switzerland,
00:08:15.840 --> 00:08:20.810
because we have German speakers in our
team, so it was not that hard. That meant
00:08:20.810 --> 00:08:26.660
in total, going through the websites of
225 mobile operators, both those that have
00:08:26.660 --> 00:08:32.140
their own network as well as the virtual
ones. And we collected the data with in
00:08:32.140 --> 00:08:37.250
total five people that spoke six languages
and worked for over four months on this.
00:08:37.250 --> 00:08:44.279
We found 186 net neutrality violations in
the form of zero rating programs. And all
00:08:44.279 --> 00:08:49.079
of that data is openly accessible. It's
linked in the report. It's all online in a
00:08:49.079 --> 00:08:55.629
free format and used under a CC BY-SA
license, so share alike.
00:08:55.629 --> 00:09:02.699
Applause
00:09:02.699 --> 00:09:06.829
I've given that talk in front of many
regulators. You're the first ones to
00:09:06.829 --> 00:09:11.559
applaud. I really like that. And the SA,
of course, because we think this data
00:09:11.559 --> 00:09:17.010
should remain free. We can always disagree
on the interpretation but at least the
00:09:17.010 --> 00:09:23.270
facts, the data itself should be openly
accessible to everybody and scrutinized by
00:09:23.270 --> 00:09:27.679
everybody as well. And I've seen other
people actually using that data for
00:09:27.679 --> 00:09:33.720
commercial purposes, which we would even
allow but not sharing it back, which is a
00:09:33.720 --> 00:09:39.699
sad thing. So what is in that dataset? You
could see this zero-rating is really a big
00:09:39.699 --> 00:09:45.129
problem. All but two European countries,
you have these problems. Finland doesn't
00:09:45.129 --> 00:09:49.160
have that problem because they don't have
data caps anymore. If you buy a SIM card
00:09:49.160 --> 00:09:53.699
in Finland, you'll get a flat rate. The
only distinction there is the speed, the
00:09:53.699 --> 00:09:58.649
bandwidth that is available to you. But
you know, I have no data caps at all and
00:09:58.649 --> 00:10:02.950
Bulgaria also doesn't have zero-rating. If
we look at the application side and that's
00:10:02.950 --> 00:10:08.420
actually the very interesting takeaway for
you. These are the applications that most
00:10:08.420 --> 00:10:15.050
profit from zero-rating. So WhatsApp leads
before 50 zero-rating deals in Europe. And
00:10:15.050 --> 00:10:20.339
the second to follow is Facebook and also
Facebook messenger in there. In total,
00:10:20.339 --> 00:10:24.959
many of these companies that profit are
from the U.S., only 3 European
00:10:24.959 --> 00:10:31.179
applications are actually in the top 20 of
zero-rating. And that is the overall
00:10:31.179 --> 00:10:38.360
number and there we just looked at the
geographical home of the applications in
00:10:38.360 --> 00:10:43.330
the classical zero-rating programs. You
know, the ones where you have a youth
00:10:43.330 --> 00:10:50.100
tariff in Portugal and you can pick either
WhatsApp or Telegram or you have YouTube
00:10:50.100 --> 00:10:55.189
is for free. Some ISP is actually do that.
And if you just look at these close
00:10:55.189 --> 00:11:00.339
programs of only have hand selected
applications, the majority of the apps are
00:11:00.339 --> 00:11:04.829
from the U.S., of course, the big
incumbents. But there is also around a
00:11:04.829 --> 00:11:11.310
third of applications which are of zero-
rating programs which are open. Open
00:11:11.310 --> 00:11:16.269
programs allow other applications to join.
Think of StreamOn here in Germany or
00:11:16.269 --> 00:11:21.879
Vodafone Pass or smartnet in Portugal.
These programs are actually trying to
00:11:21.879 --> 00:11:26.739
balance the scale a little bit. They are
actually trying to learn from our critique
00:11:26.739 --> 00:11:32.970
and allow other applications to join. And
then if we add those to statistics, we
00:11:32.970 --> 00:11:37.170
see that the majority of apps are suddenly
from the same country where the internet
00:11:37.170 --> 00:11:40.790
service is offered. All of these local
radio stations in Germany, for some
00:11:40.790 --> 00:11:44.769
reason, join StreamOn in order to be
exempt from the data volume, the
00:11:44.769 --> 00:11:49.569
ridiculously low data volume from Deutsche
Telekom. And then into second place is
00:11:49.569 --> 00:11:54.420
still have the U.S. and most
interestingly, the European economic area.
00:11:54.420 --> 00:12:00.670
So apps from other EU countries are really
down below. So one could easily make the
00:12:00.670 --> 00:12:05.060
interpretation of that data that we
actually create new barriers for cross-
00:12:05.060 --> 00:12:10.779
border provisioning of services in the
European digital single market. And if you
00:12:10.779 --> 00:12:17.109
then just count, how many of these zero-
rating programs does an app usually join.
