Victor de Pous
Open source computing and public sector policy
1. Preface
Understanding the concept of open source software and its advantages and disadvantages is still not easy. First of all, because almost everything one can say may very well be true for some specific case, but is not generally valid by default. At the same time, the many misunderstandings about open source computing hinder developments.
Both circumstances create a serious problem for national governments, politicians and local public administrators who must develop and execute effective and well-founded IT policies. Moreover, open source software uses a deviant, divers and challenging licensing approach for the development and distribution of technology code, especially the source code of a computer program.
Neither the apparently unavoidable quotas of gurus nor evangelists in this market segment offer transparent insights because their opinions are often biased and emotions equally often predominate. The Court of Audit in the Netherlands, as a notable and authoritative outsider in the complex world of digital technology and its high-paced industries, however, found surprisingly clear outcomes in the area of open technology for governments.
This and other developments trigger me to re-focus on open source software within the framework of public policies and the law, to consolidate them, and to take stock seven years after my first international study in this domain.1
What should any public sector organization in the second decade of the 21st century – worldwide, including the 1,600 in Netherlands – at least understand about open source computing before making policy and procurement decisions?
2. A continuously blurring perspective
Current times are for more than one reason diffuse and create confusion. For years technological developments in all kinds of industries succeed each other in a fast pace. The electronic technology markets are heterogeneous and characterized by high dynamics. The playing field changes not just from the apparently inexhaustible series of technical inventions. We also see ongoing economic and commercial developments: the emergence of new business models, the creation of numerous start-ups and the large number of mergers & acquisitions in the IT industry. Never a boring day.
Software applications as a service, retrieved over broadband Internet, together with the availability of scalable processing power and storage – as standardized utilities – create a new delivery model for IT, named cloud computing, based on services.2 Virtualization technologies play an important role. Computer programs and data are cut lose from the physical computer facilities in data centers. This maximizes IT resources, makes data processing more dynamic, and often transnational.
Access anytime, anywhere
Our society where digital technology plays a premier role is changing forever. Looking at the way we work, we see that offices often no longer ‘have walls’ and that our working and private lives mingle intensively. Work for the so-called knowledge-workers becomes something where they are, no longer where they go to. In addition, as a citizen and as a consumer we also want anytime, anywhere access to software, information and electronic services. Digital technology has in many ways become crucially important meaning that, in the light of the resulting dependence, we should pay more attention to the quality, continuity and sustainability of information processing as such.
Generally praised for its innovative powers, digital technology also disrupts. The broad and approachable availability of the Internet turned entrepreneurship in many economic sectors – in and outside the IT industry – during the last 15 years upside down. This hybrid socio-economic process continues and occurs even in full swing. Organizational structures and business models are constantly changing while traditional roles and positions intertwine.
Complexity
IT user organizations in general find themselves in the unenviable position of being in the shadow of the social and technological complexity and the positioning of suppliers and service providers, who want to differentiate themselves, to determine their own digital route map. Quo vadis? They want to be rapidly agile to accommodate changes. Every public sector organization wonders how IT facilitates its business needs and which vendors – with which products and services and under which terms and conditions – are best equipped for supporting their strategic goals.
Open technology
Discussions on the subject matter of more open digital technology – as opposite to less open or closed technology – add even further to the complexity of defining public policy making and individual IT procurement decisions, due to the lack of understanding and the lack of unified terminology and broadly accepted definitions. Understanding starts with the fact that open standards (technical information; specs) and open source software (programmed code for computers) are two completely different domains.
Even more relevant are the circumstances that neither open standards nor open source software form a goal for an IT project, contrary to interoperability that facilitates strategic government goals. For that very reason, the European Commission drafted in 2004 a European Interoperability Framework.3 The recent published updated version of December 16, 2010, together with the European Interoperability Strategy, is a key document for promoting interoperability among public sector organizations, within the Digital Agenda for Europe.4
3. Back to basics
Understanding the business models and legal aspects of open source computing is a conditio sine qua non for every public policy maker and public procurement manager. The concepts of free software5 and open source software6 originated in the United States and refer to software code which meets specific criteria in terms of the legal constructions which govern the free and public availability of software technology, in particular with regard to the source code of a full computer program or a software component.7
The free availability is regulated by default through a special category of licenses and is expressed in the form of three basic rights: the right to copy, modify and distribute the program. In addition, the licensee is entitled to run the software without restriction, even without being required to pay a license fee. In more detail, the concept of free software is captured in four freedoms; open source software is based on ten criteria.
