Agencies should secure distribution rights when procuring custom software

[MCHopson]

(I'm Mark, an acquisition specialist at 18F, an office in the U.S. General Services Administration (GSA) that provides in-house digital services consulting for the federal government. I'm commenting on behalf of 18F; we're an open source team and happy to share our thoughts and experiences. This comment represents only the views of 18F, not necessarily those of the GSA or its Chief Information Officer.)

Summary: The policy should require the acquisition community to ensure that the federal government has unlimited rights to distribute procured custom software publicly, and the policy can suggest the "Rights in Data—Special Works" clause for this purpose. The policy should discourage the use of Rights in Data—General", which does not secure these rights.

---

18F's policy is that all custom software it produces — and procures — is open source from the first line of code, and dedicated to the international public domain.

In support of this policy, 18F designed the Request For Quotation for its Agile Delivery Services Blanket Purchase Agreement with clear guidance for contracting officers who place task orders to require all produced works to be committed to the public domain. 18F's micro-purchase initiative, where vendors bid on small and discrete tasks (up to purchase card limits) on open source 18F projects, effectively requires vendors to dedicate all work to the international public domain through 18F's standard repository contribution requirements.

However, this is unusual in the Federal government. Today, it is common for agencies to use data-rights clauses from the Federal Acquisition Regulation (the "FAR") that prevent them from distributing the publicly-funded software code they procured. This practice significantly hinders OMB's goals of lowering costs and avoiding unnecessary procurement of software for multiple agencies.

In short, our view is that it should be legally and practically trivial for agencies to share publicly funded procured software code with the federal community and the public at large.

Require the acquisition community to ensure unlimited distribution rights when procuring custom software development

In "Government-Wide Code Reuse", the draft policy says that federal procurements of software must (emphasis ours):

Secure unlimited rights to the custom source code, associated documentation, and related files—which includes the rights to reproduction, reuse, and distribution of the custom source code, associated documentation, and related files across the Federal Government.

Today, use of the FAR's "Rights in Data—General" clause is prevalent in the U.S. government acquisition community when procuring custom-developed software. This clause does not secure rights necessary to share procured software with other agencies and the public at large.

From 48 CFR 52.227-14(c)(iii) (emphasis ours):

...For computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public) by or on behalf of the Government.

In contrast, the "Rights in Data—Special Works" clause specifically allows the distribution of copies to the public. From 48 CFR 52.227-17(c) (emphasis ours):

...The Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

It's important to emphasize that though these clauses govern distribution to "the public," they necessarily impact distribution among federal government agencies. As we discussed in #73, "open source by default", 18F's consistent experience is that the most effective way of intra-governmental sharing, by far, is through public availability. This is only more true when dealing with software, which is most effectively distributed through sophisticated version control systems (rather than traditional file transfer mechanisms, such as zip files or physical media). In other words, securing distribution rights only within the government is not an effective way to ensure government-wide distribution.

In the FAR's prescription for the use of the Special Works clause, 48 CFR 27.409(e), Special Works is described as a way for the government to manage distribution of the work products of its contracts:

...for the Government's internal use, or when there is a specific need to limit distribution and use of the data or to obtain indemnity for liabilities that may arise out of the content, performance, or disclosure of the data.

"The Government's internal use" has broad applications, and can include public distribution. Fundamentally, Special Works is a mechanism for giving the government more complete control over the work product of a contract. When it comes to publicly funded software code developed for the government, this control is essential to avoid vendor lock-in and duplication of effort.

OMB should clearly instruct agencies to ensure unlimited distribution rights when procuring custom software development. This will help OMB more effectively meet its goals of lowering costs, avoiding duplication of software development, and promoting the reuse of procured software among federal agencies and with the public.

To do this, we recommend that OMB rewrite bullet "2." of the "Government-Wide Code Reuse" section to say (emphasis on added text):

Secure unlimited rights to the custom source code, associated documentation, and related files—which includes the rights to reproduction, reuse, and distribution of the custom source code, associated documentation, and related files across the Federal Government and to the public.

And to then add a footnote to the end of that sentence which says:

To obtain full distribution rights, agencies may use the “Rights in Data—Special Works” clause (48 CFR 52.227-17) when procuring software. The “Rights in Data—General” clause (48 CFR 52.227-14) will not be sufficient to guarantee these rights to the government. Further guidance for contracting officers will be made available in Project Open Source.

We note that the Special Works clause does not guarantee that a contractor may not copyright and commercially license publicly funded software they developed for the government. Rather, the Special Works clause defines a process by which a contractor can make their case to claim the code, so long as it does not run afoul of the enumerated examples provided in 48 CFR 27.405-1, so that the government can reach a decision. To help make these decisions, OMB should provide clear guidance and examples for making such determinations as part of Project Open Source.

