RTR NET NEUTRALITY REPORT 2019 Report in accordance with Art. 5(1) of the TSM Regulation and Par. 182–183 of the BEREC Guidelines on Implementation by National Regulators of European Net Neutrality Rules www.rtr.at 2019

RTR NET NEUTRALITY REPORT 2019 Report in accordance with Art. 5(1) of the TSM Regulation and Par. 182–183 of the BEREC Guidelines on Implementation by National Regulators of European Net Neutrality Rules

Contents 62 66 66 67 68 8 Outlook on further activities 9 9.1 9.2 9.3 Appendix Mapping of the report to the structure of the guidelines Index of figures and tables Abbreviations Net Neutrality Report 2019

section 1 Executive Summary connections. Very broadly, it can be said that enforcement work in recent years has continued to improve both the level of awareness and readiness to work together on these issues on the part of affected companies. Alongside monitoring potential net neutrality violations, a second focus in the current reporting year was the blocking of websites as a result of copyright claims. Between early 2018 and April 2019, the TKK initiated a total of 14 supervisory procedures in this context, of which 13 were concluded before the end of the reporting period. Art. 81 Par. 1a of the Copyright Act (UrhG) includes a special copyright provision, according to which providers of internet access services can be obliged to refuse to provide access to such websites. Similar provisions for other areas of the law (enforcement of state monopoly on gambling, child protection etc.) are frequently discussed. As of this writing, however, it is unclear whether or how these may result in a new remit for RTR. A third and last point of focus for RTR at national level concerns its indepth activities related to zero-rating. Zero-rating, which refers to customers using services without the precipitated data transfers being deducted from the data volumes included in their tariff plans, is now a widespread practice within Europe and one that requires particular attention from a net neutrality perspective. This year’s report includes a special section on zero-rating practices in relation to Austria. At the same time, RTR has also prepared a comprehensive comparison of empirical work on zero-rating in 15 EU Member States, in which some key concerns about zero-rating are assessed in detail. What then can be observed in general about the state of open internet access in Austria during the year under review? The overall picture continues to be highly positive. Companies suspected of breaching net neutrality rules generally identified constructive solutions, which were then approved by RTR and implemented (or scheduled for implementation). Procedures were also dropped in a significant percentage of cases after plausible arguments were given or the case was reviewed, revealing that operators had not overstepped the mark when imposing blocks. On the other hand, it is regrettable that court decisions are still awaited on some key topics (specifically: specialised services and technical discrimination) on which the regulatory authority had already ruled in 2017. There were no substantive changes as regards the introduction of new products or services in the year under review. In the context of the TSM Regulation, probably the most important development was in relation to zero-rating and the fact that A1 Telekom Austria had redesigned its entire core product portfolio (A1 Go product family and b.free) to make zero-rating a feature of every new private or business customer tariff. This is expected to drive a substantial increase in the customer base. However, since the offer has been made transparently and the ratio of zero-rating to overall data consumption or the volume included in the plan is relatively minor, there are no serious grounds for intervention at the moment. In addition, other domestic mobile operators are tending to withdraw zero-rated options or are not launching products with such features. One question is whether open internet access continues to be provided at a quality level that reflects progress in technology. Here it can be observed that the developments in the year under review were not significantly impacted by products or practices that are relevant for net neutrality. While broadband product pricing is apparently not Net Neutrality Report 2019 7

section 2 Introduction As a convergent regulatory authority for media, telecoms and postal services, it is essential that RTR develop and coordinate all positions on net neutrality as an interdisciplinary activity, conferring in particular with the Austrian Communications Authority (KommAustria). From the outset, the regulatory authority has oriented its practice on the following considerations: the authority’s goal is to identify breaches of net neutrality provisions while raising awareness of the subject, so as to ultimately create a stable environment for entrepreneurial activity and innovation. Where breaches of net neutrality rules are found, the authority envisages appropriate transition periods for their resolution – which also permit companies to adjust to the new legal standards without experiencing disruptive interventions. Setting appropriate transition periods, for example, reflects these considerations. Experience has shown that in most cases, a constructive, solutionoriented approach is adequate for ensuring compliance with the substance or spirit of the TSM Regulation. To facilitate and guarantee harmonisation across the EU, RTR is active at European level as a member of BEREC working groups on net neutrality. This work includes discussions of cases from across the EU – on zero-rating and traffic management for example – with the aim of a uniform perspective on relevant issues. In this report, the following section 3 provides readers with an introduction to the general context of net neutrality, which comprises the stakeholders, institutions and the scope of TSM Regulation enforcement. Section 4 provides a chronological view of the authority’s activities in preparation for section 5, which presents (suspected) violations of the TSM Regulation together with corrective measures. Section 6 takes a look at other monitoring systems in relation to net neutrality and provides a set of key figures that describe the development of the internet in Austria. Section 7 is dedicated to the topic of zero-rating, namely those services that are offered or used without counting the data volume included in the respective tariff plan. The last part of the report, section 8, offers a brief summary of the projects and challenges expected in the next reporting year. Net Neutrality Report 2019 11

section 3 Stakeholders, institutions and the scope of TSM Regulation enforcement In Austria, the Telekom-Control-Kommission (TKK) and Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR) are responsible for enforcing the TSM Regulation. This is now explicitly included as part of the December 2018 amendment to the Telecommunications Act. Supervisory procedures under Art. 5(1) of the TSM Regulation continue to be part of the TKK’s remit, while the upstream request-for- information procedures pursuant to Art. 5(2) of the TSM Regulation are completed by RTR. Another aspect, relating among other things to net neutrality, is the continued requirement for general terms of business and fee provisions to be submitted to RTR before commencement of the service, as set out in Art. 25 of the TKG 2003. The TKK can issue an objection within eight weeks in the event of failure to comply with the TKG 2003 or ordinances issued on the basis of the TKG 2003, or with Articles 879 and 864a of the Austrian General Civil Code (ABGB) or Articles 6 and 9 of the Austrian Consumer Protection Act (KSchG). This provision de facto creates a situation where all changes relevant to general terms of business (including those affecting net neutrality) must be submitted to the regulatory authority and reviewed for compliance with the minimum contractual content given in Art. 4(1) of the TSM Regulation. This gives the regulatory authority an efficient ‘early warning’ mechanism – even though violations of provisions other than those stated in Art. 4(1) of the TSM Regulation can only be prohibited ex post. Moreover, the regulatory authority can also impose reporting requirements on a company: these can help to better assess market impact. RTR is a convergent telecoms, postal and media organisation, and the Telecommuni- cations and Postal Services division and the Media division consult with one another on all key issues relating to net neutrality. One reason why this is essential is the fact that net neutrality topics (such as zero-rating or specialised services) may exhibit an overlap with media topics (such as the procedure addressed in section 5.5). Another point of contact in relation to the EU GDPR and the ePrivacy Directive is the data protection authority: collaboration here is likely to intensify as a result of the preparation and enforcement of a new ePrivacy Regulation. Net Neutrality Report 2019 13