00:12:17.109 --> 00:12:21.149
You have a stark pick fit one to three and
then it drastically goes down until you
00:12:21.149 --> 00:12:26.570
have the 31 - 52 column at the right,
which is the top 20. So there is an
00:12:26.570 --> 00:12:30.600
inherent difficulty to actually sign up to
these so-called open nondiscriminatory
00:12:30.600 --> 00:12:36.459
zero-rating programs. What Europe has
created here is actually another reason
00:12:36.459 --> 00:12:40.790
why it will be difficult for the European
internet industry to be competitive
00:12:40.790 --> 00:12:46.360
because these are all new entry barriers
into markets in other EU countries. And we
00:12:46.360 --> 00:12:51.639
really have to explain this to the
regulators. And if you just go and take the
00:12:51.639 --> 00:12:55.059
perspective of an application, you want to
join a zero-rating program, what do you
00:12:55.059 --> 00:12:59.929
have to do? First, you have to find out
that it even exists. We did that mapping
00:12:59.929 --> 00:13:04.639
because we didn't know. And there is no
agency that also sells that data. So
00:13:04.639 --> 00:13:07.529
obtaining knowledge about the programs
that you might want to join because you
00:13:07.529 --> 00:13:12.990
might want to offer a competitive service
to people in that country of that ISP is
00:13:12.990 --> 00:13:17.759
the first step. And then secondly, you
have to request the documents, sign an NDA
00:13:17.759 --> 00:13:22.309
even, to even find out how the open
Internet works with this mobile operators.
00:13:22.309 --> 00:13:26.649
Third, you have to read the contract for
which for many start-ups is already a
00:13:26.649 --> 00:13:31.359
problem. Sign it and prepare for the
liability because you are liable for
00:13:31.359 --> 00:13:37.029
wrongfully billed data volume, which can
be really problematic. If your app is
00:13:37.029 --> 00:13:43.619
producing a lot of data or widely used by
certain people. The technical aspect that
00:13:43.619 --> 00:13:47.819
comes into play here is that of course you
are then responsible for providing
00:13:47.819 --> 00:13:53.559
identification criteria. If suddenly your
data packages need to be counted
00:13:53.559 --> 00:13:58.949
differently, go against not a general data
volume but an application specific volume
00:13:58.949 --> 00:14:03.569
per month or are completely exempt from
the data cap. Then you, in order to make
00:14:03.569 --> 00:14:07.850
that assessment, need to identify those
data packages, which of course only works
00:14:07.850 --> 00:14:13.439
with deep packet inspection in most cases.
In some cases, you also have to modify
00:14:13.439 --> 00:14:19.879
your service in order to even enter into
that deal. Spotify in Germany with
00:14:19.879 --> 00:14:24.940
StreamOn only wanted their premium
customers to benefit from the zero-rating.
00:14:24.940 --> 00:14:29.459
And they tried to separate the ad-based
free version of the Spotify program from
00:14:29.459 --> 00:14:34.569
the premium customers that are paying.
They tried for four months. Then they gave
00:14:34.569 --> 00:14:39.449
up. So the business decision of that app
provider was directly affected by these
00:14:39.449 --> 00:14:45.439
zero-rating programs. Next, whenever you
make a change to your own service or
00:14:45.439 --> 00:14:49.949
infrastructure, you change your CDN
provider or whatever you have to give 30
00:14:49.949 --> 00:14:56.629
days prior notice to the ISP so that they
can change their DPI equipment to adopt
00:14:56.629 --> 00:15:01.799
this change, which of course is a big
hindrance for innovation and in some
00:15:01.799 --> 00:15:06.490
contracts that we've analyzed, it also
includes giving access to beta versions of
00:15:06.490 --> 00:15:10.959
your own app. And lastly, in the case of
Vodafone, you also have to sign and
00:15:10.959 --> 00:15:17.730
execute marketing agreement so they want
to advertise with your app. So there is a
00:15:17.730 --> 00:15:22.350
lot of hoops to jump through in order to
be admitted into one of these zero-rating
00:15:22.350 --> 00:15:26.100
programs. So you'd think at least they'd
do a lot of effort on the telco side to
00:15:26.100 --> 00:15:31.519
make it easier for you. So for this
survey, we actually created a fake
00:15:31.519 --> 00:15:36.569
application and we tried to apply to zero-
rating programs. We said "Hello. We are a
00:15:36.569 --> 00:15:40.569
student group. We are working out of a
garage. We have that cool app. We want to
00:15:40.569 --> 00:15:44.119
join your program." And we just counted
the duration until we got a response. In
00:15:44.119 --> 00:15:49.649
two cases we got a response within a day,
in five cases we got a response within a
00:15:49.649 --> 00:15:54.569
week, in one case within a month, and in
half of the cases we never got a response
00:15:54.569 --> 00:16:00.220
at all - so not after three months, they
never got back to us. So that truly shows
00:16:00.220 --> 00:16:04.499
that there is a big problem with these
open programs. And I'm going to soon show
00:16:04.499 --> 00:16:10.549
you how the regulators have reacted to
this report in their reform. But another
00:16:10.549 --> 00:16:15.009
more general thing is speed testing
because in Europe, net neutrality also
00:16:15.009 --> 00:16:21.730
brought us the right to contractually
agreed speeds, for our Internet access. In no
00:16:21.730 --> 00:16:26.830
other area and economy, You would buy up
