36C3 - 5G & Net Neutrality

36C3 preroll music

Herald: The next talk is "5G & Net
Neutrality". The status of the net

neutrality reform in Europe and the
presenter is Thomas Lohninger from

epicenter.works and I'm very happy he's
here today with us. So please give a big

applause to Thomas Lohninger. Thank you.

Applause

Thomas Lohninger: Hello. Here we go again.
Yeah. Hello and welcome, everybody. I'm

going to talk a little bit about net
neutrality. This is not my first talk

about this issue here at congress. I
originally joined the net neutrality

debate because I really found it to be an
important issue. I liked it as a

philosophical concept of the Internet
serving the edges and also because back

then it was still a very young debate. You
could still read up on all the legislation

around the world because there was so
little about it. And a decade later, there

is more legislation, the debate has moved
on a lot. Of course, in the U.S. it has

been first and foremost after Trump
repealed the Obama era rules. And in

Europe, we feel like we're a little bit
stuck in time. And I also want to explain

where we currently are and where we are
heading. So it is an update, but it's also

an update with little bit of a
perspective and might even have a silver

lining. But before we do that, we first
have to go back to the beginning and

explain what net neutrality is. If you are
in the U.S. and you ask anybody serving

coffee on the train, they will know it.
But in Europe, it is still something that

maybe needs to be explained. In general,
net neutrality means that all bits should

be created equal, that the network should
not make distinctions about our data

packages, how important they are if the
checksum is correct. Of course, if to

check some is correct but also a lot like,
is this a valid feature for this

application? Is this a legal transmission?
All of these decisions should not be made

in the network because they should be made
by the end points by the applications on

either side. The easiest way to understand
net neutrality is if you compare it with

previous global telecommunication
networks. In the television system you

also have a global communication network
but it takes a lot of money to actually

have a voice there, to start a television
channel. So you're just consuming, it is

not a bidirectional network. Telephony
allows that, it's a global network system

but you have a central entity that decides
if you're allowed to make that call and

what the cost of that call per duration
will be. That's not the case with the

Internet. And in a way, net neutrality is
just trying to protect these inherent

principles that the Internet was born with
from undue discrimination of network

operators, of telecom companies, or ISPs.
And telecom companies can discriminate or

interfere with our traffic more or less in
two ways. The first is technical by

prioritizing or throttling certain data
packages, also modifying them or blocking

them completely. And the second way to
influence them is by so-called zero rating

by making certain data more or less
expensive, cheaper, or more expensive, or

as exempting certain applications from
your monthly data cap at all. And that all

creates a system where certain big players
have it easier to get rich, to grow, to

innovate, and others have a harder time to
even being noticed or growing. And it can

also be summarized by the principle of
innovation without permission so that you

can just start a new service, you don't
need a license to start an app,

you don't need to network to support your new
functionality. The open layered

architecture of the internet is protecting
this innovative capacity, and that even

allowed this young man in 2004 to create the
Facebook.com in his college dorm. The

total cost of operating the server in the
beginning was 85$ per month. And you would

ask yourself: "OK but isn't Mark
Zuckerberg and Facebook really a horrible

person, the company?" Yes, they are.
That's also why they are against net

neutrality these days. Facebook is one of
the most violating companies around the

world because their program free basic,
is really the opposite of net neutrality.

What they are doing there is basically
creating a walled garden for the global

south. The most vulnerable people on this
planet that do not get the full internet

access but what they got is a way of being
marketed to via their Facebook services,

of course, without any privacy. And
similarly, also, Netflix was once a

company strongly on our side supporting
net neutrality. And then when it was clear

that Trump would repeal the Obama era net
neutrality rules, the Netflix CEO said to

their shareholders: "Don't worry, we are
now big enough that we can survive without

net neutrality." So inherently, this
principle protects the underrepresented

voices and the small players, the ones
that still need to grow. And it is not the

silver stick that will solve all of the
problems from the previous talk to

problems we have with the big platforms
but if we lose net neutrality, we more or

less freeze the current dominant players
forever because it would be really hard

for anybody else to ever become as big.
And so it's all about that right column

here. Where are we in Europe? In Europe,
we started the discussion around net

neutrality in 2011/12. There were the
first non-binding resolutions of the

parliament calling for net neutrality
protections. And it all culminated in 2013

when the commission released their
proposal for really an anti net

neutrality bill. So we have to turn the
ship 180° around to get it back on track.

