How I changed the law with a GitHub pull request
arstechnica.com
arstechnica.com
The Council is able to publish the law better and faster than ever before. With the District’s previous codification contractor, updates to the DC Code were published three times a year, and there could be a five-to-seven month delay in seeing the latest laws. But the Open Law Library has shortened the publication process to about a week after a law is enacted.
It also means we’re all getting to see more of the actual law that governs us—not the law as it was months ago.
I was surprised I knew the author - he maintains mail-in-a-box, a popular mail selfhosting package.
But agencies that move towards open source initiatives, non-profits etc end up being a lot more responsive and overall end up a lot better off. Unfortunately there's a lot of entrenched commercial entities (ex Oracle) that want things to remain the same so it's going to be hard to rout them. Initiatives like this give me a bit of hope though.
Okay, so they didn't "change the law." It's a cool story but not a fan of clickbait titles either.
I mean, I'm sympathetic to your complaint. It implies something more substantive than it really means. But I also appreciate word play. (shrug)
To be fair, my own distaste for clickbait is palpable here. But I think I can suspend it in light of the importance of this article's bigger point.
I've always thought this sounded like a good idea, and to see it actually happening is pretty amazing. Here's hoping it catches on.
These change sets are almost impossible to use as they are, so the Council creates an official compilation of all the change sets as applied and organized by subject. This is the Code of the District of Columbia. Usually, when people think about "the law" they are thinking about the code, because that is how people interact with it.
The laws as passed by the Council cannot (and should not) be changed via pull request. Here, the useful representation of those laws, the representation used by everybody who actually interacts with the law, has been updated via PR to more perfectly reflect the underlying laws.
One thing I was wondering is how you would deal with more tricky issues/pull requests. Obviously we probably won't see people writing whole new laws in the pull requests editor but what if it was something like a sentience was written in an unclear way and someone opened an issue asking for it to be clarified or maybe they made a PR rewriting it to make more sense while still keeping the intent the same?
The system does not in any way change the legislative process, so you cannot use a pull request to make any substantive change to the law. That would include rewording, changing punctuation, fixing numbering, etc. If such a pull request were made, it would be immediately closed. As throughout history, the only way to make a substantive change to the law is to petition your representative to sponsor a bill and then convince the legislature to pass it.
If we are DC local how can we get involved?
I haven't been able to check yet, but does anyone know if you are allowed to use this process to propose new laws or clarifications of laws more substantial than simple typo fixes?
Sure, you aren't going to have non-lawyers crafting legislation, but could this be used to bring up clarifications that could impact rulings or increase/decrease scope of current laws or something similar? (I'm not a lawyer, so I don't know what are big and what are small changes here)
Imagine if proposed laws could be commented on, have changes offered, debated, and ultimately decided on in an open fashion like this! With a public "audit trail" of sorts showing the history of changes the law went through.
I know this is optimistic, but I wholeheartedly believe that more openness and more people involved will ultimately lead to better laws.
"You" as in you, a citizen off the street proposing a new law? Unlikely. You could use it to form the basis for a ballot initiative, I would think?
https://www.eff.org/deeplinks/2018/10/appeals-court-tells-ge...
The fact that a pull request was accepted was now that strange because it could have been done by the council representative.
For this kind of use case it would make more sense to me some sort of block chain, not controlled by a single company.
"This isn’t a copy of the DC law. It is an authoritative source. It is where the DC Council stores the digital versions of enacted laws, and this source feeds directly into the Council’s DC Code website at https://code.dccouncil.us/dc/council/code/."
So the activity is likely happening on the larger and more exposed GH service, while internally there is a daily copy bring backed up that isn't (as) exposed to hackers.
Something life that would be a great way to displace risk.
Doesn't seem likely.
Seriously, I'd imagine they treat it as “someone else's problem” — like backups.
If GitHub gets hacked, I imagine their plan is “be affronted, and sue”. When GitHub's lawyers point out that the terms of service don't guarantee anything, the plan says “be even more publicly affronted that GitHub refuses to take responsibility, while taking no responsibility”.
It would be treated no differently than someone else trying to tamper with the written law in any form.
It's a bit like saying that the paper on which the law is printed may not be produced by a private company, which of course, doesn't make sense.
The only bookstore chain where you can find the trusted, canonical copy of the book -> GitHub.
The government should host the canonical copy itself. Then, and only then, it can be replicated to any other commercial service willing to host a mirror. Be it GitHub, BitBucket, GitLab, sr.ht or anything else. Git architecture is so well suited for it that it's particularly striking to not see it done there.