The core distinction between free software and open source software may be stated concisely as follows. Whereas free and open source software has a common underlying principle in that the original software technology is freely available, must constantly remain freely available at all times, and the licensee does not have the obligation to make the software he modifies freely available to the public, by contrast an open source license may allow that the modified software code is legally transformed into a non-open source product, using a non-open source license. According to the Open Source Definition of the Open Source Initiative,8 open source software includes free software. The reverse certainly does not apply.
Open source software is a generic term for software which meets specific criteria in terms of the legal constructions which govern the free publicly availability of software technology involved, in particular with regard to the program’s source code.
While it is true that any open source software license offers extensive rights of use, this is offset by the fact that no warranties are provided in general. For instance, the license does not contain a statement made by the relevant software copyright holder to the effect that he is actually the owner and is entitled to grant the license. In addition, no indemnification is granted to a licensee against a claim made by a third party who is of the opinion that the relevant open source software infringes on his copyright.
Furthermore, an open source software license does not guarantee that the software will continue to operate in accordance with the relevant specifications (functional, technical and operational) for a certain period of time, and any liability on the part of the developers of the software code is fully excluded. More to the point, an open source software license does not address the program itself as such.
Regarding open standards for digital technology, much can be said as well. Many discussions, descriptions and criteria come along, because consensus in this domain is not easy to find.9 Within the perspective of this chapter, we restrict ourselves to some brief remarks. Important for public sector organizations are the views of the European Commission as defined in the version 2.0 of the Interoperability Framework for European Public Services. The EC accepts the FRAND standards – that are available on Fair, Reasonable, and Non-Discriminatory terms – and royalty-free standards as well.
An open standard for digital technology is a generic term for technical specifications which meets specific criteria in terms of the legal constructions which govern either (i) the reasonable accessible publicly availability or (ii) the free publicly availability of the specifications involved.
Briefly put, the new EU interoperability policy does not discriminate between open source software and non-open source software and allows both for implementation in public sector organizations.
4. Captive misunderstandings
On the one side, open source software, free software included, has been from day one a technology segment based on criteria and freedoms. On the other side, open source software has always been a domain were misunderstandings amount and fiercely rhetorical discussions do not bring divided parties together, also because we have to deal with specialized and non-standardized terminology and alleged contradictions creating confusion. Moreover, almost everything one can say in a specific case may very well be true, but normally does not have a general validation.
Open source software vs. closed source
The use of this contradiction assumes that there are only two delivery models for computer programs. In practice we analyzed at least seven models, including, freeware, escrowed software, shared-source software, runtime-software with source code rights but without an open source license.10
Proprietary software vs. open source software
Although proprietary software is often placed opposite open source, all software code11 is in principle protected by intellectual property rights, like copyrights and often patents and trademarks, and therefore is without exception proprietary too. IP laws do not distinguish between open and not open source software. The applicable intellectual property rights may be holding at one organization (company, non-profit, public sector), individual developers at any mix of those.
No license?
“We are license free”12 or “license free software”13 concerns incorrect statements that suggest that open source software is not governed by a license. Open source products, however, are never license free, for the very reason that solely an open source license classifies a computer program as open source. In other words, every piece of open source code comes with a special category license. Therefore, open source software always creates mutual legal rights and obligations between parties. Nevertheless, there is discussion about the overall status of the licenses: are they copyright licenses, patent licenses, or both?
Not an agreement?
Probably a majority of the legal community holds the opinion that under the common law system of the United States a license for open source code is not an agreement, but merely a license. Under the laws of continental Europe, however, an open source license in principle does constitute an agreement within the meaning of the Civil Code. Therefore, all the general rules of the law of contract – e.g. governing the entering of the agreement, breach of contract, liability and damage compensation – apply to open source software.14
Free and Open Source Software (FOSS)
The acronym FOSS blends two different categories of special category computer programs. Ignoring the distinction may have far-reaching legal consequences for both vendors and user organizations. This relates for instance to the restrictive and copyleft15 character of the free software licenses such as the GPL16, opposite some of the more liberal open source licenses that allows for instance a licensee to commercialize modified open source software under a non-open source license, like the BSD license.
Certified licenses?