section 4 Timeline of regulatory authority activities TABLE 01: TIMELINE OF EVENTS IN THE REPORTING PERIOD WORK IN EU BODIES 1 Current Participation in BEREC working groups on net neutrality BEREC working groups in 2018: Development of a Net Neutrality measurement tool, Implementation of the Net Neutrality Regulation, Net Neutrality – input to an evaluation BEREC working groups 2019: Update to the Guidelines on Net Neutrality, Report on the implementation of Regulation (EU) 2015/2120 and BEREC Net Neutrality Guidelines, Carry-over work on BEREC Net Neutrality measurement tool 2 3 4 5 6 Oct 2016 – Mar 2019 Jan 2018 – Feb 2019 Feb 2018/ Apr 2018 – Nov 2018 Apr 2018 – Nov 2018 NATIONAL STATUS QUO ANALYSIS/DISCUSSION WITH PROVIDERS No transparency study was completed in the current reporting period. ENFORCEMENT OF TSM REGULATION Procedures by the TKK to enforce discontinuation, initiated against the five largest providers by the TKK in October 2016. The last ongoing procedure in this round was dropped in March 2019 (see section 5 for further details). Request-for-information procedures initiated by the TKK against 16 other operators; six procedures were dropped in the reporting period without initiating a supervisory procedure. Procedures against nine of these operators were transferred to RTR in Feb 2019 through the change in responsibility resulting from the amendment to the TKG 2003 (FLG I No. 78/2018) (see section 5 for further details). Seven procedures initiated by the TKK pursuant to Art. 3(3) of the TSM Regulation against eight operators (six following merger of T-Mobile and UPC). The procedure concerned the legitimacy of blocking access to certain websites as a result of injunction claims asserted by copyright holders (see section 5.5 for further details). Introduction and informal dropping of an assessment procedure (as a result of all parties to the procedure withdrawing their submissions) pursuant to Art. 3 of the TSM Regulation and Art. 81 Par. 1a UrhG (see section 5 for further details) 7 Nov 2018 The TKK issues decisions versus A1 Telekom Austria AG, LIWEST Kabelmedien GmbH, kabelplus GmbH, Salzburg AG für Energie, Verkehr und Telekommunikation, T-Mobile Austria GmbH, two UPC companies and Hutchison Drei Austria GmbH in relation to the legitimacy of blocking accessing to certain websites as a result of injunction claims asserted by copyright holders (see section 5.5 for further details). 8 Jan 2019 – Apr 2019 Six procedures initiated by the TKK pursuant to Art. 3/Art. 5 of the TSM Regulation against eight operators. The procedures concerned the legitimacy of blocking access to certain websites as a result of injunction claims asserted by copyright holders (see under 5.5 for further details). 9 Apr 2019 The TKK issues decisions versus A1 Telekom Austria AG, LIWEST Kabelmedien GmbH, kabelplus GmbH, Salzburg AG für Energie, Verkehr und Telekommunikation, T-Mobile Austria GmbH, two UPC companies and Hutchison Drei Austria GmbH in relation to the legitimacy of blocking accessing to certain websites as a result of injunction claims asserted by copyright holders (see section 5.5 for further details). 10 11 Since Feb 2019 Continuation by RTR of the request-for-information procedures initiated previously by the TKK (point 4 above) against nine operators (see section 5 for further details). Since Feb 2019 Introduction of six assessment procedures pursuant to Art. 3 of the TSM Regulation and Art. 81 Par. 1a UrhG (see section 5.5 for further details). 12 Mar 2019 Initiation by RTR of an additional request-for-information procedure pursuant to Art. 5 Par. 2 of the TSM Regulation (see section 5 for further details). 13 Since Apr 2019 One ongoing procedure pursuant to Art. 3/Art. 5 of the TSM Regulation. The procedure concerns the legitimacy of blocking access to certain websites as a result of injunction claims asserted by copyright holders (see section 5.5 for further details). Net Neutrality Report 2019 15

section 5 Potential violations of net neutrality and associated procedures TABLE 02: SUMMARY OF PROBLEMATIC PRACTICES IN LIGHT OF THE TSM REGULATION TYPE OF PRACTICE DESCRIPTION 1. Port blocking Certain UDP or TCP ports are blocked for incoming and/or outgoing traffic. This may render certain services unusable, which is a contravention of Art. 3(1) and Art. 3(3) of the TSM Regulation. A more detailed description is given in section 5.1. 2. Private IP addresses and services Customers are assigned private IP addresses, via network address translation (NAT). This prevents these customers from using or providing their own services; this right follows, however, from Art. 3(1) of the TSM Regulation. A more detailed description is given in section 5.2. 3. Zero-rating The data volume used by a specific application or for a specific CAP does not count towards the data volume cap included in the customer’s subscription. 4. 5. 6. 7. Specialised services A specialised service is a service that is not offered by the ISP via normal internet access service (IAS) but instead as a prioritised/optimised service. To be offered as a specialised service as defined by Art. 3(5) of the TSM Regulation, a service must first satisfy certain conditions. Technical discrimination and restriction of internet access Disconnection of IP connections Blocking websites due to copyright claims Traffic modification/redirection or the placing of restrictions on the IAS contravenes Art. 3(3) of the TSM Regulation. A more detailed description is given in section 5.3. Automated disconnection of IP connections restricts the rights of the end user to use or provide their own services (Art. 3(1) TSM Regulation). A more detailed description is given in section 5.4. Even though jurisdiction for ruling on injunctions based on copyright claims normally lies with the ordinary courts, the specific traffic management measures (blocks) used to implement such orders must be verified to ensure compliance with the TSM Regulation. Where such traffic management measures are implemented simply because the ISP has been asked to do so by copyright holders (and not as a result of a court order), it is also necessary verify whether an exception exists under point (a) of the third subparagraph of Art. 3(3) of the TSM Regulation (see section 5.5). One key focus of activities in this reporting year was on procedures to determine potential violations of net neutrality by smaller (in terms of customer base) operators. To establish a level playing field, it was necessary to gradually start auditing smaller fixed network and mobile operators, after completing audits of the biggest national operators. Already in early 2018, as part of continued monitoring of compliance with Art. 3 of the TSM Regulation and in a second round of request-for-information procedures, a total of 16 ISPs were sent requests as well as questionnaires about products and technical practices. By the end of the reporting period, the operators had appropriately responded in almost all of these procedures. One positive outcome is that six of these procedures had already been dropped between July and December 2018, as it had not been possible to identify any potential violations of net neutrality. In the remaining ten procedures (it should be noted here that four procedures involved a virtual network operator that had formed separate companies for its brands), RTR continued the previous practice of holding exploratory talks on behalf of the TKK in order to identify potential violations of the TSM Regulation. At the end of 2018, one operator announced discontinuation of Net Neutrality Report 2019 17