to 8 apples for 5€. But in Internet, for
00:16:26.830 --> 00:16:32.499
some reason, that's the case. And so the
European Parliament was keen to adopt
00:16:32.499 --> 00:16:37.079
rules that were giving each and every
consumer in their contract at a minimum,
00:16:37.079 --> 00:16:41.999
an average and the maximum speed that an
ISP has to deliver. But how do you then
00:16:41.999 --> 00:16:45.629
measure the speed ? Speedtest.net is
really not a good site if you look at
00:16:45.629 --> 00:16:49.089
their business model. So regulators are
often the ones that should offer these
00:16:49.089 --> 00:16:56.269
speed tolls. And BEREC recently released
an open source speed test measurement tool
00:16:56.269 --> 00:17:01.199
that hopefully will also change another
problem that are going to show you. In
00:17:01.199 --> 00:17:05.360
Norway, the telecom regulator Nkom is
actually really good at showing how the
00:17:05.360 --> 00:17:09.910
Internet is improving year by year in the
country. And of course, fiber is hitting
00:17:09.910 --> 00:17:14.470
through the roof and it's really good. And
in general, we see that the Internet is
00:17:14.470 --> 00:17:21.549
improving healthily and the supply is
increasing to meet the demand. Austria -
00:17:21.549 --> 00:17:25.630
similar picture - regulators reporting the
numbers every year. So we know how the
00:17:25.630 --> 00:17:29.309
Internet is actually developing in these
countries. You would assume that in
00:17:29.309 --> 00:17:34.130
Western countries this is a given. It is
also an obligation under the law. They
00:17:34.130 --> 00:17:38.049
really have to do that. But sadly, only
eight countries are actually reporting
00:17:38.049 --> 00:17:44.169
figures. If the internet supply is
actually increasing. Twenty three
00:17:44.169 --> 00:17:49.860
countries released no numbers at all about
whether the internet capacity is actually
00:17:49.860 --> 00:17:54.230
constantly meeting the increasing demand,
which we see as a big problem,
00:17:54.230 --> 00:17:59.260
particularly with 5G, because that will
mean that the last mile will suddenly
00:17:59.260 --> 00:18:04.049
be very fast, but the rest of the network
to core, the backhaul, this is where the
00:18:04.049 --> 00:18:08.279
next bottleneck will lie. And if we don't
invest there soon enough, we'll really
00:18:08.279 --> 00:18:14.510
have a big infrastructural problem in the
foreseeable future. So coming to the
00:18:14.510 --> 00:18:20.059
reform. So what is on the table? First,
this is not a legislative reform. Contrary
00:18:20.059 --> 00:18:23.350
to the previous talk that I've given, this
is not about engaging with the commission
00:18:23.350 --> 00:18:28.080
to parliament or the council. This is all
about the regulatory community, like with
00:18:28.080 --> 00:18:33.080
the GDPR privacy law it's great when we as
activists proud our head and shoulders that
00:18:33.080 --> 00:18:39.149
we actually managed to get a law approved
and then the sad awakening comes. Okay.
00:18:39.149 --> 00:18:43.179
But the guys who are in charge with
enforcing the law are really not
00:18:43.179 --> 00:18:47.529
particularly motivated to do so. And then
you are stuck in Ireland with the data
00:18:47.529 --> 00:18:52.130
protection authority for years. And your
biggest problem is that they are not doing
00:18:52.130 --> 00:18:56.919
their job. Similarly, in telecom
regulation, what we have found is the
00:18:56.919 --> 00:19:01.900
biggest problem is to get the regulator to
do their job. And that needs a lot of name
00:19:01.900 --> 00:19:06.950
calling and submissions and talks with
them, which is really frustrating because
00:19:06.950 --> 00:19:12.000
it should not be the jobs of activists to
enforce legislation. It should be the task
00:19:12.000 --> 00:19:19.720
of well funded regulators. So in that
reform, we are kind of in the middle. The
00:19:19.720 --> 00:19:25.730
scope was released in 2018. In May, we had
an official stakeholder workshop which
00:19:25.730 --> 00:19:31.039
went for five hours and was a busy
gladiator debate. And October/November the
00:19:31.039 --> 00:19:34.610
draft guidelines were released and
publicly consulted. About 50 stakeholders
00:19:34.610 --> 00:19:39.909
participated, we were one of them. And now
BEREC has all of the input on their draft
00:19:39.909 --> 00:19:46.039
guidelines and most likely in Q1 2020 will
see an interim report summarizing that
00:19:46.039 --> 00:19:50.580
consultation, which again will be
consulted. We would like that to happen
00:19:50.580 --> 00:19:54.330
because it would allow us to respond to
comments from the telecom industry and to
00:19:54.330 --> 00:19:59.529
kind of have a more Ping-Pong debate. And
finally, that all should come to a close
00:19:59.529 --> 00:20:05.690
in June 2020 when the new rules are
adopted. So now I'm gonna go into what is
00:20:05.690 --> 00:20:11.919
actually in that draft and what to expect
content-wise from the topic. As you have
00:20:11.919 --> 00:20:15.750
seen in the title, what we are mostly
talking about these days is 5G, the next
00:20:15.750 --> 00:20:19.820
mobile network generation. You must have
heard about it. The telecom industry
00:20:19.820 --> 00:20:25.250
really has spent millions and millions in
advertisement to make people interested in
00:20:25.250 --> 00:20:30.850
5G. We have that whole trade war between
Trump and Huawei going on and there are
00:20:30.850 --> 00:20:37.029
