US government commits to publish publicly financed software under FOSS licenses
k7r.eu
k7r.eu
> Applicable exceptions are as follows:
> The release of the item is restricted by another statute or regulation, such as the Export Administration Regulations, the International Traffic in Arms Regulation, or the laws and regulations governing classified information;
> The release of the item would compromise national security, confidentiality, or individual privacy;
> The release of the item would create an identifiable risk to the stability, security, or integrity of the agency’s systems or personnel;
> The release of the item would compromise agency mission, programs, or operations; or
> The CIO believes it is in the national interest to exempt publicly releasing the work.
"Security through obscurity" will mean that nothing gets opened.
Whether or not it's feasible is entirely dependent on the project, though. Something that's ITAR/EAR (or classified) is never going to be open-sourced.
Ideally, with some sort of force opposing propriety, the incentive would be such that the government would think it in its best interests to granularize their code into small libraries, programs, and network services, so that they could open-source as much as possible, leaving tiny "classified kernels" as wrappers for libraries or plugins for apps.
For an idea of such a force: maybe create a "proriety credit" that a government department would to buy for each 1000 lines of code they refuse to release, whose funding goes to this effort to open-source everything else?
I still kinda think the blunt instrument is an improvement over the status quo, but it's hard to say.
/ (the stability, security, or integrity of the agency’s systems)
(an identifiable risk to) < (or)
\ (personnel)I wonder if this would make it easier to build a replacement whose interface isn't utterly terrible. Of course, the hard part would be convincing the courts to use it. Based on a sample size of one Clerk of Court, who thinks PACER is absolutely fantastic, this will be hard. To be fair, it is state-of-the-art in terms of access to court documents in the US.
BTW - check out www.casetext.com for an idea of what private enterprise can do in terms of making public records useful.
Why should there be fifty different software programs to register for a state campground? Or deal with the DMV? When the Feds pass a new law some contractor ends up writing the same software fifty different times for each individual state with small differences.
I believe the key is to have a plug in architecture, like WordPress, that allow each state to adopt the program for their individual laws. I think the savings could be tremendous and its entirely possible with multiple states collaborating the software could be continually improved.
I failed to convince them that day but I think the tide is turning.
For example, every classified document has a classification level (Secret, Top Secret, with more details on it). And the functionality to roll up the classification is re-implemented by every contractor every single system. So even within ONE agency, every system's implementation is done from scratch.
It's the perfect kind of thing that could've been an open source library (still in a classified network though), but still extremely valuable. It's something I built and recommended to my superiors ten years ago when I worked for a government contractor, but we didn't get much traction for various reasons. (Cynically, most contractors want the free money to reimplement it, so they aren't going to stop that gravy train.)
So there is a LOT of room even within each single agency, to share code that is common to their business practices.
You'll be hard pressed to find an area in any large organization (public or private) that couldn't benefit from the efficiencies of reuse.
Why not also publish publicly financed: * legal agreements * HR contracts * management presentations, best practices, and training material * marketing presentations and training material * creative output such as artwork and music
so that the rest of the world can use them for free..
If I'm not mistaken, all intellectual property published by the US government is public domain by law. I may be wrong or you may be referring to something else.
If a work is a work prepared by an officer or employee of the United States Government as part of that person’s official duties, then it is not subject to copyright in the US.
It might be subject to copyright in other countries, though.
If the government pays for a work to be created and published, but it is not a work prepared by an officer or employee of the United States Government as part of that person’s official duties, then it will be copyrighted and the copyright owner will be whoever it would be normally. If there is an agreement between the author and the government to assign the copyright to the government, the copyright will still be valid, and owned by the government.
Laws like requiring all commits to be submitted by the author. Authors must disclose potiental conflicts of interest, affiliations, etc. Submitting commits on behalf of another entity is treason; meaning if a funder wants a policy written, they post the funds, select another entity, selected entity assigns staff, staff submits policy, etc.;
All public, all real-time.
The intent seems good, but the details will be everything.
Its also suprising to see that this question popped up after 500+ points.
The reason why there is a bit of resistance with open source as a default is because funding has to be traced.
Guess I'm going to lawyer up again..