In total, the Open Source Initiative certified 69 licenses against ten criteria of the Open Source Definition.17 Moreover, there are more than 150 open source software licenses identified by a leading German research institute.18 Most of these licenses are probably developed from the Anglo-American (common) Law perspective. A ‘certified’ license, however, says nothing about (i) its legal validity under a certain legal system (e.g. US, Dutch or German law), (ii) the quality of the nonnegotiable license terms and conditions (are they fair, in balance?), and (iii) the quality and other technical aspects of code itself.19
License complexity
Without doubt, open source licenses are complex. They are also divers20 and may even be categorized.21 Intense discussions, for example, take place on the subject matter of code distribution. What is distribution legally speaking? Many, or most likely, all national legal systems of continental Europe do not know the concept of derivative works, although this plays a major role in a widely used version of the GPL license. Other license interpretation discussions include the way of linking and the viral effect of free software licenses, so that non-GPL code becomes also software code governed by the GPL license. In addition, license incompatibilities must be taken into account.
Multiple and open core licensing
Open source software code is always offered for free (no license fee), and always legally framed through a license (agreement). However, more vendors today chose on commercial grounds to offer multiple licensing.22 This means for dual licensing, generally speaking, that the same computer program is available under both an open source license and a non-open source license simultaneously. A new trend may by found in open core licensing, that offers only the central part of the computer program as open source and give vendors full market freedom to commercialize additional functionalities.23
Commercial software vs. open source software
The contradiction implies that all open source software code is a priori not commercially developed and/or commercially provisioned to the market place. In daily practice, however, we see that open source software increasingly concerns commercial trade and services.24 To make things even more complicated, vendors talk about commercial open source versus non-commercial open source. What the right wording may be, one thing is without doubt very clear. Also open source software relates in probably most instances to pure commercial activities.
Secure by default?
Other ongoing discussions include the vulnerability of the software through the public availability of the source code of computer programs. Very often we hear from open source communities that their software reduces vulnerability risks, because many developers’ eyes look at the code. Others hold the contrary opinion that general availability of the source code offers malware writers and other criminals a better opportunity. “My theoretical development and empirical results indicate that, compared with closed source software, vulnerabilities in open source software: (a) have increased risk of exploitation, (b) diffuse sooner and with higher total penetration, and (c) increase the volume of exploitation attempts,” Sam Ransbotham, assistant professor at Boston College’s Carroll School of Management, concluded in 2010.25
5. The Dutch approach, some comments
In the first decade of the twenty-first century the Second House of Parliament has frequently discussed open standards and open source software and called for “an increased” use in both domains. Consequently, this led to various policies and implementation programs as well. Probably the most comprehensive activity was the 2007 so-called action plan The Netherlands in Open Connection aimed at accelerating the use of open standards an open source software in the (semi) public sector.26 The plan constituted an important part of the wide cluster of policies, programs and legal obligations for doing IT business with public sector organizations.
According to the government, interoperability within the public sector must be increased by using open standards, arguing that the use of open source software should decrease public sector IT dependency on IT vendors. Moreover, the government wishes to advance a level playing field in the software market, just like the advancement of innovation and the economy through the powerful advancement of open source software, and will give preference to open source software when equally suitable (with non-open source software).
For various reasons we called these choices rather notable.27 First of all, the action plan applies a specific industrial policy (and rather generic public goals) to public IT procurement instructions. The important goal of a sound information management process, including e-Government, and the economic and strategic importance of an innovative IT industry in the Netherlands, indeed may both require policies. But a one-size-fits-all policy is fundamentally the wrong approach to effectively reach these quite different goals.
An even more serious comment is that the direction taken lacks foundation. Standards may indeed be beneficial, and open standards even more so, but why did the government choose a strict definition of an open standard,28 thereby rejecting other routes of achieving interoperability? We also noticed that the government marked one particular software development/delivery model as the core of this advancement policy, without addressing the additional legal risks that occur when deploying open source products.
Interoperability
From the perspective of digital technology, interoperability relates to the circumstances that hardware, software and infrastructure of various manufacturers – due to the availability of technical information of interfaces – connect and cooperate seamlessly. Interoperability, however, is not exclusively achieved by open standards – whether or nor not in compliance with a strict definition as formulated by the Dutch government – but through various ways. More than one road leads to Rome: the availability of technical information by a specific vendor, licensing intellectual property rights, small and large-scale cooperation within the industry, and, of course, technical standards in general.