people talking about health risk, which is
mostly overblown but still 5G is really
00:20:37.029 --> 00:20:42.570
portrayed as the revolutionary new
technology. Sadly, that's quite far away
00:20:42.570 --> 00:20:49.190
from the truth. 5G is an evolution. If
you've listened to the talk yesterday
00:20:49.190 --> 00:20:53.429
morning in German about the path from 4G
to 5G, you will know that technology wise
00:20:53.429 --> 00:21:01.010
5G is a very interesting technology. And
as a nerd, I find it interesting but.. The
00:21:01.010 --> 00:21:04.529
only thing that's a given is that internet
will become faster. All of the other
00:21:04.529 --> 00:21:08.840
promises you should take with a grain of
salt. There are two particular
00:21:08.840 --> 00:21:14.880
technology aspects of 5G that I want to
talk about in more detail. The first is
00:21:14.880 --> 00:21:21.620
Network Slicing. The title already gives
it away. Network slicing means you slice
00:21:21.620 --> 00:21:29.149
the network and every slice, every layer
has different quality characteristics. So
00:21:29.149 --> 00:21:32.419
it's basically QoS on the radio access
layer. So it's basically allowing you to
00:21:32.419 --> 00:21:39.100
have one SIM card with several internet
accesses to it. So you could have one that
00:21:39.100 --> 00:21:44.000
is very high bandwidth super fast for
Netflix, one for very low latency for
00:21:44.000 --> 00:21:48.159
gaming, one for very low energy
consumption. So when your battery goes
00:21:48.159 --> 00:21:53.590
below 20% or you'll have solar powered IoT
sensors, then you might want to use that
00:21:53.590 --> 00:21:57.169
because you actually don't care about
bandwidth, you don't care that much about
00:21:57.169 --> 00:22:02.610
reliability, but you only have tiny
battery or solar power. And it actually is
00:22:02.610 --> 00:22:09.120
good that we'll have that technology. But
the question is then who gets which slice?
00:22:09.120 --> 00:22:14.240
And that's where the regulators in the
business models get back into gear. The
00:22:14.240 --> 00:22:18.860
one scenario in which we could see
networks slices being marketed to us is an
00:22:18.860 --> 00:22:23.029
a per subscriber basis. So you have that
one SIM card and it allows you to have
00:22:23.029 --> 00:22:27.919
several independent Internet access
services that are also separated from each
00:22:27.919 --> 00:22:34.559
other. And you as a user are in control.
Which app gets which slice? You should not
00:22:34.559 --> 00:22:37.770
assume that all of these slices will be
flat rate. It could be that you have a
00:22:37.770 --> 00:22:42.510
normal internet access but a very high
bandwidth or low latency slice is capped
00:22:42.510 --> 00:22:46.540
with two gigabytes per month. And so it
actually is important that we as
00:22:46.540 --> 00:22:52.779
subscribers have a say in that. The second
way in which network slices could hit us,
00:22:52.779 --> 00:22:58.110
is a specialized services. So, there the
access service, the pipe, is the same
00:22:58.110 --> 00:23:04.120
thing as the application that runs over
it. So it's no longer universal access. It
00:23:04.120 --> 00:23:07.440
is no longer something that connects you
to the whole internet but it's basically
00:23:07.440 --> 00:23:13.590
just not a power plug but a Facebook plug.
And we have few safeguards, five in total
00:23:13.590 --> 00:23:19.350
in the regulation that are kind of protecting
us against specialized services becoming
00:23:19.350 --> 00:23:25.470
too widespread. But this is where we'll
see a lot of "innovation" from the telecom
00:23:25.470 --> 00:23:30.320
industry to vertically integrate, try to
have Facebook as a separately sold product
00:23:30.320 --> 00:23:37.270
or maybe Facebook, Oculus Rift, VR or
maybe some IoT vertical integration, which
00:23:37.270 --> 00:23:41.649
some smart home shit. So stuff like that
will most likely happen and 5G gives them
00:23:41.649 --> 00:23:47.539
more argumentation basis for these types
of vertically integrated products. But
00:23:47.539 --> 00:23:52.990
that's something for the enforcement. And
lastly, which was our original fear, is
00:23:52.990 --> 00:23:57.990
that a network license would be applied on
a per application basis. So, Google could
00:23:57.990 --> 00:24:03.940
make a deal and suddenly they are under
high reliability slice - always. And this
00:24:03.940 --> 00:24:09.259
is thankfully not the case in the current
draft, so we could already prevent with
00:24:09.259 --> 00:24:14.090
the work in the previous years this
scenario from being a likely result of
00:24:14.090 --> 00:24:20.529
that reform, which is good because as I
show you later, these rules in Europe will
00:24:20.529 --> 00:24:25.850
have repercussions. The second technology
aspect of 5G that merits some discussion
00:24:25.850 --> 00:24:31.610
is edge computing and it's kind of
breaking the principle of end-to-end. You
00:24:31.610 --> 00:24:35.980
no longer have desktops or mobile devices
that are connected to one Internet,
00:24:35.980 --> 00:24:40.670
whereas you have suddenly some
computational power on the cell tower, on
00:24:40.670 --> 00:24:45.360
a very close datacenter connected with
fiber lines so that the whole purpose here
00:24:45.360 --> 00:24:52.580
is very low latency. The industry is
marketing this as something really great,
00:24:52.580 --> 00:24:57.190
something that will be heavily needed.