And we did that with the
savetheinternet.eu campaign, which was

hosted by big coalition of NGOs all around
Europe. And we followed the legislative

process for two and a half years with
seven iterations of that campaign always

changing our means from faxing to the
parliament to making phone calls to just

mass bombarding the embassies to sending
comments to the regulators in the

consultation period. We also demonstrated
in Riga, in Barcelona, in Bonn, in

Brussels, in Vienna. And at the end we got
a net neutrality law. The open internet

regulation was adopted in 2015 and it was
further, then, implemented by the BEREC

guidelines that are kind of the handbook
for the guys who actually have to enforce

the law, telecom regulators. And telecom
regulators will be important in the rest

of the talk because that's where the
action currently lies. And so this was in

2016. And in January of 2019, we released
this report, which was really more

academic exercise of summarizing
everything that has happened since. So

it's really the one thing you should read
if you want to know how a t neutrality

has played out over the past two and a
half years. That's a table of content and

there's a lot of it in there from
analyzing 800 pages of annual reporting,

going through case law, and looking ahead
about 5G. But the most important thing

was the chapter about zero rating, because
that's where the debate currently is

focused on in Europe. And in order to
bring this debate back to a factual basis,

we actually did a lot of work. With doing
a complete survey of all zero rating

offers in the European economic area. I
don't think that anything like this was

ever done before also because it wasn't
easy. We went through 32 countries. So all

of the European economic area that this
law applies to, including Switzerland,

because we have German speakers in our
team, so it was not that hard. That meant

in total, going through the websites of
225 mobile operators, both those that have

their own network as well as the virtual
ones. And we collected the data with in

total five people that spoke six languages
and worked for over four months on this.

We found 186 net neutrality violations in
the form of zero rating programs. And all

of that data is openly accessible. It's
linked in the report. It's all online in a

free format and used under a CC BY-SA
license, so share alike.

Applause

I've given that talk in front of many
regulators. You're the first ones to

applaud. I really like that. And the SA,
of course, because we think this data

should remain free. We can always disagree
on the interpretation but at least the

facts, the data itself should be openly
accessible to everybody and scrutinized by

everybody as well. And I've seen other
people actually using that data for

commercial purposes, which we would even
allow but not sharing it back, which is a

sad thing. So what is in that dataset? You
could see this zero-rating is really a big

problem. All but two European countries,
you have these problems. Finland doesn't

have that problem because they don't have
data caps anymore. If you buy a SIM card

in Finland, you'll get a flat rate. The
only distinction there is the speed, the

bandwidth that is available to you. But
you know, I have no data caps at all and

Bulgaria also doesn't have zero-rating. If
we look at the application side and that's

actually the very interesting takeaway for
you. These are the applications that most

profit from zero-rating. So WhatsApp leads
before 50 zero-rating deals in Europe. And

the second to follow is Facebook and also
Facebook messenger in there. In total,

many of these companies that profit are
from the U.S., only 3 European

applications are actually in the top 20 of
zero-rating. And that is the overall

number and there we just looked at the
geographical home of the applications in

the classical zero-rating programs. You
know, the ones where you have a youth

tariff in Portugal and you can pick either
WhatsApp or Telegram or you have YouTube

is for free. Some ISP is actually do that.
And if you just look at these close

programs of only have hand selected
applications, the majority of the apps are

from the U.S., of course, the big
incumbents. But there is also around a

third of applications which are of zero-
rating programs which are open. Open

programs allow other applications to join.
Think of StreamOn here in Germany or

Vodafone Pass or smartnet in Portugal.
These programs are actually trying to

balance the scale a little bit. They are
actually trying to learn from our critique

and allow other applications to join. And
then if we add those to statistics, we

see that the majority of apps are suddenly
from the same country where the internet

service is offered. All of these local
radio stations in Germany, for some

reason, join StreamOn in order to be
exempt from the data volume, the

ridiculously low data volume from Deutsche
Telekom. And then into second place is

still have the U.S. and most
interestingly, the European economic area.

So apps from other EU countries are really
down below. So one could easily make the

interpretation of that data that we
actually create new barriers for cross-

border provisioning of services in the
European digital single market. And if you

then just count, how many of these zero-
rating programs does an app usually join.