When we close ranks that interoperability is of great importance to us all (users, vendors, society as a whole), it is certainly not obvious to support some and exclude other ways of achieving interoperability. Thus, does the action plan truly promote innovation, and to its maximum? Also relevant is the fact that under European Union Law29 every licensee has a codified right to software interoperability in case the vendor does not offer the necessary information to achieve interoperability of an independently created program with other programs.30 In other words: software interoperability can always be legally enforced.
In the recently published new version of its interoperability framework for public sector services, the European Commission prefers “open specifications” instead of “open standards” and accepts FRAND, that is, royalty-free basis licensing of those specifications for achieving interoperability. In addition, “public administrations may decide to use less open specifications, if open specifications do not exist or do not meet functional interoperability needs.”
Dependency towards vendors
Let us start with the observation that public sector dependence on information technology – and for that matter any modern organization – shall only increase even further. The dependency of a public sector organization on suppliers will probably only reduce when the government takes IT in its own hands. This means more IT personal, more internal software development projects, more government-owned data centers. Is this an attractive roadmap for governments who today have to do more with less?
Dependency on specific vendors occurs also when using open source software and we need to bear in mind that migration from one open source software package to another program (open source or not) will not be easier, more simple than a software migrating process in general. They answer to less product and vendor lock-in lies primarily in open data formats, like XML for data processing in general or SBR for financial data processing.31
Furthermore, the question arises what impact open source has on large, complex and tailor-made IT government projects? Will they become more successful by default, because a special category license governs the business application?32 The rule of thumb says that a higher level of customization relates to an equally higher level of dependency on the individual software vendor who programmed the code. Consolidation (less different software) and standardization (if possible, more standard applications) are now the name of the game for any user organization, the public sector of course included.
Level playing field
The software market at large is heterogeneous and sparkles through diversity. The market consists of a multitude of segments that are horizontal, vertical, diagonal and beyond, and in many ways placed in order, for example, by engineering technique, applications, ecosystem, market share, business models and many categories more. In addition, almost every playing field changes continuously, both by the rapid technological (innovations) and business developments (business models), and by the arrival of many start-ups and the large number of merger & acquisitions in the industry.
Vendors choose open source software consciously on clear commercial grounds, because the model creates economic value for them. In this way, they do not distinguish themselves from other market players. Interesting in this context is the emergence of new IT delivery models like software as a service (SaaS) – the premier deployment model of cloud computing – that makes the underlying business model of an individual software vendor subordinate to the model of the cloud service provider.
Advancement of innovation and economy
Almost any individual software vendor today uses open source software but the art of deployment and its consequences differ strongly. Only on rare occasions we see a supplier who has completely based its business on an open source model, excluding other business models. But almost all software companies reuse existing open source components in the development process of primarily non-open source software, as a research company analyzed during an investigation commissioned by the of Dutch trade organization ICT-Office.33
History is too short to assess if the provision of software code as a free product bundled with a paid maintenance subscription or offered with individually paid adaptive software services (developing new functionalities) shall evolve in a versatile, sustainable independent economic business model at large. What we know, is that an ecosystem of developers and business partners around one ‘traditional’ software company34, leads to innovations and an attractive economic value for the partners.
Opinions on the innovative character of open source code are divided. Some argue that open source products typically clone existing programs. Even Linux key developer Linus Torvalds classifies his operating system as a Unix clone.35 Others just praise the innovation that open source software creates, because anyone can add to programming and use the work of third parties. Red Hat CEO Jim Whitehurst holds a very decisive opinion. Giving away the source code of a computer program has little value. Open source software is all about an ecosystem or community where multiple suppliers and multiple users take part. Only in this way does open source creates value, starting at the user organization.36
6. A new dawn for public sector IT policies
It is always interesting when a notable and authoritative outsider reflects on views often taken for granted by politicians, public administrators and for example industry stakeholders. This is exactly what occurred with the study Open Standards and Open Source Software in Central Government by the Court of Audit in the Netherlands37 that addressed, at the request of the Second Chamber of the Parliament38, open technology and audited the potential savings achieved through the wider application of open standards and open source software in the central government area.39
The national auditor concentrated on the ministries (and associated agencies) and on existing software for which realistic open alternatives are available in theory. Two main conclusions are:
The potential savings the government could obtain by making more use of open source software are limited for a number of reasons. (Therefore, expectations regarding the potential savings to be achieved from open technology should be tempered.) Not only do migration and deployment of an open source product cost money, but also merely 4% of the IT budget of the Dutch central government is spent on software license fees.40
An approach to IT based solely on the wish to cut costs is too restrictive. Strategic organizational government goals should drive procurement policies and individual procurement.