section 5 Potential violations of net neutrality and associated procedures 5.1 Blocking of TCP/UDP ports or protocols Request-for-information procedures conducted in 2018 revealed that some of the providers surveyed block various ports in the TCP and UDP protocols, typically citing as a reason the need to maintain network security and integrity (based on point (b) of Art. 3(3) third subparagraph). This is problematic, since it restricts end-user rights pursuant to Art. 3(3) third subparagraph. In terms of port blocking, varying sets of circumstances have arisen as a result of these new procedures. Once again, it became clear that port blocking does not follow any single, identifiable pattern. In most cases, the actual grounds for blocking specific ports were clarified in the course of procedures. Since the mobile operators who were involved in the procedures were all virtual network operators (MVNOs), most without their own core networks, these operators simply referred the matter to their host operators. Since these MNOs had already been audited in the first round of procedures, no further investigations were necessary. Results from the fixed network ISPs surveyed were again varied and port blocking strongly depended on factors necessitated by hardware. As an example, one ISP was using TCP port 22 (service: secure shell, SSH) for the maintenance of a part in its modem and had therefore placed an end-user block on the port. Some of these blocks were therefore of a ‘legacy’ nature. At this juncture, it must once again be emphatically stated that an assessment of the legitimacy of port blocking activities always requires a case-by-case approach. Accordingly, the fact that one procedure has considered a port block in a specific scenario to be legitimate cannot automatically be used to conclude the legitimacy of port blocking as practised by other ISPs. To assess the appropriateness and necessity of blocking, the corresponding ENISA guidelines were also applied for the first time. The following section provides a summary of selected findings. Port 22 (SSH) One fixed network operator blocks this port for use by specific internet access technologies for technical reasons based on their network topology (CPE maintenance). The operator states that the modem manufacturer offers no support in this matter. The operator has therefore agreed to remove this port block for all unaffected customers by August 2019 and to offer a replacement modem to affected customers on request. TCP port 23 (Telnet) One mobile operator confirms blocking incoming traffic on TCP port 23. This action was justified by citing vulnerabilities in the hardware used by end users. The block was removed after replacing this hardware. TCP port 25 (SMTP) One mobile network operator and several fixed network operators stated that they block outgoing traffic on port 25.The key reason for such a block is to prevent a customer’s PC from sending spam mail after becoming infected by malware. If the provider only assigns private IP addresses (via NAT) and a public IP address that is shared by many customers via NAT is blacklisted, all email from those customers could be blocked. When assessed pursuant to point (b) of Art. 3(3) third subparagraph, these blocks are considered to be legitimate – as they have been in previous procedures – since (pure) SMTP is a protocol frequently misused at retail level (for sending spam). One of the providers affected has since ceased network operations. Net Neutrality Report 2019 19

section 5 Potential violations of net neutrality and associated procedures TCP port 8089 incoming (TR-069) This TCP port is not within the range of ‘well-known’ ports defined by IANA. This block was seen as justified because a certain brand of modem reserves this port for the TR-069 remote maintenance protocol and is therefore susceptible to corresponding manipulation. An analysis was ongoing at the end of the reporting period. 5.2 Private IP addresses and services Art. 3(1) grants end users also the right to use or provide their own services. These services range from smart home servers set up for personal use (e.g. temperature monitoring) on appropriate hardware, to web servers operated by end users for third parties. A key technical prerequisite for the self-hosting of services is the direct accessibility of the server or service operated by the end user from the internet, and therefore the assignment of a public IP address to that user’s internet connection. In mobile networks in particular, customers are occasionally assigned private IP addresses (via NAT). Apart from technical aspects, the main reason is the provider’s wish to save on public IPv4 addresses, which are becoming scarce.3 However, if multiple customers are required to share a single private IP address via NAT, this effectively prohibits any individual customer from providing services or content themselves. In the opinion of the regulatory authority, the basic right granted to the end user by the provisions of Art. 3(1) should at least be understood to mean the provision of a free public dynamic IP address – at least if the end user requests such an address, for example because of wishing to offer services. The end user can then utilise that address with dynamic DNS services to allow routing to their own services. Assigning a public IP address on condition of payment of an additional fee (defined for instance in a specific subscription model or as an added option) or only to certain customer segments (such as business customers) is in any case to be considered a breach of Art. 3(1). The last reporting period had shown that this problem is especially common with mobile network operators. In all but one case, which led to a request-for-information procedure involving a fixed network operator in February 2019, this circumstance exclusively affected MNOs/MVNOs in the current reporting period as well. On request, the above-mentioned fixed network operator then stated that end-users were currently being assigned only private addresses for IPv4 (carrier-grade NAT) – but public addresses in the case of IPv6. While the (additional) allocation of IPv6 addresses is to be welcomed, IPv6 penetration across the entire internet is currently only about 25%. If customers of this operator provide their own services, they would consequently be inaccessible for the entire IPv4 network, or accessible only via third parties. This procedure was still pending at the end of the reporting period. In terms of the availability of public IP addresses at MVNOs, it is important that operators of the respective host networks are reminded of their obligations to allocate public IPv4 blocks to MVNOs since the latter repeatedly report problems here. While one MVNO planned no further measures, because of intending to cease operations at the end of the reporting period, six MVNOs took action that would enable them to allocate public IPv4 3 While fewer than 232 (approx. 4 billion) addresses are available using IPv4 and are now becoming scarce, IPv6 allows a little under 264 (approx. 18 trillion) subnets. Net Neutrality Report 2019 21

section 5 Potential violations of net neutrality and associated procedures After talks with affected operators (except for the MVNO that ceased operations in March 2019 and the other MVNO acquired by an MNO), it was discovered that these cases do not in fact involve an arbitrary disconnection of IP connections but merely the completion of ‘session tickets’ for the purposes of account settlement. 5.5 5.5.1 Blocking websites due to copyright claims Website blocking in the reporting period In principle, providers of internet access services may not block, throttle, change, restrict, disrupt, impair or discriminate specific content, applications, services or categories of the same, subject to the exceptions set forth in the TSM Regulation. Thus, the listed measures can be taken insofar and for as long as they are necessary to comply with EU legislative acts or national laws or related implementing measures. There is a special copyright provision in Art. 81 Par. 1a of the Copyright Act (UrhG) according to which providers of internet access services can also be obliged to block access to websites that structurally breach the law, if they have previously been duly warned by a rights holder. A website in ‘structural breach’ of the law is a website that does not infringe exclusive rights as defined in the UrhG in an isolated case but instead breaches these rights regularly and deliberately. One example of this is when website operators contribute to the mass distribution of illegal copies of copyrighted works by providing an indexed BitTorrent file to allow users to more easily locate titles of works they are looking for.4 Before awarding to a rights holder an injunction against the provider of internet access services, various basic rights first need to be considered.5 In assessing claims according to Art. 81 Par. 1a UrhG, the entitlement to protection of intellectual property claimed by the copyright holder requesting the injunction, as well as that party’s right to effective enforcement of the law, must be weighed against the basic rights to freedom of expression, freedom of information and freedom to conduct a business, to which internet users, website operators and the access provider involved in the procedure are entitled.6 Since consideration of those basic rights is intrinsic to the assessment of claims based on Art. 81 Par. 1a UrhG, this provision is therefore an exception as referred to in Art. 3(3) third subparagraph point (a) of the TSM Regulation7. If a provider of internet access services adopts a proportionate traffic management strategy that accords with these claims, this does not violate the terms of the TSM Regulation. In the period between early 2018 and April 2019, the TKK initiated a total of 14 supervisory procedures against internet access service providers who were suspected of having denied access to particular websites, and completed 13 procedures in this period. In the procedures, the providers claimed to have denied access to some of these websites in response to a court decision – such as a provisional injunction or a court ruling. They also referred to blocks that had been placed as a result of court settlements or solely on the basis of a warning issued by the rights holders. 4 OGH 24 October 2017, 4 Ob 121/17y; TKK 26 November 2018, R 1–5, 8, 9/18; TKK 12 April 2019, R 1–6/19. 5 ECJ 27 March 2014, C-314/12, UPC Telekabel Wien/Constantin Film Verleih et al. 6 OGH 14 October 2017, 4 Ob 121/17y. 7 TKK 26 November 2018, R 1–5, 8, 9/18; TKK 12 April 2019, R 1–6/19. Net Neutrality Report 2019 23