You have a stark pick fit one to three and
then it drastically goes down until you

have the 31 - 52 column at the right,
which is the top 20. So there is an

inherent difficulty to actually sign up to
these so-called open nondiscriminatory

zero-rating programs. What Europe has
created here is actually another reason

why it will be difficult for the European
internet industry to be competitive

because these are all new entry barriers
into markets in other EU countries. And we

really have to explain this to the
regulators. And if you just go and take the

perspective of an application, you want to
join a zero-rating program, what do you

have to do? First, you have to find out
that it even exists. We did that mapping

because we didn't know. And there is no
agency that also sells that data. So

obtaining knowledge about the programs
that you might want to join because you

might want to offer a competitive service
to people in that country of that ISP is

the first step. And then secondly, you
have to request the documents, sign an NDA

even, to even find out how the open
Internet works with this mobile operators.

Third, you have to read the contract for
which for many start-ups is already a

problem. Sign it and prepare for the
liability because you are liable for

wrongfully billed data volume, which can
be really problematic. If your app is

producing a lot of data or widely used by
certain people. The technical aspect that

comes into play here is that of course you
are then responsible for providing

identification criteria. If suddenly your
data packages need to be counted

differently, go against not a general data
volume but an application specific volume

per month or are completely exempt from
the data cap. Then you, in order to make

that assessment, need to identify those
data packages, which of course only works

with deep packet inspection in most cases.
In some cases, you also have to modify

your service in order to even enter into
that deal. Spotify in Germany with

StreamOn only wanted their premium
customers to benefit from the zero-rating.

And they tried to separate the ad-based
free version of the Spotify program from

the premium customers that are paying.
They tried for four months. Then they gave

up. So the business decision of that app
provider was directly affected by these

zero-rating programs. Next, whenever you
make a change to your own service or

infrastructure, you change your CDN
provider or whatever you have to give 30

days prior notice to the ISP so that they
can change their DPI equipment to adopt

this change, which of course is a big
hindrance for innovation and in some

contracts that we've analyzed, it also
includes giving access to beta versions of

your own app. And lastly, in the case of
Vodafone, you also have to sign and

execute marketing agreement so they want
to advertise with your app. So there is a

lot of hoops to jump through in order to
be admitted into one of these zero-rating

programs. So you'd think at least they'd
do a lot of effort on the telco side to

make it easier for you. So for this
survey, we actually created a fake

application and we tried to apply to zero-
rating programs. We said "Hello. We are a

student group. We are working out of a
garage. We have that cool app. We want to

join your program." And we just counted
the duration until we got a response. In

two cases we got a response within a day,
in five cases we got a response within a

week, in one case within a month, and in
half of the cases we never got a response

at all - so not after three months, they
never got back to us. So that truly shows

that there is a big problem with these
open programs. And I'm going to soon show

you how the regulators have reacted to
this report in their reform. But another

more general thing is speed testing
because in Europe, net neutrality also

brought us the right to contractually
agreed speeds, for our Internet access. In no

other area and economy, You would buy up
to 8 apples for 5€. But in Internet, for

some reason, that's the case. And so the
European Parliament was keen to adopt

rules that were giving each and every
consumer in their contract at a minimum,

an average and the maximum speed that an
ISP has to deliver. But how do you then

measure the speed ? Speedtest.net is
really not a good site if you look at

their business model. So regulators are
often the ones that should offer these

speed tolls. And BEREC recently released
an open source speed test measurement tool

that hopefully will also change another
problem that are going to show you. In

Norway, the telecom regulator Nkom is
actually really good at showing how the

Internet is improving year by year in the
country. And of course, fiber is hitting

through the roof and it's really good. And
in general, we see that the Internet is

improving healthily and the supply is
increasing to meet the demand. Austria -

similar picture - regulators reporting the
numbers every year. So we know how the

Internet is actually developing in these
countries. You would assume that in

Western countries this is a given. It is
also an obligation under the law. They

really have to do that. But sadly, only
eight countries are actually reporting

figures. If the internet supply is
actually increasing. Twenty three

countries released no numbers at all about
whether the internet capacity is actually

constantly meeting the increasing demand,
which we see as a big problem,

particularly with 5G, because that will
mean that the last mile will suddenly

be very fast, but the rest of the network
to core, the backhaul, this is where the

next bottleneck will lie. And if we don't
invest there soon enough, we'll really

have a big infrastructural problem in the
foreseeable future. So coming to the

reform. So what is on the table? First,
this is not a legislative reform. Contrary

to the previous talk that I've given, this
is not about engaging with the commission

to parliament or the council. This is all
about the regulatory community, like with

the GDPR privacy law it's great when we as
activists proud our head and shoulders that

we actually managed to get a law approved
and then the sad awakening comes. Okay.