Example - I did a FOIA that was rejected absurdly unfairly. Going through the attorney general took about 6 months to hear a response back, which Chicago's lawyer then used essentially a mistype to throw that request out. 8 months in total there. Fast forward 6 months later and we have a court date with a lot of small things in between then and now.
1. Definitely a lot of laziness from the FOIA officers. Some are really great, but others not so much.
2. There's no standardization in how it's handled within the city. Departments in the same buildings have very different idea of what should be rejected, their helpfulness, looseness of FOIA interpretation, etc.
3. They're truly not technical in the slightest. At one point I asked for a database dump, excluding sensitive columns and tables. The response was "Wikipedia defines a Data as:", so I had some fun explaining that one.
4. Fighting the process takes a very long time, so a rejection is an easy way to get someone to go away.
5. Not a reason, but still annoying.. They wait the maximum days to respond to your requests. Of the 50 or so I've submitted, I'd say 45 of them have been last minute. 25 times out of the 50, sure... but most?
It's a lot of work if it gets to that point, yep, but I've only ever needed my lawyer to file a suit. The average FOIA might take me 5 minutes to write, so it's not really that much time - especially considering what you get for it.
Here's an example one with some pretty neat data from it: https://github.com/red-bin/chitickets
That ticket data is actually managed by IBM, so that even adds an annoying translation dynamic.
This current suit is because the city thinks it's 'unduly burdensome' to resolve city-owned phone numbers to names that were dialed by Chicago's mayor. Initially I could have understood that, but it became pretty clear pretty soon that they really didn't want me to have those records with these rejections:
Some more detail on the rejections I've been through this past year and 4 months:
-Original request asked for the mayor's records. Rejected for "no such records". Heh.
-Second was for the FOIA officer's phone records. Again, "No such records". (This was just a test to see if the mayor's phone was the only one without any records..... and it was kinda funny ;))
-Sent a request to Chicago's IT dept for their VOIP logs, which got me a file with the first 6 digits of all of non-government phones that were dialed. Government phones were completely redacted for "privacy" reasons. So, so many things wrong there.. especially since FOIA specifically disallows that sort of redaction.
-Sent a "Request For Review" to the attorney general's office, who took 6 months to agree with me and told the FOIA officer to give me the records. Chicago's lawyers then threw the VOIP request out, since they don't have VOIP. The assistant attorney general on the case and my lawyer both said (paraphrased) "They're right, but that's a total dick move and they know it."
-Submitted a cleaned up request, without "VOIP". They sent the same file from before. Same creation time and everything.
-Now we're waiting through the long court process...
About the attorney general's RFR process, though..
You can submit FOIA requests anonymously, but you can't submit RFRs anonymously! Their reasoning was that I need to have a valid signature with my named spelled out in plain text, despite ESIGN allowing pseudonyms. So - don't like that anonymous person? Just don't respond to their request and they'll either have to sue using their name or submit an RFR using their name. I fought that one for about a month and eventually submitted a FOIA request to the AG's office asking for the email chain that led to that decision. That got rejected with something like "deliberation discussions cannot be released."
I got involved with this after working with one of the old mayor candidates, Amara Enyia. The plan was to give her the parking ticket data which would be used for her campaign. The day we were supposed to meet, two of the candidates and an ex-senator effectively colluded to get her kicked out of the race by questioning her signatures. The guy who submitted it was related to Dock Walls and friends with Ricky Hendon, iirc. Her campaign manager then went to Bob Fioretti's campaign, where they invited me over, where I gave Fioretti's campaign manager and Amara's campaign manager the full data. Fioretti's manager called it "fucking golden"..... I never heard back. A bit later, he made parking tickets a big part of his campaign.
After seeing Dock Walls, Ricky Hendon and Willie Wilson colluding to get Amara out of the race (seriously, they talked about it on facebook, publicly), it seemed a little suspicious that Fioretti's team didn't bother responding, considering how much they liked it. The phone records request was just a probe to see if the collusion ran deeper. Whether it's true or not isn't the point since, 1. I don't care enough about politics. 2. It's the principal of the entire thing.
For what it's worth, Fioretti dropped out of the race and gave Rahm his support the weekend before the election. :)
Your story is concerning, but I'm not surprised. In my opinion, the system itself filters for this sort of behavior - and it gets worse in the upper echelons of the competition because in the upper echelons it becomes less and less feasible to deviate from an "optimum approach". My assumption being that the "optimum" approach includes participation in unfair and antisocial techniques.
