Open source and the public sector

The U.S. government continues to devote resources to advancing the country’s technology by utilizing a mixture of “proprietary, open source, and mixed source code” when building out federal solutions, according to the Federal Source Code Policy.

In 2016, the government launched code.gov and with it, a pilot program that required agencies to release at least 20 percent of new custom-developed code as open-source software. The code.gov website is a platform built to “support reuse and public access to custom-developed Federal source code” and houses code from 25 separate agencies. 

This strategic move originally began in 2014, when the White House launched the U.S. Digital Service as part of its mission to improve public sector technology. The group's Digital Services Playbook outlined how to manage and improve all publicly facing digital services and stressed the importance of adhering to these guidelines if contributing to the public sector.

The details of each section in the playbook illustrate separate data-driven objectives that, if followed, will enhance the American citizens’ digital experience and “help build the people’s trust in government,” according to the U.S. Digital Service Report to Congress, 2017. Each “play” contains an outline of a job to be done, a checklist of tasks that for completing that job and key questions that public-sector services developers must answer while making their way through the playbook.

“Default to open” is the 13th play in the handbook and explains the importance of openness when operating in the public sector. The play maintains that if the government follows the checklist, along with the other guidelines, effective digital services will be created.

With open-source a significant part of the nation’s digital infrastructure, the risks associated with this type of software are enough to pique the interest of department officials who must, according to the Playbook, “publish source code of projects or components online [and] share [their] development process and progress publicly.” While the importance of security is stressed throughout the "Manage security and privacy through reusable processes" play, the checklist does not define how often a scan for vulnerabilities should occur, leaving public-sector developers to judge for themselves.

Former Department of Homeland Security Secretary John Kelly testified in May 2017 that the department itself needed to “up [its] game” in terms of cybersecurity. Becoming aware of the open-source components within any software application that directly influences, or provides a service, to the public is an essential first step to maintaining a secure digital infrastructure. 

Public-sector employees should be adhering to the guidelines set forth by the Digital Services Playbook and staying compliant with the policies on code.gov. Yet by following both guides, the risk of utilizing a vulnerable component is considerably heightened because of code reuse. If a vulnerability is uncovered in one agency's code and not remediated in the other agencies who share that code, a hacker can exploit all other points of vulnerability. 

The policy itself tackles this possibility by requiring agencies to perform two tasks to stay compliant and mitigate the cybersecurity risk associated with open source code:

1. Update their policies to be consistent with the Source Code Policy.
2. Publish an inventory of their source code in the prescribed format on their website.

However, fewer than half of the government agencies are fully compliant, putting the other agencies' code at exploitative risk. 

Because the government is mandating that a percentage of the code it creates must be released as open source components, any vulnerabilities discovered in that code will also be publicly available. By using and reusing open-source code, the government saves resources. However, proactive maintenance is essential when working with open-source software. The only way this can be accomplished is if public-sector contributors and developers have a complete bill of materials for all code they are utilizing and apply patches as they become available. 

This “open” approach to advancing public-sector applications has both positive and negative repercussions. As vulnerabilities continue to be uncovered, they can be swiftly patched. However, if a black hat hacker finds and exploits a vulnerability before it is disclosed and a patch can be applied, these publicly accessed portals are susceptible to a potential threat. This cyber race has no finish line -- new technology emerges daily and vulnerabilities continue to be uncovered in components developed decades ago.

Keeping our nation secure, both digitally and physically, is of the utmost importance. With agencies such as the Social Security Administration, Nuclear Regulatory Commission, Treasury Department and the National Security Agency abiding by the guidelines set forth in the Digital Services Playbook and the Federal Source Code Policy, it's essential that the information they hold remains secure.