section 5 Potential violations of net neutrality and associated procedures 5.5.2 Note: Technical options for implementing traffic management measures to block websites structurally in breach of copyright law In the procedures addressing network blocks during the reporting period, the question also arose as to how to implement traffic management in detail and how the various implementation options might impact compliance with the TSM Regulation. Various options for implementing a block are available to an ISP required to block a specific website. These differ in terms of technical implementation, options for bypassing the block, potential ‘overblocking’ effects and possible invasions of end users’ privacy. Accordingly, the following section discusses the blocking options using a DNS block or IP block. Not discussed here are types of blocks that would require an analysis of content data and therefore deep packet inspection (DPI) nor those that appear disproportionate (also from the perspective of data protection), such as DNS sniffing or the reading of TLS/SNI data or HTTP host names. 5.5.2.1 Technical principles From a technical perspective, end users such as consumers and application providers are identified on the internet based on their IP addresses. Examples of IP addresses include 81.16.157.4 or 2a01:190:15fd:1c00::4, depending on the specific protocol used. Since such addresses are neither easy to handle nor simple to remember in day-to- day use, access is instead provided via domains, such as www.rtr.at. To translate the easily remembered name of the domain into the IP address that is actually technically necessary for communication, a domain name service (DNS) is then used. In simple terms, DNS is like an internet ‘telephone directory’ in which the matching IP address can be looked up for each domain. Structurally, the DNS is designed and implemented as a distributed system. DNS queries take place without users’ knowledge. Accordingly, every internet access service includes an ISP-operated DNS server that is set up for the end user by the internet access provider and is (indirectly) queried by the user’s web browser when accessing a domain. This is shown (in simplified form) in figure 2: When accessing the www.rtr.at website, the end user’s browser automatically queries the DNS server to obtain the associated IP address. Only once this is provided can the browser then establish a connection to its ultimate destination. Net Neutrality Report 2019 25

section 5 Potential violations of net neutrality and associated procedures DNS blocks therefore offer a targeted way of preventing direct access to the affected domains. The end user is informed about the block while third-party domains are not affected technically by this kind of block. While a DNS block can in principle be bypassed, this does require the application of some basic technical knowledge. Examples of workarounds available to the end user include the use of a VPN service, the use of TOR11 or changing the operating system’s DNS server settings to point to an alternative DNS provider who is not under the control of the user’s internet access provider.12 On discovering the block, the website operator can move the site to an alternative/additional domain, thereby rendering the block useless.13 5.5.2.1.2 IP block An IP block set up by the ISP prevents access to the blocked IP address by end users. This means that none of the traffic destined for the target IP is routed to the site, regardless of what triggered the traffic or the actual domain name accessed. Since this kind of block does not use a technical redirection but directly blocks the IP address, end users cannot be informed about the block when attempting to access a domain that uses the blocked IP address. This can be represented as a diagram as shown in figure 4: While the DNS query is answered correctly in the event of an IP block, the ISP does not deliver any data packets to the blocked IP address regardless of the domain that is being queried. FIGURE 04: SCHEMATIC DIAGRAM OF AN IP BLOCK 80.109.251.35 Browser ISP 213.33.99.70 DNS 81.16.157.4 Webserver DNS Request Query to 213.33.99.70 What’s the IP of www.rtr.at? HTTPS Request Request to 81.16.157.4 Domain: www.rtr.at 81.16.157.4 > REFUSE DNS Response Response to 80.109.251.35 IP of www.rtr.at is 81.16.157.4 11 The Onion Router, https://www.torproject.org/ 12 Popular providers of such DNS servers include Google (8.8.8.8), Quad9 (9.9.9.9) and CloudFlare (1.1.1.1). 13 This was temporarily the case with the copyright-infringing website movie2k.to, which moved to movie4k.to after a block was set up. (https://t3n.de/news/movie2kto-neuer-name-movie4to-469942/) Net Neutrality Report 2019 27

section 5 Potential violations of net neutrality and associated procedures 5.5.2.2 Blocking of legal content: ‘overblocking’ Since the TSM Regulation stipulates that ISPs “shall not block, slow down, alter, restrict, interfere with, degrade or discriminate between specific content, applications or services” 16, internet blocks must always be analysed in sufficient detail. There is a possibility of blocks overstepping the mark, preventing access to content although there is no legal basis. This kind of blocking is termed ‘overblocking’. 5.5.2.2.1 Overblocking of content on a domain to be blocked Since a block imposed across a domain will block all of the content on that domain, an analysis must first be conducted to assess the ratio of legal to illegal content and whether an indiscriminate content block appears justified. To help conduct such analyses, the legal concept of a website that is in ‘structural breach’ of copyright law has been developed and a website block may only be imposed on sites of this kind. This kind of structural breach was deemed to apply to kino.to, for example, although it would be unlikely in the case of sites like YouTube or Wikipedia since here the vast majority of content is legal.17 The following section does not further discuss this form of overblocking. 5.5.2.2.2 Overblocking of content on third-party domains and websites In principle, it would be possible for website blocks not only to affect the domain to be blocked itself but also other, unrelated third-party websites. For DNS blocks, this would be the case if the need to block a domain resulted in the blocking of an entire top-level domain on the DNS server. One example would be the blocking of Tonga’s entire top-level domain ‘.to’ in order to set up a block that was needed for ‘movie4k.to’. In reality, a more important type of overblocking that is also harder to assess is the blocking of IPv4 addresses. Particularly with shared web hosting, many separate domains share the same IP address. This also results from the scarcity of available IPv4 addresses, the costs involved in procuring an exclusive IPv4 address and the support provided by technologies that enable multiple use by all of the popular browsers.18 16 Citation from Art. 3(3) third subparagraph of the TSM Regulation 17 OGH 24 June 2014, 4 Ob 71/14s. 18 Server Name Indication (SNI), RFC 6066. Net Neutrality Report 2019 29

section 5 Potential violations of net neutrality and associated procedures address,29 reverse DNS queries produce no results and searches in public repositories for CloudFlare IPs reveal a multitude of unrelated websites.30 In the procedures mentioned above, CloudFlare was also observed to change IP addresses for individual websites regularly, which is further evidence against the allocation of one static IP address to each website. 5.5.2.3 Technical issues to consider In practice, website blocks in Austria make use of both DNS blocks and IP blocks, although most of the blocks are of the DNS type.31 If a block must be imposed for a specific domain but no specific technical method is stipulated, RTR believes that a nuanced approach must then be taken. This is especially the case if the site to be blocked uses a CDN.32 While the effectiveness of both the block and the potential for overblocking by DNS blocks is not technically affected by CDN use, this is not the case for IP blocks, for the reasons outlined above: not only is technical proof of the use of an exclusive IP address hard to come by, but it is also current practice particularly within the CDN industry to use one IP address to serve multiple domains. Nor was any evidence to the contrary obtained about the domains actually investigated in the procedures conducted in the reporting period. In fact, the sharing of one IP address between multiple domains investigated during the procedures meant that a 1:1 allocation of IP address to domain could actually be ruled out.33 Although setting an IP block might seem more effective at first – because it cannot be bypassed by using a different DNS server, for example – not only the website operator but also users with sufficient basic technical expertise can work around the block, while the risk of overblocking increases substantially. This must be considered when assessing whether a block is proportionate, thereby evaluating compliance with traffic management pursuant to Art. 3(3) third subparagraph of the TSM Regulation. 29 See for example http://104.27.180.161 30 Such as a Bing search for ‘ip:104.27.180.161’. 31 TKK 12 April 2019, R 1–5/19. 32 See 5.5.2.2.3. 33 TKK 12 April 2019, R 1–5/19. Net Neutrality Report 2019 31