Actually, there is very little real use
00:24:57.190 --> 00:25:02.570
cases out there that I think are
realistic. The only one that we could find
00:25:02.570 --> 00:25:06.769
and that merits discussion is local
dynamic maps. So it's basically if you
00:25:06.769 --> 00:25:12.850
think of a future in which self-driving
cars all have their own sensory data and
00:25:12.850 --> 00:25:17.399
that sensory data is then cached in this
edge-called cloud. So you have a 3-D
00:25:17.399 --> 00:25:23.499
model that knows from the car that has gone
around the same curve for a minute ago that
00:25:23.499 --> 00:25:27.320
there is a traffic jam over there. And so
your car would know before you even passed
00:25:27.320 --> 00:25:33.670
that curve. It is telling that even the
European Commission backed a Wi-Fi based
00:25:33.670 --> 00:25:39.409
mesh network standard and not 5G, which
means even that very weak example of edge
00:25:39.409 --> 00:25:44.769
computing is kind of discredited in
Europe. So we have good cases for the
00:25:44.769 --> 00:25:49.299
global reform. And when we talk about 5G,
it's important to stress that this is a
00:25:49.299 --> 00:25:55.120
global standard. 3GPP, an international
body is standardizing the technology for
00:25:55.120 --> 00:26:01.080
5G and now it's being rolled out step by
step in the rest of the world. The U.S.,
00:26:01.080 --> 00:26:04.389
of course, will not be helpful with that
because they are heavily investing in 5G
00:26:04.389 --> 00:26:08.490
but they are no longer net neutrality
standards to test this new technology
00:26:08.490 --> 00:26:14.110
against. Canada, great net neutrality law,
but not taking a front seat approach to
00:26:14.110 --> 00:26:19.540
5G. So they are not actively engaging with
it. India great net neutrality, again not
00:26:19.540 --> 00:26:24.659
interested in 5G yet. South Korea,
actually, our colleagues there could
00:26:24.659 --> 00:26:31.419
prevent a repeal of the net neutrality
legislation in South Korea. But they tried
00:26:31.419 --> 00:26:38.009
to regulatory sandbox net neutrality from
5G to just let the net neutrality rules
00:26:38.009 --> 00:26:42.360
that are already weak in South Korea to
begin with not apply to that technology.
00:26:42.360 --> 00:26:46.330
So Europe is kind of the first world
region that tries to square these two
00:26:46.330 --> 00:26:52.410
things together. And that's why our
approach here might be quite influential.
00:26:52.410 --> 00:26:57.559
Also, if you think of the whole ecosystem
because what does it mean if we have user
00:26:57.559 --> 00:27:01.549
controlled network slices? That means that
on my mobile device, I need to somehow
00:27:01.549 --> 00:27:06.490
also decide which application gets which
slice at which time. And so Google and
00:27:06.490 --> 00:27:13.990
Android - ähm Google and Apple (Freud)
come into play here as well. Another issue
00:27:13.990 --> 00:27:20.029
that we did not at all expect to fight
about is parental control filters. So when
00:27:20.029 --> 00:27:23.179
we fought about this law in the
parliament and in the council in the
00:27:23.179 --> 00:27:28.399
trial, we always had that looming danger
of parental controls, like in the UK. You
00:27:28.399 --> 00:27:32.750
buy an internet subscription and you have
a porn filter on it by default. We could
00:27:32.750 --> 00:27:36.570
kill this in trial. So parental
controls were struck out of the law books
00:27:36.570 --> 00:27:41.710
and for some weird reason I would call it
lobby pressure. The regulators wanted to
00:27:41.710 --> 00:27:47.059
allow this in this reform and we've shot
heavily against it. We got even support
00:27:47.059 --> 00:27:51.220
from the consumer protection
organizations, from BEUC, and we hope
00:27:51.220 --> 00:27:56.029
that we can actually prevent this because
what would it mean? It would mean that
00:27:56.029 --> 00:28:01.330
suddenly in the terms of services, you can
circumvent net neutrality. Usually an ISP
00:28:01.330 --> 00:28:05.320
is, of course, not allowed to just
randomly block websites but parental
00:28:05.320 --> 00:28:09.720
controls are exactly that. If you want to
do parental control filtering do it on the
00:28:09.720 --> 00:28:16.340
device but not in the network. Blocking
should always happen on the edge of the
00:28:16.340 --> 00:28:20.919
application, not on the network site. The
picture is more interesting when we talk
00:28:20.919 --> 00:28:26.399
about zero rating cause they actually took
many of our ideas and also from our report
00:28:26.399 --> 00:28:32.179
into consideration. The draft that was
released in October actually contains even
00:28:32.179 --> 00:28:36.429
the same language of open zero rating
programs. And it says they have to be
00:28:36.429 --> 00:28:41.870
fair, everyone needs to get a response,
they have to be reasonable, so all
00:28:41.870 --> 00:28:45.820
documentation should be made public, they
have to be transparent, so if WhatsApp
00:28:45.820 --> 00:28:50.059
calls or Spotify ads are actually counting
towards you data cap and are not zero-
00:28:50.059 --> 00:28:55.889
rated, you should least tell the customer
and they have to be non-discriminatory. So
00:28:55.889 --> 00:28:59.919
Vimeo gets the same response time as
YouTube. These are all our critical
00:28:59.919 --> 00:29:04.200
points. I'm very thankful that they have
listened to us but sadly, they are also
00:29:04.200 --> 00:29:09.249
allowing ISP to simply don't give a fuck
and have non-open programs, so they have
00:29:09.249 --> 00:29:14.309
not drawn a red line. They have not said
clearly we have these types of zero-rating
00:29:14.309 --> 00:29:18.160
programs, which are okay and then we have
all of these others that you have to
00:29:18.160 --> 00:29:27.200
follow these rules for. And that is just a
level of lack of opportunity and a missed
00:29:27.200 --> 00:29:32.100
opportunity for the regulators because
whenever the rules are fuzzy and
00:29:32.100 --> 00:29:37.679
unclear,that only creates problems further
down the road in enforcement. The last
00:29:37.679 --> 00:29:41.450
issue was also kind of unexpected. In the
beginning, because I thought we've solved
00:29:41.450 --> 00:29:46.970
that. Deep packet inspection. So deep
packet inspection means when an ISP is
00:29:46.970 --> 00:29:51.309
looking into your data packages. So he's
looking closely into what you are actually
00:29:51.309 --> 00:29:57.429
doing online, your concrete user behavior.
