Why me?

OSS contributor & maintainer since ~2008

Helped write the DoD's 2022 open source policy

Wrote the 2023 DHS open source policy

1. Why Open Source?
2. The Challenges
3. The Policy
4. The Reality
5. The Possibilities

Reusability

Collaboration and Contribution

Security

Cost *

For the people...

"OSS is insecure"

"It's illegal"

"We paid for it, it's ours."

Lack of Techincal Knowledge

Federal Source Code Policy (M-16-21)

Section 5: Open Source Software

• Pilot program to release 20% of gov code as OSS
  (ended in 2019)
• Participation in the community
  • Open development practices
  • Community engagement
  • Accepting code contributions
  • Focus on documentation

Section 4: Goverment-Wide Code Reuse

1. Data rights to share code
2. Code inventory

Code.gov

Code.gov

Digital.gov

SHARE IT Act

congress.gov/bill/118th-congress/house-bill/9566

1. Data rights to share code
2. Goverment-wide code access and reuse
3. Code inventory

DHS Inventory: dhs.gov/code.json

{
  "agency": "DHS",
  "releases": [
    {
      "name": "trustymail",
      "contact": { ... },
      "description": "Scan domains and return data based on trustworthy email best practices",
      "homepageURL": "https://github.com/cisagov/trustymail",
      "repositoryURL": "https://github.com/cisagov/trustymail.git",
      "languages": [ "Python", "Shell", "Dockerfile" ],
      "organization": "Cybersecurity and Infrastructure Security Agency",
      "permissions": {
        "licenses": [{ "name": "CC0-1.0" }]
      },
      "status": "Development",
      "tags": [ ... ],
      ...
    },
    { ... }
  ]
}

EO 14144 (January 2025)

Strengthening and Promoting Innovation in the Nation's Cybersecurity

Section 2(e): CISA must create "recommendations to agencies on the use of security assessments and patching of open source software and best practices for contributing to open source software projects."

Agency Open Source Policies & Guidance

• Department of Homeland Security (DHS)
• Department of Defense (DoD)
• Center for Medicare & Medicaid Services (CMS)
• National Aeronautics & Space Administration (NASA)
• General Services Administration (GSA)
• Consumer Financial Protection Bureau (CFPB)
• Cybersecurity & Infrastructure Security Agency (CISA)

Unfortunately, most of these are focused only on publication and not consumtpion

Is anyone actually sharing code?

Some Examples

• SE Linux (NSA)
• U.S. Web Design System (GSA)
• Open MCT (NASA)
• IRS Direct File (IRS)

How much is open?

😭

What about upstream OSS?

Government is (arguably) the largest consumer of OSS ...

... and might be the worst consumer of open source.

1. Selection

1. Selection

2. Consumption

2. Consumption

3. Contribution

3. Contribution

Goal: Increase Open Source Publication

• Clear guidance on the process
• Build modular, reusable components
• Make it a contract requirement
• Enforce secure coding practices

Goal: Secure Government Systems

• Baseline OSS selection process
• Automate OSS scanning & approval
• Use mirrors
• Guidance on OSS updating

Goal: Support a Secure Ecosystem

• Contribute all security fixes upstream
• Cotnributions to OSS we rely on
• Grants for critical OSS infrastructure
• Be an active participant in the community

As a contractor...

As a federal employee...

As an indivudal...