Another recommendation even stands out:
“We recommend that a clear distinction be made between the policy goals to improve operational management at the ministries (a responsibility of the Minister of the Interior and Kingdom Relations) and the policy goals to organize the software market (a responsibility of the Minister of Economic Affairs, Agriculture and Innovation). Only when these distinct goals are defined clearly and unambiguously can the ministers agree on the policy and account for it.”
Open standards
The Court of Audit’s findings should serve as a wake-up call for public sector organizations. Concisely stated, please act professionally and approach decision-making in any individual procurement case deliberately, always within the goals of the strategic government framework. Conclusions and values and especially the potential benefits of both open standards and open source software – often taken for granted by many of us – lack general validity. “Generally speaking, open standards cannot be considered better than closed standards or vice versa,” reports the Court of Audit, adding that there is no evidence for the general validity of the frequently quoted advantages on quality, cost saving, vendor independency, and sustainability of the processed data. A very down-to-earth conclusion.
Open source software
With regards to open source software, the Court of Audit remarks that in de selection process of computer programs, other aspects besides merely the costs deserve proper weight. “The software also needs to be compatible with the information and IT architecture of the Dutch Government, and the consequences it will have for the various components of that government also need to be considered.” As with open standards, the Court of Audit finds no evidence for the general validity of the frequently quoted open source characteristics, that is on the availability of community-answered queries, sustainability of the code (and more vendors), and technical reliability. “The main difference between open source software and closed source software lies in the license.”
Conclusions
Regarding the migrating opportunities to open alternatives, the Court of Audit concludes that they depend on the organizational goals. Only when the goals are translated into an information strategy and an IT strategy, can decisions be made on the use of open or closed standards and software.
Regarding the replacement potential, the Court of Audit concludes that it is a mission impossible to say in advance what part of a software portfolio of a ministry could be made open. The software landscape involved is a complex system with a large number of components that exchange information both with each other and with the outside world using many different standards. Furthermore, the software industry is subject to rapid change. Software releasing is a continuous stream of new versions and applications, open, closed and everything in between. The transition from closed to open is an ongoing process.41
Regarding the advantages and disadvantages, opportunities and risks of introducing open technology, the Court of Audit concludes that there are many but they are not universally applicable. Whether or not they apply in a specific situation can only be determined by studying the conditions in that situation and through specific market research of the available software products and services.
7. Legal developments
Over the last few years, we observed a wide area of developments, which relate more than once to the legal aspects; not surprisingly, because open source software at large finds its existence in a challenging special category of licenses. Recent developments put the open software technology either itself or its formal criteria sometimes under a certain strain. Some of them are explained below.
The continuity of open source projects
In his doctoral thesis, Ruben van Wendel de Joode concluded in 2005 that open source communities are self-organizing and that circumstance set limits to the malleability of open source communities.42 Individual software developers determine mainly by themselves what to do next. Mergers & acquisitions constitute another obstacle for continuity of a community and road mapping for the open product.
Follow, for example, the tracks of OpenSolaris, MySQL, and OpenOffice, especially after the Sun Microsystems takeover by Oracle in 2010.43 Also, the so-called forking of open source projects – developers take a legal copy of source code from one software package and start independent development on it, creating a distinct piece of software44 – leads to additional uncertainty.
Unique risks and risk management
“The use of FOSS by financial institutions does not pose risks that are fundamentally different from those presented by the use of proprietary or self-developed software. However, FOSS adoption and usage necessitates some distinctive risk management practices with which institutions must be familiar. This guidance describes those unique risk management practices and should be used in conjunction with other published guidance, such as the FFIEC IT Examination Handbook, Development and Acquisition Booklet.”45 At that time – 2004 – this public sector organization recognized that open source software does indeed require unique risk management. Today we observe broader recognition of the significant and unique risks linked to open source adoption in the US, by both legal counsels and source code scanning service providers.46
Open source in court
Although open source licenses have not been broadly tested in legal systems at large, there have been court cases in Germany47 and the United States and the trend is increasing. At this time, various cases involve the Google’s open source operation system for mobile devices Android, like smart phones and tablets.48 More and more vigorous patent claims constitute the basis for legal action in the open source domain.