The domains you access, the URLs you
00:29:57.429 --> 00:30:01.399
access, that means your sexual
preferences, your news preferences, which
00:30:01.399 --> 00:30:06.169
videos you have watched, all of that.
Usually that should be prohibited.
00:30:06.169 --> 00:30:10.110
Everything that's payload of transport
layer 4 should be off limit for an ISP.
00:30:10.110 --> 00:30:14.169
That's the general definition of deep
packet inspection. And actually we thought
00:30:14.169 --> 00:30:19.210
that we've won that. But then there were
rumors that deep packet inspection, they
00:30:19.210 --> 00:30:24.380
want to open it up and allow it again. So
we launched an open letter which was
00:30:24.380 --> 00:30:29.639
signed by 45 NGOs, academics, and privacy
experts. But we still felt like this is a
00:30:29.639 --> 00:30:35.309
hard push. We knew the regulators on the
other side - Germany is one of them - that
00:30:35.309 --> 00:30:40.830
were just because of lobby pressure,
really asking for ex post allowing deep
00:30:40.830 --> 00:30:50.980
packet inspection. And in that moment,
Gandalf came and we really got support
00:30:50.980 --> 00:30:56.240
from an unexpected friend. The highest
data protection body in the European
00:30:56.240 --> 00:31:03.159
Union, EDPB, issued a letter to BEREC and
saying that the board considers the
00:31:03.159 --> 00:31:07.341
processing of data such as domain names
and URLs by Internet access service
00:31:07.341 --> 00:31:12.659
providers for traffic management and
billing purposes, it's unlawful unless
00:31:12.659 --> 00:31:18.470
consent of all users is obtained. And that
is interesting because of course all users
00:31:18.470 --> 00:31:24.279
means that it will never work because
I as a customer of my telco, can maybe
00:31:24.279 --> 00:31:30.009
consent to that, but not the rest of the
internet that might send a data package
00:31:30.009 --> 00:31:34.379
down my way. They're not just saying this
for their net neutrality law, they are
00:31:34.379 --> 00:31:39.850
also saying it for their interpretation of
e-privacy, of the GDPR, all of the other
00:31:39.850 --> 00:31:43.629
laws. So this is actually giving us even
more sticks to go after deep packet
00:31:43.629 --> 00:31:48.009
inspection in the future of that legal
opinion. And lastly, a completely
00:31:48.009 --> 00:31:53.659
unrelated reform but still plays into this
whole thing. In Germany, you can pick your
00:31:53.659 --> 00:31:58.789
own router. It doesn't matter which ISP
you have. You have the right to buy a
00:31:58.789 --> 00:32:03.370
router from anywhere, even an open source
or libre one. And it needs to be able to
00:32:03.370 --> 00:32:06.929
connect to your internet access service.
That is not the case in many European
00:32:06.929 --> 00:32:11.129
countries because it is often unclear
where does the network actually end and
00:32:11.129 --> 00:32:15.289
where does my home network begin. And that
network termination point is one of the
00:32:15.289 --> 00:32:21.809
things that the same body BEREC, the
telecom regulators will decide for us. And
00:32:21.809 --> 00:32:26.030
again, it looks like we will win. Winning
in this sense means that you will have it
00:32:26.030 --> 00:32:30.679
the freedom to choose your own router, you
will have device freedom also in the
00:32:30.679 --> 00:32:35.690
customer premise equipment and the network
ends at the socket, at the wall, at the
00:32:35.690 --> 00:32:39.779
antenna. So it's actually quite good for
user choice. The only counterpoint that I have to
00:32:39.779 --> 00:32:44.039
give you, of course, when the network
ends, net neutrality ends. But if your ISP
00:32:44.039 --> 00:32:49.289
tries to fuck you on your router, you can
just replace it with another device. And
00:32:49.289 --> 00:32:53.150
that's it for the neutrality thing.
And I think we still have some time for Q
00:32:53.150 --> 00:33:01.059
and A. Thanks.
00:33:01.059 --> 00:33:07.669
Applause
00:33:07.669 --> 00:33:18.159
Herald: Yeah. Thank you so much. And don't
leave yet. I wanted to say support
00:33:18.159 --> 00:33:22.460
epicenter.work, support EDRi. We need support,
we need people who believe in this and to
00:33:22.460 --> 00:33:29.869
fight for this and thank you.
00:33:29.869 --> 00:33:33.960
Applause
00:33:33.960 --> 00:33:41.309
Herald: Okay. So, do we have questions? We
have questions from the Internet, maybe -
00:33:41.309 --> 00:33:48.470
not really. Number two, please.