section 5 Potential violations of net neutrality and associated procedures 5.7 Measures in accordance with Art. 5(1) In the third reporting period (ending in April 2019), no measures as defined in Art. 5(1) TSM Regulation were considered necessary to ensure compliance with the provisions of that article. This was because dialogue was initiated with the companies early on and discussions usually resulted in constructive solutions compliant with the TSM Regulation. Numerous procedures pursuant to Art. 5(1) were initiated but then dropped without a decision and order (e.g. because of the voluntary resolution of the issue by the operator); such cases are not listed here. The regulatory authority nonetheless, as a matter of course, monitored compliance with the provisions of Art. 3 and Art. 4 TSM Regulation on an ongoing basis. The decisions on measures issued against A1 Telekom Austria AG in December 2017 pursuant to Art. 5(1) of the TSM Regulation remain valid. A less positive outcome, however, is the length of the procedure before the Federal Administrative Court, since these two decisions were the first issued on the basis of the TSM Regulation, while a rapid legal assessment would have been desirable so as to offer concrete guidance for future procedures. Net Neutrality Report 2019 33

section 6 Other indicators and activities 6.3 Indicators of continuous availability of non-discriminatory internet access services Art. 5(1) of the TSM Regulation requires national regulatory authorities to ensure compliance with Art. 3 and Art. 4 TSM Regulation and to promote the continued availability of non-discriminatory internet access services at levels of quality that reflect advances in technology. To provide a degree of perspective and a more accurate estimate of progress, the following charts also show the long-term trend. The charts are interpreted only for the reporting period, however. In the explanations that follow, reference is therefore made to the most recent set of available figures: nonetheless, figures for some indicators were not yet available for Q1 2019 when the report was compiled. The following indicators were deemed relevant to depict the continued availability of non-discriminatory internet access services at levels of quality that reflect advances in technology: • Number of broadband connections • Distribution of download and upload speeds in the reporting period • Median of download and upload speeds and latency over time • Distribution of download and upload speeds by hour of day • Price baskets fixed vs. mobile broadband • Quality dimensions Net Neutrality Report 2019 37

section 6 Other indicators and activities FIGURE 06: DISTRIBUTION OF DOWNLOAD SPEEDS OVER REPORTING PERIOD 2016 2017 2018 2019 (Jan-May) Percentage of tests with download speeds in a given category 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% % 5 7 . % 2 7 . % 8 5 . % 1 5 . % 5 5 2 . % 5 4 2 . % 5 2 2 . % 7 0 2 . % 9 6 3 . % 3 9 3 . % 0 9 3 . % 7 8 3 . % 0 5 1 . % 6 5 1 . % 5 6 1 . % 4 7 1 . % 4 2 1 . % 5 0 1 . % 5 1 1 . % 7 2 1 . % 7 2 . % 9 2 . % 6 4 . % 4 5 . ≤ 2 Mbps > 2 bis 10 Mbps >10 bis 30 Mbps > 30 bis 50 Mbps > 50 bis 100 Mbps > 100 Mbps Source: RTR-NetTest Figure 6 reveals the percentages of tests with download speeds in a given category. It can be seen that as early as 2016 most of the measurements display download speeds of 10 to 30 Mbps. While this proportion grew in 2017, it shrank slightly in 2018. The percentage of measurements under 2 Mbps dropped between 2016 and 2019, while the proportion of measurements in excess of 100 Mbps rose over the same period. Net Neutrality Report 2019 39

section 6 Other indicators and activities FIGURE 08: DOWNLOAD SPEED BY TECHNOLOGY (W)LAN 3G 4G Median in Mbps 50 40 30 20 10 0 3 1 5 9 4 5 1 0 9 4 5 1 0 9 4 5 1 7 9 3 5 1 2 9 3 6 1 0 1 2 3 6 1 0 8 3 5 1 9 9 2 6 1 8 9 2 8 1 9 9 2 9 1 0 9 3 9 1 1 9 3 9 1 1 8 3 Q1 2016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Q4 2017 Q1 2018 Q2 2018 Q3 2018 Q4 2018 Q1 2019 Source: RTR-NetTest Figure 8 depicts the median39 download speed measured with the RTR-NetTest over time, broken down by type of technology. It can be clearly recognised that, based on median, far higher download speeds can be reached with 4G mobile telecommunications technology than with (W)LAN or 3G. However, the download speed for 4G has fallen since the start of 2016. This trend was reversed in the period between Q2 and Q4 2018, with download speeds rising from 28.9 Mbps to 31.4 Mbps. In Q1 2019 the download speed for 4G mobile services fell once again, however, to 30.7 Mbps. With the introduction of a new mobile telecommunications technology, the capacities available at any given time generally follow a cycle that can be observed. When a new technology is introduced, there are initially free capacities available, which are then gradually ‘occupied’ as a result of market competition and demand, until the next technology (often associated with new spectrum) creates in turn new capacities. Consequently, the figure does not suggest a deteriorating quality of connections or in fact reveal anything about net neutrality. Of all the technologies assessed, the lowest download speeds were achieved with 3G. Considering the low data transmission rates supported, 2G connections are not included in this and subsequent assessments. The download speed for (W)LAN was relatively constant or rose slightly in the reporting period. 39 The median is appropriate because it is located at the very centre of all (sorted) observations, i.e. 50% of measurements are above and 50% are below the median. It therefore reliably excludes the influence of outliers. Net Neutrality Report 2019 41

section 6 Other indicators and activities FIGURE 10: LATENCY (PING) BY TECHNOLOGY 40 (W)LAN 3G 4G Ping time in ms 60 50 40 30 20 10 0 7 2 1 4 7 2 6 2 1 4 8 2 6 2 1 4 7 2 6 2 1 4 7 2 6 2 1 4 7 2 6 2 2 4 7 2 5 2 0 5 7 2 5 2 8 4 7 2 4 2 9 4 7 2 3 2 5 4 7 2 3 2 1 4 7 2 3 2 0 4 7 2 3 2 0 4 7 2 Q1 2016 Q2 2016 Q3 2016 Q4 2016 Q1 2017 Q2 2017 Q3 2017 Q4 2017 Q1 2018 Q2 2018 Q3 2018 Q4 2018 Q1 2019 Source: RTR-NetTest Figure 10 depicts median latency. Roughly the same figures for latency (between 22.5 ms and 27 ms) can be achieved using 4G mobile technology and (W)LANs. The figures are relatively constant for (W)LANs and 4G in the reporting period. With 3G, however, latency is much higher, although this has again decreased from 45 ms to 40 ms since Q2 2018. 40 ‘Ping’ (or ‘latency’, the technically correct term) is the time a small data packet needs to make its way from a user device (such as a mobile or laptop) to an online server and back. The ping time is measured in milliseconds (ms). While latency is a key indicator with online games, ping time can also have a significant impact on the ‘sluggishness’ of access when normally surfing in the internet. Both the technology used to access the internet and the extent to which access is utilised significantly affect latency. Net Neutrality Report 2019 43