Third-party license enforcement
Perhaps unique in the world: private organizations that are not a contractual party at an agreement between a software licensor and the licensee (and not the developer or owner of the software code) enforce licenses if either of the parties breach the terms and conditions. The Free Software Law Center49 and Gpl-violations.org50 watch over the correct use of the free software licenses, like the popular GPL license (e.g. applicable for all versions of the Linux operating systems).
Public sector as vendor
A recent issue taken from an international discussion list on open source licenses shows the importance of understanding the main criteria and relevant principles for public sector organizations.51 A UK police force member wanted to ‘open source’ an application that was apparently in-house developed by his department, and distribute the program exclusively to other police forces in the country. He asked the experts’ community what open source license would fit this goal best. The answer was simple and unequivocal: none! Open source license may not discriminate and therefore an open source application may not be distributed only, for instance, to or within the public sector.52
Free distribution
Since 2010, distribution from the United States to certain countries is forbidden and the distribution website sourgeforce.net blocks downloading to US black-listed nations, such as Cuba, Iran and North-Korea. This government rule violates, however, the strong anti-discrimination principle of the Open Source Definition (5#). US Export control legislation requires often an export license in advance of the international distribution, technology like (open source) software included.53 This means also that for every new release of the product a new license is required.
8. Trends and analysis
(1) Open source is a complex and challenging development and distribution model for software that will not go away. Every modern IT environment consists of an extensive mix (stack) of computer programs, which requires among others (i) interoperability of the independently created programs for connection and cooperation with other programs, and (ii) knowledge of the legal framework of computing today. Furthermore, current coding practices show that components – open source or not – are reused and linked into new software (component-based programming).
(2) Open source software still holds many ambiguities and misunderstandings due to the probably structural lack of interest in the business and legal aspects, outside the specialized legal community. The ‘free’ nature of open source computing clearly dominates in a way that the small print – the license terms (rights and obligations) – and other legal aspects do not fit. Nevertheless, in principle open source software involve software code protected at least by copyright (and often protected by patent law as well), which is always governed by a special category license.
(3) In principle, the many licenses for open source software provide the licensee with broad use rights, but no legal warranties.
(4) Reducing software costs appears often as the prime driver for the deployment of open source software, because no license fee is applicable. Recently the Court of Audit found that the potential savings the government could make by deploying open source software products are limited. There is indeed no license fee involved, but the implementation, operation and maintenance of open technology also involve costs. Also relevant is the estimate that the software licensing costs for a Dutch ministry amounts only to 4% of the total spending on IT.
(5) Although cost saving for public sector organizations is important, an approach to IT solely on the wish to cut costs is too restrictive. Strategic government goals should determine the use of IT.
(6) Based on the findings of the Court of Audit report we draw an interesting parallel between the frequently quoted benefits of the deployment of open source software and open standards. Both do not inherently hold those advantages. In other words, the positive claims of open source software and open standards are, generally speaking, unproven.
(7) The new EU interoperability policy accepts (i) FRAND and (ii) royalty-free basis licensing of the intellectual property rights of open specifications for achieving interoperability. This policy does not discriminate between open source software and non-open source software and therefore allows both for implementation by public sector organizations.
(8) In addition, any public sector organization within the European Union member states has the right to decide “to use less open specifications, if open specifications do not exist or do not meet functional interoperability needs,” which opens the door for a comply or explain policy.
(9) Open data formats (and not open standards/specifications in general) are in principle more important than open source software at large, because they (i) enable collaboration between end-users in different organizations,54 (ii) enable portability for – more easily – migrating to another application on premises or to a cloud computing service, and (iii) enable change from one vendor or service provider to another. Furthermore, open data formats benefit (iv) digital sustainability, thereby respecting public archiving obligations mandated by statute law.
(10) Every public sector organization must act professionally with respect to both efficiency and legality. These administrative law principles translate in light of open source software into two requirements. (i) Looking at the financial side of open source adoption, a full comparison should be made between the various suitable software options, e.g. including costs for migrating, maintenance, staffing and more. (ii) The use of open source software can only be sustainable after the implementation of a comprehensive Open Source Software Management program – including a taxonomy of licenses that addresses legal compliance and manages the special, unique legal risks.
