AI
Why Open Source Matters for Government
Kasper gave four reasons for open source in government: reusability, security, transparency, and cost. Reusability underpins collaboration and contribution. Open source is more secure because bugs are visible, unlike closed source where bugs exist unfound. Transparency covers code, development velocity, and pipeline practices like CI and security scans. Cost has an asterisk — total cost of ownership is not zero. A Harvard Business School study (Frank Nagel, now Linux Foundation chief economist) pegged the cost to rewrite all global open source at $8.8 trillion, excluding Linux.
Misconceptions and Stagnation
Kasper listed quotes from government officials: “Open source software is insecure,” “It’s illegal,” and “We paid for it. It’s ours.” He refuted each. Insecurity arguments ignore that closed source still has bugs. The illegality claim misreads contractor copyright — all federal IT contracts for 15+ years grant full data rights to share publicly. “We paid for it” ignores that taxpayers paid, not the agency. A deeper challenge: brain drain since the 1970s left agencies without technical staff. Contractors handle 95%+ of software, often without updating open source dependencies. Kasper described one program that pulled a library and never updated it for six or seven years.
Policy Landscape: M-16-21, SHARE IT Act, and More
The 2016 federal source code policy (M-16-21) required a pilot to release 20% of custom software as open source. The 20% target was undefined — lines of code, projects, budget? Zero agencies met it. The pilot ended in 2019. M-16-21 also mandated governmentwide code reuse, data rights in all IT contracts, and a code inventory at each agency (e.g., dhs.gov/code.json). The supporting code.gov group fizzled out. The SHARE IT Act, passed in 2024, codified those requirements into law — it cannot be rescinded by the executive branch. Executive Order 14144 (January 2025) directs CISA to create best practices for contributing to open source. CISA is waiting on guidance Kasper wrote but which has not cleared public affairs.
Consumption Without Contribution
The US government is probably the largest consumer of open source software in the world, with hundreds of thousands of IT systems depending on it. It is also one of the worst consumers. Selection criteria are nonexistent — contractors pull in any library. Updates are manual. No automated dependency scanning, no version change license checks. Contributions upstream are rare. Kasper gave an example: a contractor found an XML parsing library slow for megabyte files. Rather than file an issue, they nearly abandoned the library. Kasper pushed them to file a GitHub issue; the maintainer added a flag in a month, making the library 10x faster. Security fixes found internally stay behind the agency wall because contractors are not paid to contribute back.
A Path Forward: Required Contributions and a Sovereign Tech Fund
Kasper proposed three goals. First, increase publication: require contractors to deliver software as a public GitHub URL with all infrastructure-as-code and build artifacts. Second, secure consumption: establish baseline selection criteria (release cadence, tests), automate scanning and approval, use mirrors instead of pulling directly from PyPI or npm. Third, support the ecosystem: make it a contractual requirement to contribute 100% of security fixes upstream — that would inject roughly 500,000 new developers into open source. He cited Germany’s Sovereign Tech Fund, which grants $1,000 to $1M to maintainers. The US should do the same. Finally, federal employees should push for these changes in contracts, and private individuals can contribute to government GitHub projects or join CISA’s bug bounty programs on Bugcrowd.
Notable Quotes
Open source software is insecure. Jordan Kasper · ▶ 08:04
We paid for it. It’s ours. Jordan Kasper · ▶ 10:21
If we create a security fix for an open source library, we must contribute that back upstream. Jordan Kasper · ▶ 32:07
Key Takeaways
- The US government has 164 agency GitHub orgs but contributes almost no fixes upstream.
- M-16-21’s 20% open source pilot failed because the denominator was never defined.
- Making security fix contribution a contractual requirement could add 500,000 developer contributors.
About the Speaker(s)
Jordan Kasper started programming in 1993 and has developed systems on platforms ranging from IBM mainframes to TI calculators. His government work spanned the Departments of Defense and Homeland Security, where he helped reform IT programs, advocate for modern technology, and advise on policies including open source software. He is an open source maintainer and community organizer.