section 6 Other indicators and activities 55.2 41.4 31.8 31.6 26.6 21.9 FIGURE 12: PRICE BASKETS FIXED VS. MOBILE BROADBAND Mobile flat ≤30 Mbps Mobile flat between >30 and ≤100 Mbps Fixed ≤30 Mbps Fixed between >30 and ≤100 Mbps Mobil flat >100 Mbps Fixed>100 Mbps EUR per month 60 50 40 30 20 10 0 March 16 June 16 Sept. 16 Dec. 16 March 17 June 17 Sept. 17 Dec. 17 March 18 June 18 Sept. 18 Dec. 18 March 19 Source: RTR Figure 12 contrasts the three price baskets for fixed network broadband (each without TV) with the three price baskets for mobile broadband (with unlimited data volume). In both cases, the broadband categories differentiated are ≤30 Mbps, >30 to ≤100 Mbps, and >100 Mbps. The basket value is based on the least expensive product from each operator that can be included in the respective basket. It is clear that, for higher bandwidths (>100 Mbps), mobile broadband is more expensive than fixed broadband (prices between EUR 40.20 and EUR 55.20), with the reverse being true for lower bandwidths (≤30 Mbps; prices between EUR 21.10 and EUR 26.60). From May 2018 to March 2019, prices for mobile broadband at high transmission speeds (>100 Mbps) rose slightly, while prices fell slightly for mobile broadband at low transmission speeds (≤30 Mbps). In the category >30 to ≤100 Mbps, prices remained virtually the same during the reporting period and have also been relatively constant historically (prices between EUR 30.70 and EUR 33.40). Net Neutrality Report 2019 45

section 7 Focus topic: zero-rating In the European Union (EU), zero-rating is practised by a number of mobile network operators (see in this regard section 7.4 below) and can be found in several different forms, such as: • an exclusive or nonexclusive offer of a service provided as zero-rated; • an offer that encompasses one service (a specific application) or a category of services; • an offer that is updated at specific intervals and references a ‘Most Popular’ list (for example, top downloads in app stores); • an integrated offer by an ISP; • an offer involving payment by a CAP for having its app zero-rated (sponsored data); • a component of a tariff or a tariff add-on that can be added by the customer for a specific charge; • an offer that is possibly also associated with technical differentiations (throttling of the service, discriminatory treatment based on data volume used); • an offer that may have varying levels of intrusiveness with regard to the underlying traffic management or the measures for identifying and charging for traffic. Consequently, it may also in some cases – to varying degrees – conflict with the provisions of Art. 3(3) second and third subparagraphs; • and similar offers. In addition, combinations of the features listed above as examples are also possible (for instance, as an exclusive, proprietary offer by the operator). Normally, the various options are to be evaluated differently with a view to their effects. A number of potential benefits are generally associated with zero-rating, including, for instance, the following: • end users are able to purchase a service without that particular service being counted towards the data included in their subscription (in other words, the users are able to consume more of that service); it potentially enables providers to win over new end users; • • Zero-rating can boost competition among ISPs (it is also generally utilised as a competitive dimension); • Zero-rating can also potentially advance CAPs’ efforts to enter the market since it increases the likelihood that they will be chosen by customers. Net Neutrality Report 2019 49

section 7 Focus topic: zero-rating The extent to which a product is (un)problematic in view of the TSM Regulation’s ‘theory of harm’ can be determined based on the answers to these questions. The more appealing the product and the stronger the market position of the CAP(s) and ISP(s), the more likely it is that end users’ freedom of choice will be limited. The more complex or more restrictive any wholesale contracts are, the more likely it is that CAPs will face barriers to their market entry or expansion due to zero-rating. Based on European decision-making practice to date and the regulatory authorities’ common understanding, it is clear that any technical differentiation that treats zero-rated traffic differently (for example, by slowing it down) than other internet traffic is equally prohibited as a product where, after the included data has been consumed, no other services are available or are only available with some kind of limitation but where zero-rated traffic, by contrast, can continue to be used without limitation. While it is true that zero-rating does not require ex-ante approval from the authorities, these types of technical discrimination nonetheless constitute a breach. As a rule, sponsored data and exclusive agreements with a mobile operator also tend to draw more attention from regulatory authorities. To review the effects of zero-rating, RTR gathers data on the use of zero-rating offers at irregular intervals.44 The dimensions surveyed include the number of users of zero- rating offers, the number of users whose use exceeds the data included in the tariff, the data included in the tariff, the data actually consumed, and the total zero-rating volume consumed. These data are collected monthly for each tariff. If there are multiple categories of applications in a zero-rating offer (for instance, audio, video, social network, and chat services), the zero-rating volumes consumed per category are also queried. In the case of offers with a special dynamic or range, the wholesale contracts are also analysed. The impact of the zero-rating offer on downstream markets will then be examined in detail if (for instance) the offer’s range is broad, usage is intensive, there is potentially an identical offer from another MNO and where the CAP has any special market position. For zero-rating offers that are comprised of whole categories of services, no data regarding use of individual applications is collected (for instance, regarding Facebook in the category ‘social networks’), as this would raise data privacy issues. At most there would be a question regarding the entire category on offer. The information provided below outlines several of the findings from ongoing monitoring (while still safeguarding business and trade secrets). 43 Zero-rating has become a key topic in the European debate regarding the openness of the internet and there are a number of relevant offers; given the aim of European harmonisation, RTR consequently believes it will be necessary in any case to adjust the assessment criteria in the event that new guidelines regarding a (potentially) revised net neutrality regulation specify other criteria. 44 The surveys are taken two to three times a year depending on the variability of the product, its range and the underlying marketing expense. These surveys are based on the provisions of Art. 5 (Supervision and enforcement) of the TSM Regulation. Net Neutrality Report 2019 51

section 7 Focus topic: zero-rating One of the concerns that accompanies the introduction of zero-rating offers is the possible increase in price per GB; in other words, that either the price of the tariff will increase and/or the included data will be reduced as a result. This could be based on the reasoning that appealing services that the customer would use regardless are already included in the zero-rating offer, and therefore the customer would need a smaller volume of freely available data, which is why this could also be limited. From a net neutrality perspective, this kind of development is worrying, since it would mean that an increasingly smaller volume of data (or an increasingly higher-priced data volume) would be available to the end user to be used for other or new services. The table below provides an overview of the A1 product portfolio for private customers, which make up the majority of zero-rating subscribers. TABLE 05: A1 GO! AND XCITE PRODUCT PORTFOLIO – RANKING OF TARIFFS Ranking by price/ GB (low to high) as of 04/2019 Ranking by absolute price (low to high) as of 04/2019 EUR/GB as of 03/18 EUR/GB as of 04/19 Delta price 03/18 to 04/ 19 in % 1 2 3 4 5 6 7 7 6 2 1 5 4 3 - 1.30 1.99 2.74 2.41 2.99 4.74 0.90 1.33 1.99 2.19 2.50 3.12 4.99 - +2.57 0.00 -20.00 +3.45 +4.18 +5.28 Tariff plan A1 Go! Premium A1 Go! XL A1 Xcite L A1 Xcite S A1 Go! L A1 Go! M A1 Go! S Net Neutrality Report 2019 53

