CFPB's Source Code Policy

cfpb-source-code-policy.txt

1. USE OF EXTERNAL OPEN SOURCE SOFTWARE

        a) "Open Source Software" (OSS) is software that allows its recipients to modify and redistribute
           the source code; as such, "open source" is a copyright and distribution framework and makes no
           implications regarding technical support or indemnification. In almost all cases, OSS meets
           the definition of "commercial computer software" and shall be given appropriate statutory
           preference in accordance with 41 USC 264B (reference (b)) (see also FAR 2.101(b), 12_1.html
           12.000, 12.101 (reference (c))).

        b) Executive agencies, including CFPB, are required to conduct market research when preparing for
           the procurement of products or services by 41 USC Sec. 253a (reference (e)) (see also FAR
           10.001. Market research for software should include OSS.
                a. There are several positive aspects of OSS that should compel CFPB to seek out OSS when
                   conducting market research on software for Bureau-wide use:
                          i. Publicly available source code enables continuous and broad peer review that
                             ensures rigorous security and reliability. Specifically, this process
                             encourages the identification and elimination of defects that might
                             otherwise go unrecognized by a more limited core development team.
                         ii. The unrestricted ability to modify software source code enables CFPB to
                             respond more rapidly to constantly changing missions and markets, and is
                             critical to CFPB's ability to create new tools and keep pace with industry.
                        iii. Using OSS instead of proprietary software may reduce reliance on a
                             particular software developer or vendor. OSS can be operated and maintained
                             by multiple vendors, thus reducing barriers to entry and exit.
                         iv. Open source licenses do not restrict who can use the software or the
                             endeavors in which the software can be used. This allows CFPB to endlessly
                             reuse existing OSS-based products to satisfy new needs quickly and secure
                             substantial cost savings for the Bureau.
                          v. Since the monetary cost of OSS typically lies in support and maintenance as
                             opposed to licensing, OSS can provide a cost advantage in situations where
                             many copies of the software may be required, and can mitigate risk of cost
                             growth due to licensing in situations where the total number of users may
                             not be known in advance.
                         vi. By sharing the responsibility for maintenance of OSS with other users, CFPB
                             can benefit by reducing the total cost of ownership for software,
                             particularly compared with software for which CFPB has sole responsibility
                             for maintenance (e.g., GOTS).
                        vii. OSS is particularly suitable for rapid prototyping and experimentation,
                             where the ability to "test drive" the software with minimal costs and
                             administrative delays can be important.

                b. While these considerations may be relevant, they may not be the overriding drivers to
                   any decision about software. Ultimately, the software that best meets the needs and
                   mission of CFPB should be used, regardless of whether the software is open source.

        c) The use of any software without appropriate maintenance and support presents an information
           assurance risk. Before approving the use of software (including OSS), system/program managers,
           and ultimately Designated Approving Authorities (DAAs), must ensure that the plan for software
           support (e.g., commercial or Government program office support) is adequate for mission need.

        d) It is important to understand both the specifics of the open source license in question and
           how CFPB intends to use and redistribute any Bureau-modified OSS. There is a misconception
           that the Government is always obligated to distribute the source code of any modified OSS to
           the public, and therefore that OSS should not be integrated or modified for use in sensitive
           CFPB systems. In contrast, many open source licenses permit the user to modify OSS for
           internal use without being obligated to distribute source code to the public. However, if the
           user chooses to distribute the modified OSS outside the user's organization (e.g., a
           Government user distributes the code outside the Government), then some OSS licenses (such as
           the GNU General Public License) do require distribution of the corresponding source code to
           the recipient of the software.

        e) When contracting developer services, CFPB will encourage vendors to use open source technology
           wherever possible, for the reasons cited in a)i-vii above.

        f) In order to facilitate the auditing of CFPB's software catalog, the Technology & Innovation
           office will use a source code analysis tool to index its open source assets and their
           respective licensing obligations.

2. REDISTRIBUTION OF CFPB CODE

        a) Software source code written entirely by CFPB staff, and by contractors who are developing
           software on behalf of CFPB, is by default a public domain work.

        b) Software source code previously released under an open source license and then modified by
           CFPB staff is considered a "joint work" (see 17 USC § 101); it is partially copyrighted,
           partially public domain, and as a whole is protected by the copyrights of the non-government
           authors and must be released according to the terms of the original open-source license.

        c) All source code as defined in 2)a and 2)b above must be catalogued and shared with the general
           public via a highly visible, easily accessible online source code community that facilitates
           the code’s reuse. Source code shall not be released if any of the following conditions are
           met:

                a. The author of the code in question determines that the code is too crude to merit
                   distribution or provide value to the broader community.
                b. The Government does not have the rights to reproduce and release the item. The
                   Government has public release rights when the software is developed by Government
                   personnel, when the Government receives "unlimited rights" in software developed by a
                   contractor at Government expense, or when pre-existing OSS is modified by or for the
                   Government.
                c. The public release of the item is restricted by other law or regulation, such as the
                   Export Administration Regulations or the International Traffic in Arms Regulation.
                d. CFPB cybersecurity staff determine that the public release of such code would pose an
                   unacceptable risk to CFPB's operational security.