Mic 2: Yes. Have you seen any requirements
00:33:48.470 --> 00:33:53.450
in digital media playback for recording
location information and identifying
00:33:53.450 --> 00:33:57.360
users? So especially the location
information of media playback.
00:33:57.360 --> 00:34:04.100
Lohninger: I'm not sure I follow the
question. So like... you mean like YouTube
00:34:04.100 --> 00:34:06.190
reporting the playback position of the
audience?
00:34:06.190 --> 00:34:09.780
Mix 2: No, not the not the public playback
position, the position or the location of
00:34:09.780 --> 00:34:14.480
the user that is playing back to media.
Lohninger: I'm not sure that that would
00:34:14.480 --> 00:34:21.429
relate to this. So, the ISP, of course,
knows in most cases where the user is, you
00:34:21.429 --> 00:34:30.299
know, in all cases actually, and the
content provider, if it is not localizing
00:34:30.299 --> 00:34:35.960
the user on the app with the location,
then the ISP at least would not share that
00:34:35.960 --> 00:34:41.790
location information. I also wouldn't know
by which API or on which legal basis they
00:34:41.790 --> 00:34:46.330
could do that. I hope that answers the
question, but I'm not sure.
00:34:46.330 --> 00:34:52.080
Herald: Okay, thank you. Okay, we have
another question. Microphone four, please.
00:34:52.080 --> 00:34:58.569
Mic 4: Hi. Will the users have the same
rights if they are not in the home country
00:34:58.569 --> 00:35:01.970
like if you are roaming?
Lohninger: Yeah, that's actually an
00:35:01.970 --> 00:35:08.200
interesting question. So, the net
neutrality regulation is also the roaming
00:35:08.200 --> 00:35:12.630
regulation in the EU. These two things a
legally mixed together but they actually
00:35:12.630 --> 00:35:19.490
can be seen completely separate. So when
you are roaming in another country, so my
00:35:19.490 --> 00:35:25.280
Austrian SIM card here in Germany, it is
actually then the German provider that is
00:35:25.280 --> 00:35:30.869
physically providing me the Internet
access service, which has to apply by the
00:35:30.869 --> 00:35:38.230
same European regulation for net
neutrality. In most cases that would not
00:35:38.230 --> 00:35:45.390
mean that there is even a technical or
legal connection to the customer, to the
00:35:45.390 --> 00:35:50.920
ISP in Austria that I have a contract
with. Of course, it gets then interesting
00:35:50.920 --> 00:35:59.349
because that's mostly about the technical
aspect when we look about zero rating. For
00:35:59.349 --> 00:36:03.359
most cases the zero rating would just not
be possible. So if you have StreamOn in
00:36:03.359 --> 00:36:07.460
Germany, you are a customer of T-Mobile,
you are going to Austria and you are in
00:36:07.460 --> 00:36:13.890
the network of some ISP, then the zero-
rating would just not be possible and you
00:36:13.890 --> 00:36:18.690
would just have additional data volume
given to you. There was actually a court
00:36:18.690 --> 00:36:25.060
case about that out of Germany and there's
still ongoing litigation from the consumer
00:36:25.060 --> 00:36:31.450
protection NGO, VZBV in Germany against
Vodafone around that same question. It
00:36:31.450 --> 00:36:37.119
might be differently if you are a German
T-Mobile customer in Austria and roaming
00:36:37.119 --> 00:36:41.520
in the T-Mobile network there because
technically I think it would be possible
00:36:41.520 --> 00:36:47.010
to then apply the zero-rating but I'm not
sure if they actually do that. I think it
00:36:47.010 --> 00:36:50.310
would not be easy and the incentive
usually would also not be there because
00:36:50.310 --> 00:36:55.890
these are very few edge cases that even to
configure and maintain those wouldn't make
00:36:55.890 --> 00:37:01.900
a lot of sense.
Herald: Okay, so next, we have a question
00:37:01.900 --> 00:37:09.020
from the Internet. Dear signal angel.
Signal: So there was a question about DPI.
00:37:09.020 --> 00:37:15.250
Are data protection authorities doing
anything about this and are there any
00:37:15.250 --> 00:37:20.940
enforcements in the European country?
Lohninger: Sadly, no and no but I think
00:37:20.940 --> 00:37:28.579
there is definitely an opportunity there
for enforcement action. And I know many of
00:37:28.579 --> 00:37:33.730
the people that work around strategic
litigation and enforcement of the GDPR.
00:37:33.730 --> 00:37:38.440
They have their hands full because similar
to net neutrality, the great law that
00:37:38.440 --> 00:37:44.150
we've written in the last year is not
taken very seriously by the regulators.
00:37:44.150 --> 00:37:49.670
And I think it will again depend on
activists or other entities bringing
00:37:49.670 --> 00:37:55.420
cases, bringing complaints to data
protection authorities around DPI before
00:37:55.420 --> 00:37:59.750
we see actual movement there. Legally, I
think particularly with that statement
00:37:59.750 --> 00:38:06.099
from the EDPB, it would be an easy win. So
if somebody wants to earn spores or help
00:38:06.099 --> 00:38:11.099
of that, I think it's quite doable case to
bring a complaint against DPI based on
00:38:11.099 --> 00:38:16.030
that legal opinion.
Herald: So you're all part of it again.
00:38:16.030 --> 00:38:22.359
Number two, please.