But the guys who are in charge with
enforcing the law are really not

particularly motivated to do so. And then
you are stuck in Ireland with the data

protection authority for years. And your
biggest problem is that they are not doing

their job. Similarly, in telecom
regulation, what we have found is the

biggest problem is to get the regulator to
do their job. And that needs a lot of name

calling and submissions and talks with
them, which is really frustrating because

it should not be the jobs of activists to
enforce legislation. It should be the task

of well funded regulators. So in that
reform, we are kind of in the middle. The

scope was released in 2018. In May, we had
an official stakeholder workshop which

went for five hours and was a busy
gladiator debate. And October/November the

draft guidelines were released and
publicly consulted. About 50 stakeholders

participated, we were one of them. And now
BEREC has all of the input on their draft

guidelines and most likely in Q1 2020 will
see an interim report summarizing that

consultation, which again will be
consulted. We would like that to happen

because it would allow us to respond to
comments from the telecom industry and to

kind of have a more Ping-Pong debate. And
finally, that all should come to a close

in June 2020 when the new rules are
adopted. So now I'm gonna go into what is

actually in that draft and what to expect
content-wise from the topic. As you have

seen in the title, what we are mostly
talking about these days is 5G, the next

mobile network generation. You must have
heard about it. The telecom industry

really has spent millions and millions in
advertisement to make people interested in

5G. We have that whole trade war between
Trump and Huawei going on and there are

people talking about health risk, which is
mostly overblown but still 5G is really

portrayed as the revolutionary new
technology. Sadly, that's quite far away

from the truth. 5G is an evolution. If
you've listened to the talk yesterday

morning in German about the path from 4G
to 5G, you will know that technology wise

5G is a very interesting technology. And
as a nerd, I find it interesting but.. The

only thing that's a given is that internet
will become faster. All of the other

promises you should take with a grain of
salt. There are two particular

technology aspects of 5G that I want to
talk about in more detail. The first is

Network Slicing. The title already gives
it away. Network slicing means you slice

the network and every slice, every layer
has different quality characteristics. So

it's basically QoS on the radio access
layer. So it's basically allowing you to

have one SIM card with several internet
accesses to it. So you could have one that

is very high bandwidth super fast for
Netflix, one for very low latency for

gaming, one for very low energy
consumption. So when your battery goes

below 20% or you'll have solar powered IoT
sensors, then you might want to use that

because you actually don't care about
bandwidth, you don't care that much about

reliability, but you only have tiny
battery or solar power. And it actually is

good that we'll have that technology. But
the question is then who gets which slice?

And that's where the regulators in the
business models get back into gear. The

one scenario in which we could see
networks slices being marketed to us is an

a per subscriber basis. So you have that
one SIM card and it allows you to have

several independent Internet access
services that are also separated from each

other. And you as a user are in control.
Which app gets which slice? You should not

assume that all of these slices will be
flat rate. It could be that you have a

normal internet access but a very high
bandwidth or low latency slice is capped

with two gigabytes per month. And so it
actually is important that we as

subscribers have a say in that. The second
way in which network slices could hit us,

is a specialized services. So, there the
access service, the pipe, is the same

thing as the application that runs over
it. So it's no longer universal access. It

is no longer something that connects you
to the whole internet but it's basically

just not a power plug but a Facebook plug.
And we have few safeguards, five in total

in the regulation that are kind of protecting
us against specialized services becoming

too widespread. But this is where we'll
see a lot of "innovation" from the telecom

industry to vertically integrate, try to
have Facebook as a separately sold product

or maybe Facebook, Oculus Rift, VR or
maybe some IoT vertical integration, which

some smart home shit. So stuff like that
will most likely happen and 5G gives them

more argumentation basis for these types
of vertically integrated products. But

that's something for the enforcement. And
lastly, which was our original fear, is

that a network license would be applied on
a per application basis. So, Google could