The idealist in me thinks those behaviors can be fixed even though it's "turtles all the way down". Though, if enough people do enough tenaciously peaceful civics work, then hopefully things will get slightly better. By treating everything as a mystery as [0] and [1] talk about, things become manageable.
[0] http://www.smithsonianmag.com/people-places/risks-and-riddle... [1] http://www.newyorker.com/magazine/2007/01/08/open-secrets-3
http://www.informationweek.com/applications/nsa-submits-open...
;)
And does it substitute for system monitoring/config tools that are popular or just complement them?
So for example, my local council wants to purchase software to help track customer feedback from dozens of sources (web sites, phone ins etc). Sounds perfect for a web era, message queue based project.
But my council is only interested in meeting its fiduciary duty in buying software that already exists, and has been proven to do the job required. Speculative development is out - even though pretty much everyone of 430+ councils, parishes, towns etc of the U.K. Will want something similar in the next few years.
No one is willing to stump up the cash to start the open source alternative.
It's a tragedy of the not commons.
I think there ought to be solutions in some kind of development bonds or other financing arrangements - but it's not clear how.
As further confirmation, it's cemented as one of the ten design principles behind GOV.UK: https://www.gov.uk/design-principles#tenth
https://18f.gsa.gov/2015/01/16/open-source-for-good-governme...
> However, it is encouraged to be retroactively applicable for the existing custom-build software developed by agency employees in the course of their official duties.
As much as I love FOSS, anything produced by the government — including software — is public domain, right? The government is not eligible for copyright — including FOSS licensing. While I understand that the government sometimes contracts stuff out, and those third-parties seem to enjoy a weird exception to the rule, the article seems to be including stuff developed directly by the government for the government. How do they think they have any rights to it at all?
Because many governmental projects are politically sanctioned, done properly, this could become a great way to do R&D where the private market doesn't.
A better outcome for this type of system would be a pre-election and post-election verification of each machine (which isn't unreasonable since the number of machines is far less than the number of ballots) in which interested agents from each party/group could be present during the verification process (and use their own machine if they desire) to ensure that all the digital signatures match and there's no foul play.
Right now if there is a bug that creates incorrect vote totals it would be very hard to prove it was done intentionally. If the software was required to be open source, then just the fact that they were running different software than was published would be strong evidence that it was intentional.
>> ... will be fitted with a printer that will have a drop box to store the paper trail of the votes cast. This is expected to alleviate concerns — expressed earlier by the opposition led by BJP — over possible tampering of EVMs to favour a certain candidate.<<
http://www.business-standard.com/article/pti-stories/2019-ge...
http://timesofindia.indiatimes.com/india/EC-ready-with-new-a...
https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089...
"Hearing on San Francisco's efforts to fund, design, and implement an open source voting system, including budget costs and projected roll-out schedule; and requesting the Department of Elections and the Elections Commission to report."
It's currently up for consideration in the budget.
SF resident Brian Behlendorf recently endorsed (along with EFF, Code for San Francisco, California Common Cause, local GitHub CEO Chris Wanstrath, etc), and we're looking for more high-profile supporters to help influence the Mayor's budget decision:
For a true to life example, look at the NSA.
Looking at the exemptions carved out of this rule (assuming this source is accurate), this looks more like it is codifying the secret nature of government operations than it is opening up anything substantial.
Hard to regard this as good news, although it may be another straw on the back of the government finally falling and the emergence of an actual open and peaceful world.
I think some just let irrational hatred make them believe inane fairy tales.
Do you think that this is a reasonable belief?
If so, then it logically and obviously follows both that 1) development of products by the government (to the extent that this is even the reasonable purview of information age government at all) need to be conducted in a profoundly public way and that 2) a failure to do this will result in a properly disaffected populace and shortened moral stature on the part of the government.
It is no fairy tale to suggest that secrecy in government is a substantial part of the formula of government failure more generally. The only assertion I'm making that might not yet be in evidence is that, amidst the information age, this aspect of good government is more important and that its effects will be realized far more quickly.
>npm install xkeyscore
npm ERR! 404 'xkeyscore' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it