section 7 Focus topic: zero-rating Measured as the ratio of zero-rated data used and data included in the tariff to all zero- rating tariffs in Q1 of 2018 (i.e. at the end of the last reporting period), use was still nearly zero or well below 10%. By April 2019, in contrast, the figure had risen to between 5% and 10% – irrespective of the tariff. There was a tenfold increase in the ratio when calculated as a weighted (by zero-rating subscribers) average across all private customer tariffs. The increase was smaller for business customers. A major increase is also identified at the end of Q1 2019, which was partly attributable to zero-rated video offers (in the higher-end tariffs). Explanations by A1 point to possible effects from extraordinary events such as the Champions League or even the finale of the series ‘Game of Thrones’ (not only the finale but all of the seasons could be viewed again). This does not seem implausible, since starting in April 2019 the use of zero-rated video offers drops off again significantly and is only slightly higher than the level existing in January of the same year. Nevertheless, demand for the use of the zero-rating offer definitely appears to fluctuate. The ‘consumption’ of data by consumers usually falls far below their included data – in other words, they generally wish to remain on the safe side when choosing a tariff. In view of this fact, the ratio of data consumed for zero-rated services to the total volume of data actually consumed (including zero-rating) can provide further insights. Depending on the tariff, for private and business customers this proportion ranges from below 10% to up to 30%, whereby we should also point out here that there was a significant, short- term increase in the first quarter of 2019. With regard to the concerns expressed above, these proportions mean that the average data included in each tariff was still significantly higher than the average volume of zero-rated data consumed, despite a considerable rise in zero-rating overall as well as in all of A1’s individual categories. This means that the zero-rated volume utilised within the tariff on average by all customers could also be easily covered through the included data. Because the number of A1 subscribers with zero-rating tariffs (included zero-rating and zero-rating as an add-on) still comes out to considerably less than 10% and A1’s market share in the private customer segment is less than 50%, there has thus far been no reason to assume any limitation of end users’ choice to an extent that would raise concerns Therefore, from the perspective of the authority, the commercial agreements to date (Art. 3(2) of the TSM Regulation) do not currently endanger the rights of end users (consumers or CAP) as set out in Art. 3(1) of the TSM Regulation.49 Given the current data situation, the conclusion might be different if there were no similar tariffs (without zero-rating) available in the market – if customers were in effect forced into a zero-rating offer and the pull were commensurately stronger. However, given current competitive pressure in the mobile retail markets and the existence of similarly structured offers with and without zero-rating, the conclusion is not warranted at present. The information on A1’s Free Stream offers provided thus far has dealt with zero-rating as a whole or individual tariffs and customer categories, as well as the question of how powerful the pull exercised by these products is and whether innovations might be hampered (via the effects on the end user side). Admittedly, this view is inadequate for the assessment of the effects on downstream markets. Other levels need to be examined here. As a first step, we will now shift our focus to individual categories of zero-rating products. 49 See recital 7 of the TSM Regulation. (7) [...] Such agreements, as well as any commercial practices of providers of internet access services, should not limit the exercise of those rights [Note: under Art. 1 TSM Regulation) and thus circumvent provisions of this Regulation safeguarding open internet access. [...] National regulatory and other competent authorities should be required, as part of their monitoring and enforcement function, to intervene when agreements or commercial practices would result in the undermining of the essence of the end users’ rights. Net Neutrality Report 2019 55

section 7 Focus topic: zero-rating 7.3 Wholesale level: the CAP–ISP relationship To complete the picture, in addition to a more detailed view of the situation from the consumer side as set out in the section above, we also need to examine the wholesale level. Here as well it is primarily the products offered by A1 that are of interest, since other providers do not have corresponding categories in which CAPs can be included openly, or do not or no longer push zero-rating offers. As stated at the start, at the wholesale level the primary concern is the openness of the offer and its terms and conditions, which can become barriers to market entry or expansion. In principle, any service provider offering services in one of the specified categories can become an A1 zero-rating partner. To date, RTR has not received any complaints to the contrary and A1 has not reported any such in connection with monitoring. There was only one company that had showed interest in becoming a partner, but it ultimately decided on its own accord to shelve the idea. According to information provided by A1, the average length of time required to include a new CAP in the offer is about two to three months. A1 makes the decisions regarding category definitions and allocating a specific service; this makes A1 the gatekeeper, determining the number of tariffs and/or the number of customers who can be reached. There is nothing in place to allow individual (as the case may be, particularly strong) CAP partners to have a say regarding the inclusion of new zero-rating partners in the offer. If there is a legitimate suspicion that a streaming service breaches statutory provisions (e.g. copyright law) or contains inappropriate content, A1 can refuse to allow participation in the programme or, if the service is already being offered, suspend the service if necessary after demanding that conformity with the law be established. A1 can adapt the scope and structure of the zero-rating offer as well as the allocation to tariffs at its own discretion; any decision regarding discontinuing the offer also lies exclusively within A1’s purview. As far as the scope of the zero-rating offer is concerned, A1 distinguishes and defines each of the four categories mentioned above. This is an attempt to precisely delineate which component of traffic is now actually subject to zero-rating.52 As for the technical terms and conditions for inclusion in the offer, A1 stipulates that zero-rating can only be implemented if the streaming partner keeps A1 continually informed of the precise and complete technical specifications allowing A1 to separate the zero-rating content from other content. In A1’s view, the appropriate technical specifications are comprised of: IP addresses • • URL (uniform resource locator) • SNI (server name identification) • Protocols In RTR’s view, while the use of the IP address for traffic identification seems unproble- matic, there are nevertheless doubts concerning the other options as to whether these are compatible with the provisions of Art. 3(3) second subparagraph of the TSM Regulation and applicable data privacy law. A broader discussion of this issue has flared up recently in data privacy circles as well,53 but we will have to wait for the revised BEREC guidelines to learn of the outcome and any ramifications. Nevertheless, it is a fact 52 For example, chat services are defined as “solely text, image, video and voice messages via the respective app, provided such are received and/or sent as a completed message”; any other services that might be able to be used in the app, for instance live voice or video telephony, or externally linked content, are excluded from the zero-rating offer. Quoted from the General Terms of Service “under which streaming partners can participate in the A1 Free Stream offer by A1 Telekom Austria AG”. 53 Vgl. etwa das Schreiben der EDRi an verschiedene Institutionen: https://edri.org/wp-content/uploads/2019/05/20190515_EDRiOpenLetterDeepPacketInspection.pdf Net Neutrality Report 2019 57

section 7 Focus topic: zero-rating TABLE 07: GEOGRAPHIC DISTRIBUTION OF STREAMING SERVICES BY REGION AND CATEGORY Co. headquarters / Category Video Music/audio Chat Social Number in Austria Number in the rest of Europe Number in the rest of the world 5 12 2 12 3 3 0 1 3 0 0 2 As of April 2019 For an overall picture of the Austrian market, the issue of the future of zero-rating offers also needs to be raised. The more data is included in tariffs and the stronger the competitive pressure is towards flat-rate offers, the less appealing zero-rating offers start to look. It remains to be seen whether zero-rating offers should be viewed as upselling strategies intended to make it more appealing for companies to enter the field of flat-rate products. The fact that Magenta has not offered any such tariffs to date and is now offering flat rates for its top-of-the-line smartphone products (5G Ready, Mobile Gold, Mobile Platine) could imply that zero-rating products are possibly just a short-term, interim step towards a broader distribution of mobile flat-rate products. It has also been noted that H3A has not launched any new zero-rating offers in quite some time and that existing offers (like Spotify) are expiring. In any event, support to ensure a competitive environment remains essential for development of the mobile telecommunications markets. The following portion of this special section on zero-rating expands on the issues and deals with the international significance of zero-rating offers and their effects on prices and included data volumes. At its heart is a comprehensive econometric analysis that examines the previous impact of zero-rating offers. Net Neutrality Report 2019 59