make a deal and suddenly they are under
high reliability slice - always. And this

is thankfully not the case in the current
draft, so we could already prevent with

the work in the previous years this
scenario from being a likely result of

that reform, which is good because as I
show you later, these rules in Europe will

have repercussions. The second technology
aspect of 5G that merits some discussion

is edge computing and it's kind of
breaking the principle of end-to-end. You

no longer have desktops or mobile devices
that are connected to one Internet,

whereas you have suddenly some
computational power on the cell tower, on

a very close datacenter connected with
fiber lines so that the whole purpose here

is very low latency. The industry is
marketing this as something really great,

something that will be heavily needed.
Actually, there is very little real use

cases out there that I think are
realistic. The only one that we could find

and that merits discussion is local
dynamic maps. So it's basically if you

think of a future in which self-driving
cars all have their own sensory data and

that sensory data is then cached in this
edge-called cloud. So you have a 3-D

model that knows from the car that has gone
around the same curve for a minute ago that

there is a traffic jam over there. And so
your car would know before you even passed

that curve. It is telling that even the
European Commission backed a Wi-Fi based

mesh network standard and not 5G, which
means even that very weak example of edge

computing is kind of discredited in
Europe. So we have good cases for the

global reform. And when we talk about 5G,
it's important to stress that this is a

global standard. 3GPP, an international
body is standardizing the technology for

5G and now it's being rolled out step by
step in the rest of the world. The U.S.,

of course, will not be helpful with that
because they are heavily investing in 5G

but they are no longer net neutrality
standards to test this new technology

against. Canada, great net neutrality law,
but not taking a front seat approach to

5G. So they are not actively engaging with
it. India great net neutrality, again not

interested in 5G yet. South Korea,
actually, our colleagues there could

prevent a repeal of the net neutrality
legislation in South Korea. But they tried

to regulatory sandbox net neutrality from
5G to just let the net neutrality rules

that are already weak in South Korea to
begin with not apply to that technology.

So Europe is kind of the first world
region that tries to square these two

things together. And that's why our
approach here might be quite influential.

Also, if you think of the whole ecosystem
because what does it mean if we have user

controlled network slices? That means that
on my mobile device, I need to somehow

also decide which application gets which
slice at which time. And so Google and

Android - ähm Google and Apple (Freud)
come into play here as well. Another issue

that we did not at all expect to fight
about is parental control filters. So when

we fought about this law in the
parliament and in the council in the

trial, we always had that looming danger
of parental controls, like in the UK. You

buy an internet subscription and you have
a porn filter on it by default. We could

kill this in trial. So parental
controls were struck out of the law books

and for some weird reason I would call it
lobby pressure. The regulators wanted to

allow this in this reform and we've shot
heavily against it. We got even support

from the consumer protection
organizations, from BEUC, and we hope

that we can actually prevent this because
what would it mean? It would mean that

suddenly in the terms of services, you can
circumvent net neutrality. Usually an ISP

is, of course, not allowed to just
randomly block websites but parental

controls are exactly that. If you want to
do parental control filtering do it on the

device but not in the network. Blocking
should always happen on the edge of the

application, not on the network site. The
picture is more interesting when we talk

about zero rating cause they actually took
many of our ideas and also from our report

into consideration. The draft that was
released in October actually contains even

the same language of open zero rating
programs. And it says they have to be

fair, everyone needs to get a response,
they have to be reasonable, so all

documentation should be made public, they
have to be transparent, so if WhatsApp

calls or Spotify ads are actually counting
towards you data cap and are not zero-

rated, you should least tell the customer
and they have to be non-discriminatory. So

Vimeo gets the same response time as
YouTube. These are all our critical

points. I'm very thankful that they have
listened to us but sadly, they are also

allowing ISP to simply don't give a fuck
and have non-open programs, so they have

not drawn a red line. They have not said
clearly we have these types of zero-rating

programs, which are okay and then we have
all of these others that you have to

follow these rules for. And that is just a
level of lack of opportunity and a missed

opportunity for the regulators because
whenever the rules are fuzzy and

unclear,that only creates problems further
down the road in enforcement. The last

issue was also kind of unexpected. In the
beginning, because I thought we've solved

that. Deep packet inspection. So deep
packet inspection means when an ISP is

looking into your data packages. So he's
looking closely into what you are actually

doing online, your concrete user behavior.
The domains you access, the URLs you

access, that means your sexual
preferences, your news preferences, which

videos you have watched, all of that.
Usually that should be prohibited.