Mic 2: I want to ask, why the hell should
00:38:22.359 --> 00:38:29.510
the ISP mess around on layer 4 laugh ,
as you described it before?
00:38:29.510 --> 00:38:34.119
Lohinger: That is the current definition
that we have, like the regulation says no
00:38:34.119 --> 00:38:42.480
monitoring of specific content. And BEREC
interpreted that in 2016 it meaning pay a
00:38:42.480 --> 00:38:48.690
load of transport layer 4 should be off
limit. That is the interpretation that the
00:38:48.690 --> 00:38:51.950
regulators have come up with. And that, of
course, was also a political compromise
00:38:51.950 --> 00:38:58.750
like where do you draw the line? And so my
slide there was really based on the 2016
00:38:58.750 --> 00:39:04.300
text of the guidelines.
Herald: Okay. Number one, please.
00:39:04.300 --> 00:39:09.660
Mic 1: So currently an app developer has
to apply for to an ISP to get zero-rated.
00:39:09.660 --> 00:39:14.119
What's to stop an ISP to just zero-rate an
app on its own to gain some market
00:39:14.119 --> 00:39:17.119
advantage.
Lohninger: They can. And there's nothing
00:39:17.119 --> 00:39:22.390
stopping it. And WhatsApp, for example, is
easily just saying "Okay, here's how you
00:39:22.390 --> 00:39:29.609
zero-rate us and we don't even want to
interact with you." There does not need to
00:39:29.609 --> 00:39:34.271
be a bilateral agreement. Of course, ISP
then has the problem if the app provider
00:39:34.271 --> 00:39:39.299
changes their service or infrastructure
and identification criteria should also
00:39:39.299 --> 00:39:45.350
change that the ISP needs to implement
that change before it happens. And so
00:39:45.350 --> 00:39:48.980
that's the reason for the 30 day period.
But again, that problem might not even
00:39:48.980 --> 00:39:54.910
exist for big providers that have
dedicated IP addresses. If your services
00:39:54.910 --> 00:39:58.799
coming out of an CDN and then you would
rely on SNI or other technologies to
00:39:58.799 --> 00:40:04.810
actually be identifiable.
Herald: So we have one more minute and I'm
00:40:04.810 --> 00:40:10.510
sorry to say it's number 4. Thank you,
others. And yeah, probably you can go to
00:40:10.510 --> 00:40:14.200
Epicenter Networks and contact Thomas
there. Thank you.
00:40:14.200 --> 00:40:18.809
Mic 4: Hi. I'm very touched by your
argument about regulation not being
00:40:18.809 --> 00:40:24.050
enforced right now in the EU. In France,
it has been the case about video
00:40:24.050 --> 00:40:31.310
surveillance where the state has stated
that CLIN, the regulators are a
00:40:31.310 --> 00:40:35.799
consultative authority. You know, they
shouldn't enforce. That's what quite
00:40:35.799 --> 00:40:41.250
arterial the association that is doing
most of the work about that said so. I
00:40:41.250 --> 00:40:44.430
don't know where we go from there. You
know, I'm very scared. It's nice that
00:40:44.430 --> 00:40:47.430
you're doing...
Herald: What is the question, please? We
00:40:47.430 --> 00:40:49.550
just have 20 more seconds.
Mic 4: Sorry, my question is, what do you
00:40:49.550 --> 00:40:53.950
think we can do to help enforce regulation
in the EU?
00:40:53.950 --> 00:40:59.280
Lohninger: Big question. There are many
things there, like one of the things that
00:40:59.280 --> 00:41:04.950
is a positive development to look at a
bright side is that more and more digital
00:41:04.950 --> 00:41:09.550
rights NGOs are warming up to strategic
litigation. So ultimately, why are
00:41:09.550 --> 00:41:15.720
regulators not acting? Because on the one
side, they have fundamental rights to law,
00:41:15.720 --> 00:41:19.420
consumer protection. And on the other
side, you have a big, big company that
00:41:19.420 --> 00:41:24.240
will not accept their decision that it
will bring them to court no matter what.
00:41:24.240 --> 00:41:28.270
And so if you're a small regulator with a
limited budget, you can either take the
00:41:28.270 --> 00:41:33.740
uncomfortable decision that, you know, you
will be sued for. Or just duck away and
00:41:33.740 --> 00:41:37.880
then the thing might be over. So that the
risk assessment and the cost calculation
00:41:37.880 --> 00:41:42.750
is currently not in our favor. And that's
why we need to bring more cases. We have
00:41:42.750 --> 00:41:48.579
to make regulators really bear a certain
risk on both sides of the decision. And
00:41:48.579 --> 00:41:52.770
only then will the decision actually move
more to the factual basis. And I mean, I
00:41:52.770 --> 00:41:57.670
know there are many problems in France but
at least CLIN was one of the few DPAs that
00:41:57.670 --> 00:42:02.710
actually issued a few million penalties.
So there is at least some silver lining.
00:42:02.710 --> 00:42:09.700
Herald: Okay, so complain. Support EDRi,
support epicenter.works. Thank you
00:42:09.700 --> 00:42:12.460
for being here and given another applause
to Thomas Lohninger. Thank you so much.
00:42:12.460 --> 00:42:13.460
Applause
00:42:13.460 --> 00:42:14.460
36c3 postroll music
00:42:14.460 --> 00:42:15.960
Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!