9. Final remarks
Public procurement policies, whether for information technology, police patrol cars or office furnishing, differ completely from public policies that focus on economic development or organizing specific markets or industries. Those sharply divided responsibilities lie with two different ministries: internal affairs and economic affairs. A Chinese wall should prevent any dilution.
Common sense, a pragmatic attitude and especially strategic government goals should determine – policies for – the public procurement of IT resources in general and computer programs more in particular. Deciding which application to deploy solely based on cost savings or solely based on one preferred business model, is a too restrictive approach and will lead most likely to ineffective decisions with wide and long-time consequences.
Strategically viewing and leveraging open source software to the benefit of any public sector organization is not easy and – after qualifying the technology itself, its roadmap and the scale and maturity of its ecosystem – should be done on a case-by-case basis and include all financial and legal aspects in regard with the life-cycle of that computer program.
Proactive attention to the legal framework of public sector information systems and digital infrastructures creates economic value, optimizes assets and manages risks.
Victor de Pous studied law at the Vrije Universiteit in Amsterdam. He has been working as a corporate lawyer and industry analyst in the domain of legal aspects of digital technology and the information society since 1983.
1 Victor A. de Pous, Open source software en politiek, white paper, Amsterdam, 2004. Translated into the English (Open Source Software and Politics), Japanese (オープンソースソフトウエアと政策), and Chinese (Mandarin: 开源软件及政策) languages. Since 2005, the author publishes and makes available a yearly trend analysis (in the Dutch language) on the state of open source software, relating to the business and legal aspects.
2 http://csrc.nist.gov/publications/drafts/800-145/Draft-SP-800-145_cloud-definition.pdf
3 http://ec.europa.eu/idabc/en/document/3473.html
4 http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1734&format=HTML&aged=0&language=en&guiLanguage=en
5 http://www.gnu.org/philosophy/free-sw.html.
6 http://www.opensource.org/docs/osd
7 This does not cover a computer program in the public domain, whose creator has waived his intellectual property rights to them. Open source code, including free software code, is always copyright protected and to which patents may have been granted in addition.
8 http://www.opensource.org/
9 Wikipedia’s lemma on open standard (http://en.wikipedia.org/wiki/Open_standard): “An open standard is a standard that is publicly available and has various rights to use associated with it, and may have various properties of how it was designed (e.g. open process). There is no single definition and interpretations vary with usage.”
10 Victor de Pous, Open technologie 1.0, White Paper, Amsterdam, 2006.
11 Excluding – small – software code like for example interfaces where the coding is predominated by technical conditions and the developer has no choice and can not leave his personal mark on the code.
12 See e.g. http://www.zorgopen.org/2010/07/ruwaard-van-putten-neemt-open-source-pacs-en-licentievrij-san-in-gebruik/
13 http://www.telegraaf.nl/digitaal/9273219/___Licentievrije_software_bespaart_niet_veel___.html
14 Because open source licenses are nonnegotiable and not signed, they are legally considered general terms and conditions as governed by the Dutch Civil Code. In addition, one of the most crucial principles of Dutch civil law – the bona fides principle (reasonableness and fairness) – applies to open source licenses.
15 “Copyleft is a general method for making a program (or other work) free, and requiring all modified and extended versions of the program to be free as well.” The method is based on copyright. See http://www.gnu.org/copyleft/
16 See the criticism on the free software licenses of the Free Software Foundation by a founder of the Open Source Initiative (http://dotcommie.net:80/feed/index.php?id=160).
17 http://www.opensource.org/licenses/index.html
18 Institut für Rechtsfragen der Freien und Open Source Software (www.ifross.de).
19 Another uncertainty/complexity concerns the application of an open source license by online and offline distribution of the product. What makes that a user is legally bound to an open source license under a specific legal system?
20 “It seems that choosing an open source license is more difficult then developing the software,” a developer recently remarked on license-discuss@opensource.org
21 http://www.opensource.org/licenses/category, and http://ifross.org/lizenz-center
22 http://en.wikipedia.org/wiki/Multi-licensing
23 http://blogs.gartner.com/brian_prentice/2010/03/23/open-sources-reality-distortion-field/
24 For example, commercial software vendor Red Hat is on its way to a billion dollar company, achieved not by the sales of licenses but the sales of subscriptions for open source software, like Red Hat Linux (http://www.redhat.com/).