In summary: the policy should require the acquisition community to ensure that the federal government has unlimited rights to distribute procured custom software publicly, and the policy can suggest the "Rights in Data—Special Works" clause for this purpose. The policy should discourage the use of Rights in Data—General", which does not secure these rights.

[dsmorgan77]

I'm not inclined to agree. The Rights in Data - General clause should be sufficient here. You have omitted a key part of the clause:

_The prior, express written permission of the Contracting Officer is required to assert copyright in all other data first produced in the performance of this contract.
_

If the Government does not permit the Contractor to assert copyright, then the government's rights are unlimited (see (b)(1) of same). This is further reinforced by (f)(1) of the same clause, which says that data that are delivered without restrictive markings is deemed to have been furnished with unlimited rights.

In short, there is nothing to do here. As long as the Government doesn't allow the Contractor to assert copyright (or the Contractor does not assert copyright), then the government can distribute.

[richsalz]

perhaps guidance saying that Contractor must provide a "compelling justificdation" to request copyright assertion?

[konklone]

@dsmorgan77 I understand your point, and that’s a helpful part of the General clause to point out, but the section you quoted only concerns copyrightability. We are concerned about ensuring that public distribution rights are unlimited.

If the Government does not permit the Contractor to assert copyright, then the government's rights are unlimited (see (b)(1) of same).

Copyright is only one way that distribution might be limited -- distribution can also just be limited by the direct terms of the contract.

This is further reinforced by (f)(1) of the same clause, which says that data that are delivered without restrictive markings is deemed to have been furnished with unlimited rights.

While it’s possible to read that as assuming a default of unlimited rights, it’s also possible to read it as assuming that General allows contractors to use markings restricting the government’s rights to distribute.

And because of 48 CFR 52.227-14(c)(iii), the latter interpretation seems more plausible to us. To quote it again (emphasis ours):

For computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public) by or on behalf of the Government.

And this is distinct from the Special Works clause, which does not contain the limitation emphasized above. This clause is essentially a peer to the clause you cited about the contractor needing to get permission to copyright the work. This is possible to reconcile, because copyrightability is not the only way to limit distribution for either party.

To be clear, this is all incredibly confusing. What’s fundamentally important is that the U.S. government be unambiguously in control of public distribution of the source code that it spends public funds procuring. The “Rights in Data—General"” clause has a clause in it that creates serious ambiguity about that right, which is why we’re raising this issue.

Our recommended text change, reproduced below, makes it clear that obtaining this right is required (emphasis used to note addition):

Secure unlimited rights to the custom source code, associated documentation, and related files—which includes the rights to reproduction, reuse, and distribution of the custom source code, associated documentation, and related files across the Federal Government and to the public.

Whether we settle specific clause recommendations in the policy or in Project Open Source, this change is an important norm for OMB to set -- even, as we described in our comment, if the goal is primarily to promote inter-agency sharing and reuse. Public distribution is the most effective way to do this. And even if agencies attempt to privately share procured code, this should be a low-stakes, low-bureaucracy affair -- the penalty for accidentally distributing this code publicly should be very low. It shouldn’t open themselves up to litigation for a breach of contract or violation of copyright or other issues. The government should, unambiguously and entirely, be in control of the source code it procures, up to and including public distribution.

(This reply is also on behalf of 18F.)

[dsmorgan77]

Thanks, @konklone!

Of course, I absolutely agree that the policy should encourage public distribution. The same bias toward openness that is embodied in the open data policy should apply here (as software is, of course, considered data). The change to the body of the policy is totally fine with me.

That said, I think my 18F colleagues are making a pretty big logical leap about the potential harms and misinterpretations of the FAR clause. The provisions of the clause build on each other. The government's rights are unlimited (see (b)(1)) unless the government gives those rights away. Unlimited is unlimited, and that includes the right to distribute copies to the public (see: definitions in the clause at (a)).

The clause only allows for an exception to those unlimited rights in (c)(1)(i). The government gets to decide whether the contractor may assert copyright. When the government permits this for computer software, the government cannot distribute software to the public (see (c)(i)(iii)). We may not like (c)(i)(iii), but it only matters when:

• A contractor asserts copyright
• The government permits that assertion

So, my argument is that the clause is not broken. It could be written more plainly, but I think it offers all the protections you're advocating.

[konklone]

Of course, I absolutely agree that the policy should encourage public distribution. The same bias toward openness that is embodied in the open data policy should apply here (as software is, of course, considered data). The change to the body of the policy is totally fine with me.

👍 That's the most important thing to us, as well.