How regulation could impact the open-source community

Cybersecurity has been in the spotlight ever since President Joe Biden issued an executive order in response to sophisticated cyberattacks earlier this year. The EO was followed up with a cybersecurity summit at the White House where programs focused on different aspects -- from implementing zero trust to addressing the skills shortage -- were announced. The steady flow of initiatives, culminating in the recent announcement by the Open Source Security Foundation of its $10 million commitment to supply-chain security highlights the urgency assigned by the administration to these cybersecurity measures.

These moves are especially crucial for one area that is being targeted by new initiatives: open-source security. Just as the issue of ransomware drew attention and calls for legislation, which is expected to rise to 30% by the end of 2025, similar calls for regulation may target open source.

The open-source community, which has created the free components that nearly all software and applications rely on today, can see changes on the horizon. After decades of freedom, security concerns drawing government attention and action might signal that the Wild West era of open source is nearing its end.

What’s at stake?

The open-source community has been a driving force behind software development, as a majority of all software and web applications utilize open-source components. From the early days of the Open Source Initiative and the free software movement, programmers have been collaborating on the creation of code.  The community has existed for decades without government regulation, relying on self-governance, while continuing to embody a spirit of open collaboration and cooperation.

Today, developers around the world share and contribute to projects by fixing bugs, updating code and modifying it for different uses. This work is often done in their free time with no expectations that they maintain the project, which means developers are free to experiment and test ideas. As an ecosystem that fosters creativity and collaboration, the open-source community has garnered support from major companies in the technology industry, and as new and mutually beneficial business models emerge, commercial support continues to grow.

Addressing the cybersecurity risks with regulation

Just like any piece of software, open-source components can be exploited, and this makes security crucial, given their widespread usage in software development. Unfortunately, the community’s decentralized approach to open-source projects can be a double-edged sword. For example, projects are particularly vulnerable when open-source developers lack support, resources and commitment. Some projects can be maintained by a group of developers, but some might just have one person working through bugs and updates. Having to balance a full-time job and other life priorities can lead to a project’s abandonment by the original creator. If the project is not picked up, forked by another developer or lacks proper documentation, then the component can become increasingly vulnerable or even unusable once abandoned. 

Regulating ownership and assigning liability to open-source developers might lessen the chances of this happening, but doing so could damage the main pillar of the open-source community’s ideals. Developers will no doubt balk at being liable for cyberattacks exploiting their projects, and such an initiative would backfire.

Some programs offer incentives to keep software secure, but a government-led program might not get as much traction as the officials might hope -- especially if it involves any liability agreements. Many open-source developers are willing to work on projects for free when their motivation is being recognized -- they take pride in creating a successful project. The fact is, any regulation attempts that infringe on the freedom of the open-source community will likely fail despite good intentions.

Finding a balance

Developers may be reluctant to trust the government and view it as slow to adapt to new technical concepts. And while there is an air of mistrust between government and cybersecurity researchers (ethical hackers), open-source cybersecurity issues cannot be left unaddressed if the U.S is serious about bolstering the nation’s security infrastructure. Luckily, a number of tech companies and organizations involved and respected within the open-source community are willing to collaborate and provide recommendations on government initiatives. Rather than widespread policy implementations, a collaborative approach with the community will have effective and more targeted results.

The new Secure Open Source Rewards program, which is run by the Linux Foundation with sponsorship from companies like IBM, Intel and Oracle is an example of a successful partnership. In this pilot program, developers enhancing the security of software considered critical -- according to the National Institute of Standards and Technology’s definition – are eligible for cash rewards. Security improvements would be made by having these projects measured against multiple frameworks and scorecards as well as by having their repositories checked by the OpenSSF Allstar Github app. Members of the open-source community can choose to participate and will be incentivized to make their projects more secure.

Setting out to tame the open-source community with regulation could hurt both developers and government. Regulation could lead to an exodus of developers, which would take away much-needed support for updating and securing open-source projects. Close collaboration between the U.S government and organizations in the community is necessary to create a mutually beneficial effect.

Securing open-source components is a challenging task -- instead of rushing headfirst with regulation, smaller steps that foster collaboration will lead to greater success.