What is needed is cryptographic authentication so that the git servers can be completely untrusted. This is also necessary to comply with the Uniform Electronic Legal Material Act (adopted by DC here: https://code.dccouncil.us/dc/council/code/titles/2/chapters/...). We will be rolling out such a system based on TUF in Q1 2019.
Regardless, I would expect hosting, authoritative DNS and certificate to all be handled by the government itself. It's not a startup that's getting free vouchers for AWS to burn, public infrastructure should be either handled internally, or via some public auction on government's terms.
It is really common for the government to outsource this kind of thing, and most times it results in users paying fees to the private company for access. With GitHub, no fees are necessary. So win win.
The law should have had a test case created, which would have the equivalent of ensuring that police officers are not in violation of the law, when they are serving active duty, or going home. NJ’s assembly had to rush in some middle of the night legislation to fix this “bug” in the law, that nobody caught.
I would love to see this applied to all laws. As the article states, software and law have a lot in common. Testing should be one of them.
https://github.com/steeve/france.code-civil/commit/dfd5918f9...
Hopefully DC (and others) will look at doing GPG signatures[0,1] so that they don't have to trust github's authentication as much. Github has a nice GUI that reflects signatures with the "Verified" tag, which you can see at[2].
0: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
… which would immediately be noticed by everyone using the repo. How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?
> How many scenarios are there where a compromise wouldn’t include GPG keys or the attacker simply uploading their own key?
If the user's github credentials were compromised (lots of ways for that to happen which don't involve their system/keys being compromised, like using the same password across sites), then using GPG signatures would still allow cloners to check/detect problems since they wouldn't have the maliciously-updated github GPG key (or they might be one of the few folks still using the Web of Trust).
Furthermore, it's possible to have a local system compromise that doesn't give access to GPG keys, as keys could either be password protected or kept on a separate system that's primarily used for signatures (not extreme for a system that distributes law).
Also, signatures not only protect the latest commit, they also sign the previous commit hash(es), protecting previous commits and preventing a history rewrite. Without them, a history rewrite that left recent commits unchanged but modified some text could have the chance to go unnoticed.
EDIT: small clarity tweak
This assumes that the attacker wouldn't simply upload their own key to public keyservers with the same email address. I would be shocked if more people would notice the use of an additional key than would notice, say, Git's warning when history changes between different repos.
The big win is having multiple copies with independent access control. I'm not opposed to using GPG but in practice the benefits are fairly minimal and there's a massive usability hit for anything involving GPG. In the case of a legal code that's probably justified but it's probably well into diminishing returns.
* : Last I checked, the two most popular Linux distros I'm familiar with (CentOS and Ubuntu) only make their iso hashes available via http-only served files that are GPG signed
Would much rather see this on a self hosted GitLab but this is a good start for sure.
It's a only a small part of the laws published on https://lafabriquedelaloi.fr for now but should be complete soon !
Disclaimer: I work on the project
I have been thinking of running for local office (one seat in particular is always uncontested), and my platform would basically be: I'll set up a method for constituents to voice their opinion in a transparent way. I'm thinking something like change.org, but with some way to verify residency.
I think citizens don't get as involved as they want to because the barrier to entry is too high and the results are too opaque (don't know how many called, emailed, etc). I would love to start a movement for more open government, but I'm just not sure the demand is there.
I wonder how well code-style line-oriented diffs work for laws. If you word wrap then your single-line changes can cascade and effect many lines. If you don’t word wrap seems like you need a better way to see diffs within long lines. Seems totally solvable, but that what github does for code might not be right.
But this is so awesome, pull requesting a typo. Go DC really forward thinking.
Of course, it could also work against you, but either way, it's one less thing that's open for discussion.
Consider what would happen if Microsoft decided to delete the repo. There will still be copies of the law at different places, but there would no authoritative version. Imagine a lawsuit where each party is arguing that their copy of the law is the "correct" one.
They wouldn't just have picked someone's favourite service without thinking, because fair competition is a fundamental ingredient of a well-functioning capitalist market economy.
Right?
Seems to be a great domain.
(Colemak user here)
I want draft laws, I want to see all representatives as contributors and be able to see their contributions and changes to draft laws.
the House should have a master branch that submits pull requests to another repository, the other chamber having one too
The Governor/President gets to approve PR's from that jurisdiction
It would become SUPER easy to track origins and changes of laws, let alone browse them, and comment on them.