25 http://weis2010.econinfosec.org/papers/session6/weis2010_ransbotham.pdf
26 http://www.rijksoverheid.nl/documenten-en-publicaties/brochures/2007/12/20/the-netherlands-in-open-connection.html
27 V.A. de Pous, Zakendoen met de overheid, Public procurement voor ICT-leveranciers, Executive Analysis, Amsterdam, 2010.
28 The Netherlands opted for a strict definition and considers that an open standard must meet five criteria: (i) an open decision process, (ii) freedom of access to the management organization, (iii) publication of the standard, (iv) low cost of ownership (royalty free), and (v) no restrictions on reuse.
29 Directive 2009/24/EC of the European Parliament and the Counsel of 23 April 2009 on the Legal protection of computer programs (Software Directive).
30 See Article 6 of the Software Directive (on decompilation).
31 http://www.sbr-nl.nl/fileadmin/SBR/documenten/presentatie_XBRL_Conference_2011.pdf
32 Accessing and modifying the source code in this case is not a discussion, because the Dutch government – trough its general procurement terms and conditions for the central public sector – requires the transfer of intellectual property rights when using bespoke third-party software development. See Article 8 ARBIT.
33 Robbin te Velde, Jaap Veldkamp en Marijn Plomp, De softwaresector in Nederland, Survey 2010, 13 augustus 2010.
34 CA Technologies, Microsoft, IBM, Oracle, SAP, and many more.
35 Linus Torvalds and David Daimond, Just for Fun, 2001.
36 Key note at the (7th) Open Source Business Conference (OSBC), May 16, 2011, San Francisco.
37 http://www.courtofaudit.com/english.
38 De Tweede Kamer der Staten-Generaal is the ‘House of Representatives’ in the Netherlands.
39 http://www.courtofaudit.com/english/News/Audits/Introductions/2011/03/Open_standards_and_open_source_software_in_central_government. An English translation of the report of March 17, 2011, is available. Please feel free to ask for a copy at depous@planet.nl. The original Dutch-language version prevails.
40 Software costs cannot be calculated directly from a ministry’s accounts. We formed an indicative picture of the costs in 2009 from statements provided by the ministries, based in part on estimates. The ministries’ total ICT costs (all hardware costs and all software costs) amounted to approximately EURO 2.1 billion. Of this amount, approximately EURO 88 million (about 4%) consisted of license fees and approximately EURO 170 million (about 8%) of maintenance costs for software for which there are open alternatives. The savings on a ministry’s software costs can be calculated only by making cost/benefit analyses on a case-by-case basis. Such cost/benefit analyses would have to take account of implementation, operation (including management) and maintenance costs as well as procurement costs (including licence fees).
41 The Court of Audit also found that ministries currently already use “a lot” of open source software.
42 Ruben van Wendel de Joode, Understanding open source communities, An organizational perspective, Enschede, 2005 (doctoral thesis, Technical University of Delft).
43 OpenSolaris axed by Ellison (http://www.theregister.co.uk/2010/08/13/opensolaris_is_dead/). See also http://en.wikipedia.org/wiki/OpenSolaris. MySOL is still at Oracle and on June 1, 2011, OpenOffice.org donated Oracle to the Apache Foundation. See also http://ostatic.com/blog/is-oracle-holding-back-openoffice-files-from-apache
44 http://en.wikipedia.org/wiki/Fork_(software_development)
45 http://www.fdic.gov/news/news/financial/2004/FIL11404a.html
46 So-called scanning service providers are in the business of providing tools and services for real-time automatic scanning of binary and source code. Antelink, Alamida, Black Duck Software, OpenLogic and Protecode are all in the business of open source license management.
47 http://fsfe.org/news/2011/news-20110620-01.en.html, and more to come. See also http://Gpl-violations.org/
48 http://news.cnet.com/8301-30684_3-20013546-265.html
49 http://www.softwarefreedom.org/
50 http://Gpl-violations.org/
51 license-discuss@opensource.org; a tailor-made non-open source license would help to achieve his goal.
52 OSD# 5. “No Discrimination Against Persons or Groups. The license must not discriminate against any person or group of persons.” http://www.opensource.org/docs/osd
53 http://www.bis.doc.gov/licensing/exportingbasics.htm
54 Especially in (public/private) sector chains, like social security and taxing. Therefore the Dutch government decided on using only one open standard – Business Standard Reporting – starting at January 1, 2013.