section 7 Focus topic: zero-rating number of mobile network providers or countries with higher data limits in comparison with countries having lower data limits). Finally, we now look at the effect of zero-rating across different categories of apps. Viewed thus, we find that tariffs including only social media and chat apps are associated with a higher volume of included data and a lower price per GB than the control group (tariffs without zero-rating). For tariffs including only zero-rated video or audio apps, the reverse tends to be observed. Overall the study comes to the conclusion that zero-rating appears to have no systematic effect on other tariff features such as included data, price and price per GB. Instead, the effects vary across countries, the period observed, and among application categories. The findings therefore support a case-by-base evaluation of the (potential) consequences of zero-rating. Where zero-rating is to be assessed on a case-by-case basis (and the effects on the market as a whole), the assessment of the specific effect in individual countries should be undertaken in a way that takes into account the situation in that particular country. RTR’s study, in English, can be downloaded from https://www.rtr.at/de/inf/ZeroRatingEU2019. Net Neutrality Report 2019 61

section 8 Outlook on further activities analyses derived from that information (such as hedonic prices, the mobile price index and price baskets). Additionally, the continuous further development of the RTR-NetTest provides a significant instrument to measure quality and data transmission speeds. On the whole, this provides a foundation for further RTR indicators and analyses. All of the relevant information, published in RTR’s quarterly Internet Monitor and Telekom Monitor, can be downloaded as Open Data57 by interested parties. 6. Certified monitoring mechanism. The regulatory authority has been offering the RTR-NetTest for several years now (www.netztest.at). This is used for evaluation purposes in conciliation procedures (as well as court proceedings) in order to ascertain whether the operator is or has been providing a deficient service. Since the TKG amendment in November 2018, the regulatory authority has been offering a performance monitoring mechanism for end users (Art. 17b TKG 2003), which is considered a certified monitoring mechanism within the meaning of Art. 4(4) of Regulation (EU) 2015/2120. A review is currently underway to determine whether any, and if so which, other steps will need to be taken under that provision. International cooperation The special significance of international cooperation in the context of net neutrality was highlighted in section 3. Collaboration at this level will continue in the coming reporting year (05/2019 to 04/2020) with the priority areas described below.58 1. The international exchange among regulatory authorities, aimed at a harmonious implementation of net neutrality provisions (within the framework of BEREC but also bilaterally), will continue in 2019/2020, for example through ongoing procedures as well as the joint discussion and analysis of relevant products. 2. A BEREC report on implementing the TSM Regulation will be compiled and published towards the end of 2019. The report will be based on the national reports on net neutrality to be released by 30 June 2019 and on the BEREC data survey to be carried out in June 2019.59 3. BEREC began to work on an update to the existing net neutrality guidelines at the beginning of 2019. The basis for this work is the BEREC Opinion on the evaluation of the net neutrality regulation, which was sent to the European Commission at the end of 2018 and used as input for the evaluation of the TSM Regulation by the European Commission. A stakeholder workshop regarding the update of the net neutrality 57 See RTR’s Open Data Portal, https://data.rtr.at 58 The information provided in the following is primarily based on the BEREC Work Programme 2019: https://berec.europa.eu/eng/ document_register/subject_matter/berec/annual_work_programmes/8337-berec-work-programme-2019 and on the draft for the BEREC Work Programme 2020: https://berec.europa.eu/eng/document_register/subject_matter/berec/annual_work_pro- grammes/8365-outline-for-berec-work-programme-2020. The last version of the 2020 work programme, currently under prepara- tion, should be finally adopted in late 2019. The 2019 Work Programme is currently being drafted and should be finally adopted in late 2019. 59 BEREC Report on the implementation of Regulation (EU) 2015/2120 and BEREC Net Neutrality Guidelines. Net Neutrality Report 2019 63

section 8 Outlook on further activities Cooperation with network operators After a range of events and discussions in the context of adopting the TSM Regulation and the BEREC guidelines, the current reporting year was dominated by procedures and discussions on how to resolve certain practices deemed problematic from a net neutrality perspective. There were detailed discussions (beyond procedures) in particular on zero- rating issues and regarding individual aspects associated with network slicing. RTR expects that these two topics will also be at the top of the list of issues to be discussed in the upcoming reporting year, whereby the focus of the talks was last aimed at the application of the provisions of the TSM Regulation in concrete terms to new net and service developments. Elsewhere in this report we explained how certain practices were transparent for and tolerated by the authority in certain cases, while solutions were found in many other cases in consultation with the network operator. As previously, the regulatory authority continues to encourage all network operators, interested institutions and other stakeholders to take part in open dialogue about any issues that might arise as well as new developments and concerns relating to net neutrality. Information for the public and further considerations To the extent such information can be made accessible to the public, the activities mentioned will be made available on the RTR website, or RTR plans – as has been done in the past – to refer via its website to other relevant proceedings, studies, and activities by institutions in the general field of net neutrality.62 62 For details, follow these links: https://www.rtr.at/en/tk/Netzneutralitaet und https://www.rtr.at/en/tk/Internationales. Net Neutrality Report 2019 65

section 9 Appendix 14 26 26 27 38 39 41 42 43 44 45 46 15 17 32 34 53 54 59 66 9.2 Index of figures and tables Figures Figure 01: Figure 02: Figure 03: Figure 04: Figure 05: Figure 06: Figure 08: Figure 09: Figure 10: Figure 11: Figure 12: Figure 13: Tables Table 01: Table 02: Table 03: Table 04: Table 05: Table 06: Table 07: Table 08: Timeline of events in the reporting period Schematic diagram of website access Schematic diagram of a DNS block Schematic diagram of an IP block Fixed and mobile broadband connections Distribution of download speeds over reporting period Distribution of upload speeds over reporting period Upload speed by technology Latency (ping) by technology Download and upload speeds by time of day in 2017 and 2018 Price baskets fixed vs. mobile broadband Quality of service test (RTR-NetTest) Timeline of events in the reporting period Summary of problematic practices in light of the TSM Regulation Overview of categories of suspected NN breaches Procedures in accordance with Art. 5(1) TSM Regulation pending in reporting period A1 Go! and Xcite product portfolio – ranking of tariffs Tariff plans with zero-rating available to A1 private customers – April 2019 Geographic distribution of streaming services by region and category Sections of this report as mapped to the BEREC guidelines Net Neutrality Report 2019 67

section 9 Appendix TCP TFTP TKG TKK TLS-SNI Transmission Control Protocol Trivial File Transfer Protocol; very simple (and early) file transfer protocol Telecommunications Act Telekom-Control-Kommission Transport Layer Security – Server Name Indication; an extension of the transport layer security protocol that allows multiple encrypted, retrievable websites with different domains to share one server on TLS port 443, even if it has only one IP address TSM Regulation Telecoms Single Market Regulation; REGULATION (EU) 2015/2120 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 25 November 2015, laying down measures concerning open internet access and amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services and Regulation (EU) No 531/2012 on roaming on public mobile communications networks within the Union. UDP UrhG VoD WAN User Datagram Protocol; a minimal, connectionless network protocol that is part of the transport layer of the internet protocol family Federal Act on Copyright in Literary and Artistic Works and Related Rights (Urheberrechtsgesetz) video on demand wide area network Net Neutrality Report 2019 69