Everything that's payload of transport
layer 4 should be off limit for an ISP.

That's the general definition of deep
packet inspection. And actually we thought

that we've won that. But then there were
rumors that deep packet inspection, they

want to open it up and allow it again. So
we launched an open letter which was

signed by 45 NGOs, academics, and privacy
experts. But we still felt like this is a

hard push. We knew the regulators on the
other side - Germany is one of them - that

were just because of lobby pressure,
really asking for ex post allowing deep

packet inspection. And in that moment,
Gandalf came and we really got support

from an unexpected friend. The highest
data protection body in the European

Union, EDPB, issued a letter to BEREC and
saying that the board considers the

processing of data such as domain names
and URLs by Internet access service

providers for traffic management and
billing purposes, it's unlawful unless

consent of all users is obtained. And that
is interesting because of course all users

means that it will never work because
I as a customer of my telco, can maybe

consent to that, but not the rest of the
internet that might send a data package

down my way. They're not just saying this
for their net neutrality law, they are

also saying it for their interpretation of
e-privacy, of the GDPR, all of the other

laws. So this is actually giving us even
more sticks to go after deep packet

inspection in the future of that legal
opinion. And lastly, a completely

unrelated reform but still plays into this
whole thing. In Germany, you can pick your

own router. It doesn't matter which ISP
you have. You have the right to buy a

router from anywhere, even an open source
or libre one. And it needs to be able to

connect to your internet access service.
That is not the case in many European

countries because it is often unclear
where does the network actually end and

where does my home network begin. And that
network termination point is one of the

things that the same body BEREC, the
telecom regulators will decide for us. And

again, it looks like we will win. Winning
in this sense means that you will have it

the freedom to choose your own router, you
will have device freedom also in the

customer premise equipment and the network
ends at the socket, at the wall, at the

antenna. So it's actually quite good for
user choice. The only counterpoint that I have to

give you, of course, when the network
ends, net neutrality ends. But if your ISP

tries to fuck you on your router, you can
just replace it with another device. And

that's it for the neutrality thing.
And I think we still have some time for Q

and A. Thanks.

Applause

Herald: Yeah. Thank you so much. And don't
leave yet. I wanted to say support

epicenter.work, support EDRi. We need support,
we need people who believe in this and to

fight for this and thank you.

Applause

Herald: Okay. So, do we have questions? We
have questions from the Internet, maybe -

not really. Number two, please.
Mic 2: Yes. Have you seen any requirements

in digital media playback for recording
location information and identifying

users? So especially the location
information of media playback.

Lohninger: I'm not sure I follow the
question. So like... you mean like YouTube

reporting the playback position of the
audience?

Mix 2: No, not the not the public playback
position, the position or the location of

the user that is playing back to media.
Lohninger: I'm not sure that that would

relate to this. So, the ISP, of course,
knows in most cases where the user is, you

know, in all cases actually, and the
content provider, if it is not localizing

the user on the app with the location,
then the ISP at least would not share that

location information. I also wouldn't know
by which API or on which legal basis they

could do that. I hope that answers the
question, but I'm not sure.

Herald: Okay, thank you. Okay, we have
another question. Microphone four, please.

Mic 4: Hi. Will the users have the same
rights if they are not in the home country

like if you are roaming?
Lohninger: Yeah, that's actually an

interesting question. So, the net
neutrality regulation is also the roaming

regulation in the EU. These two things a
legally mixed together but they actually

can be seen completely separate. So when
you are roaming in another country, so my

Austrian SIM card here in Germany, it is
actually then the German provider that is

physically providing me the Internet
access service, which has to apply by the

same European regulation for net
neutrality. In most cases that would not

mean that there is even a technical or
legal connection to the customer, to the

ISP in Austria that I have a contract
with. Of course, it gets then interesting

because that's mostly about the technical
aspect when we look about zero rating. For

most cases the zero rating would just not
be possible. So if you have StreamOn in

Germany, you are a customer of T-Mobile,
you are going to Austria and you are in

the network of some ISP, then the zero-
rating would just not be possible and you

would just have additional data volume
given to you. There was actually a court

case about that out of Germany and there's
still ongoing litigation from the consumer

protection NGO, VZBV in Germany against
Vodafone around that same question. It

might be differently if you are a German
T-Mobile customer in Austria and roaming

in the T-Mobile network there because
technically I think it would be possible

to then apply the zero-rating but I'm not
sure if they actually do that. I think it

would not be easy and the incentive
usually would also not be there because

these are very few edge cases that even to
configure and maintain those wouldn't make

a lot of sense.
Herald: Okay, so next, we have a question

from the Internet. Dear signal angel.
Signal: So there was a question about DPI.