I'd like to see this done retroactively all the way back to English law
Any effort to do so will lead to tyranny.
It's just a process that would lead to some interesting outcome. Nobody's suggesting anything about enforcing that outcome to anyone.
I am linking to a particular law I followed from inception to passage, an amendment to the Delaware limited liability company Act allowing company records to be kept on Blockchain.
https://legis.delaware.gov/BillDetail/26554
You get the name of the Sponsor and co sponsors, additional sponsors, sign status, next steps, committee reports, action history, etc...
My main problem is that many laws are written as: “Hereby strikes section b of USC1788(1)(iii) and replaced the word or with and”
And with this kind of system it would be standardized already on how to see what the modifications look like, or at least jump to that old version of the law easily
When the final laws are all merged together after a passed bill makes simple instructions instead of the plain text law, it would be easy to see the version history of that section of the law, or act
Thanks! All the other comments have been “hey the system you described has been around for many years, with all the problems you described but I didnt notice those just going to make a rebuttal to your idea for rebuttal’s sake”
I've actually thought about this for some years, but idly, and I haven't found the time yet to get started. It just seems like an excellent and obvious-to-me use for HTML.
Florida has a search function for their statutes that allows you to then select the year/version of the law. If the Law was amended in a given year in the annotations there are “redline versions” of the law pre amendment, with changes and final.
So again similar to what you describe but as you say...limitations to existing systems. Obviously standardization is also another problem, it would be hard enough to work with federal code and 50 states but the reality is each county and city/municipality can have their own bodies of laws, rules, regulations and ordinances...so thousands of bodies of law, in the US alone.
Real time access to laws as they are drafted is a Really Bad Idea. Good ideas need time to incubate. The system you want would lead to the sound byte version of legislating.
Only a better system
Plus, fine-grained version control doesn’t imply real time updates. It’s fully possible to only release the version history to the public after the law is approved.
Good point, but if they used a distributed version control system, lawmakers could have any number of private repositories on which to craft laws before they're merged to the public master repo.
(I wouldn't expect lawmakers themselves to use git, of course; their staff would do this for them.)
I.e., your design if not bug-compatible will be rejected.
Github is free to use for open source projects, self-hosting by the government would only make it more expensive for the tax payer.
That's the problem though. In principal, if they only use pure-git operations in the process, it would be easy to move at any point. But if they leverage the entire Github platform, i.e. PR discussion, issue tracking etc, then important parts of the legal history will be bound to the github platform.
And that's not great. Github is free for public projects for now, but as with any publicly traded tech company, they're able to change the terms of use of their product at any time to suit the needs of the company.
When we're talking about enshrining the laws of society, we're talking about a very long-term proposition. Technology companies pivot and or kill products all the time. What if we decided to record legislative history on Google Flow?
That doesn't solve the interop problem that would exist in trying to implement secondary UI systems that can redisplay that information usefully, but ETL of that sort is full of options and developers with experience.
JSON dumps of GitHub information would be useful to more open source projects beyond legislative history. I think a good automated solution could be generally useful, if someone wanted to invest in it.
They also have self-hosted enterprise contracts so I'm sure something like that could be done if the government were interested.
If we are talking about accepting PRs for drafting legislation in git, where it is hosted and who hosts it becomes extremely important. Sure anyone can clone/fork, but only the appointed central repo could become law. A clone that you or I make will likely never have this ability.
I want sentences to be GitHub as well, so that an inmate can hack github to change his sentence.
Some review process needs to be there, and frankly, even a typo correction IMO needs to be run by the Mayor because she/he signed one thing into law and this process changes what they signed. We cannot ever assume we know the intent of the Chief Executive, even when “obviously” in error.
OTOH, a diff system for law is awesome. California uses a similar system but it is cumbersome to do things like “show me how this section evolved over time”.
Whats important is having eyes on what changes are made, and if you want to track changes and revisions to something... github (and gitlab, phabricator, etc) is pretty close to the optimization of that problem humanity has developed up to this point.
The text already mentioned "The Freedom of Information Act of 1976" unambiguously, but the metadata was incorrect.
The mayor didn't sign a website.
The author clearly indicates the website did not accurately reflect the act as enacted at the very beginning of the article: "Comparing the DC Code to the act that made the change, I noticed that something was amiss..."
> This sort of “technical correction,” as lawyers would call it, didn’t need to be passed by the Council and signed by the Mayor.