Are data protection authorities doing
anything about this and are there any

enforcements in the European country?
Lohninger: Sadly, no and no but I think

there is definitely an opportunity there
for enforcement action. And I know many of

the people that work around strategic
litigation and enforcement of the GDPR.

They have their hands full because similar
to net neutrality, the great law that

we've written in the last year is not
taken very seriously by the regulators.

And I think it will again depend on
activists or other entities bringing

cases, bringing complaints to data
protection authorities around DPI before

we see actual movement there. Legally, I
think particularly with that statement

from the EDPB, it would be an easy win. So
if somebody wants to earn spores or help

of that, I think it's quite doable case to
bring a complaint against DPI based on

that legal opinion.
Herald: So you're all part of it again.

Number two, please.
Mic 2: I want to ask, why the hell should

the ISP mess around on layer 4 laugh ,
as you described it before?

Lohinger: That is the current definition
that we have, like the regulation says no

monitoring of specific content. And BEREC
interpreted that in 2016 it meaning pay a

load of transport layer 4 should be off
limit. That is the interpretation that the

regulators have come up with. And that, of
course, was also a political compromise

like where do you draw the line? And so my
slide there was really based on the 2016

text of the guidelines.
Herald: Okay. Number one, please.

Mic 1: So currently an app developer has
to apply for to an ISP to get zero-rated.

What's to stop an ISP to just zero-rate an
app on its own to gain some market

advantage.
Lohninger: They can. And there's nothing

stopping it. And WhatsApp, for example, is
easily just saying "Okay, here's how you

zero-rate us and we don't even want to
interact with you." There does not need to

be a bilateral agreement. Of course, ISP
then has the problem if the app provider

changes their service or infrastructure
and identification criteria should also

change that the ISP needs to implement
that change before it happens. And so

that's the reason for the 30 day period.
But again, that problem might not even

exist for big providers that have
dedicated IP addresses. If your services

coming out of an CDN and then you would
rely on SNI or other technologies to

actually be identifiable.
Herald: So we have one more minute and I'm

sorry to say it's number 4. Thank you,
others. And yeah, probably you can go to

Epicenter Networks and contact Thomas
there. Thank you.

Mic 4: Hi. I'm very touched by your
argument about regulation not being

enforced right now in the EU. In France,
it has been the case about video

surveillance where the state has stated
that CLIN, the regulators are a

consultative authority. You know, they
shouldn't enforce. That's what quite

arterial the association that is doing
most of the work about that said so. I

don't know where we go from there. You
know, I'm very scared. It's nice that

you're doing...
Herald: What is the question, please? We

just have 20 more seconds.
Mic 4: Sorry, my question is, what do you

think we can do to help enforce regulation
in the EU?

Lohninger: Big question. There are many
things there, like one of the things that

is a positive development to look at a
bright side is that more and more digital

rights NGOs are warming up to strategic
litigation. So ultimately, why are

regulators not acting? Because on the one
side, they have fundamental rights to law,

consumer protection. And on the other
side, you have a big, big company that

will not accept their decision that it
will bring them to court no matter what.

And so if you're a small regulator with a
limited budget, you can either take the

uncomfortable decision that, you know, you
will be sued for. Or just duck away and

then the thing might be over. So that the
risk assessment and the cost calculation

is currently not in our favor. And that's
why we need to bring more cases. We have

to make regulators really bear a certain
risk on both sides of the decision. And

only then will the decision actually move
more to the factual basis. And I mean, I

know there are many problems in France but
at least CLIN was one of the few DPAs that

actually issued a few million penalties.
So there is at least some silver lining.

Herald: Okay, so complain. Support EDRi,
support epicenter.works. Thank you

for being here and given another applause
to Thomas Lohninger. Thank you so much.

Applause

36c3 postroll music

Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!