The Department of Defense has not adequately implemented a pilot program, mandated by Congress, that would increase the Penatgon\u2019s reliance on open source code, according to a Sept. 10 report from Government Accountability Office.<\/p>\n\n\n\n
The Pentagon failed to follow an August 2016 memorandum from the Office of Management and Budget, which directed agencies to create a pilot program that released 20 percent of their new developed code as open source, as well as establishing a metric for measuring success. The fiscal year 2018 National Defense Authorization Act required the Pentagon to follow that policy. Open source programming allows users to modify, reuse and share code. As a result, open source can reduce costs and improve efficiency, the GAO wrote. According to the report, titled \u201cDOD Needs to Fully Implement Program for Piloting Open Source Software,\u201d<\/b> officials from 11 components within the DoD said there would be efficiency and financial benefits.<\/p>\n\n\n\n
\u201cHowever, there were disparate views on how to manage the cybersecurity risk of using open source software,” the GAO wrote. “Specifically, officials from three components noted that security concerns could result in the sporadic use of [open source], whereas eight officials stated that the potential cybersecurity risks were managable [sic].\u201d<\/p>\n\n\n\n
According to the GAO, as of July 2019, the Pentagon had released less than 10 percent of its custom developed code, well short of the 20 percent goal.<\/p>\n\n\n\n
The Pentagon\u2019s top IT official, Dana Deasy, is responsible for implementing the requirements. Under the OMB guidance, agencies have to issue a policy for government-wide reuse of code, conduct software solutions analysis looking at alternative software options, secure data rights and inventory custom code, and release code in a way that fosters communication between agencies. The DoD has not issued a policy for open source code, but has \u201cpartially implemented\u201d the other three requirements.<\/p>\n\n\n\n
The Pentagon pushed back on the GAO\u2019s first recommendation – that the DoD should implement the open source pilot program – writing that the Pentagon \u201cdoes not believe that the pilot program as described in the OMB memorandum is implementable as proposed.\u201d Department leaders argued “most of DoD\u2019s custom developed software is created for weapons systems and releasing the associated code is sensitive for national security reasons,\u201d the GAO reported.<\/p>\n\n\n\n
Deasy\u2019s office also said the size of the Defense Department makes it difficult to inventory all the code.<\/p>\n\n\n\n
\u201cThe CIO reported that the size of the department makes it nearly impossible to inventory all of its source code custom developed since August 2016. As such, the CIO stated that it would be difficult to meet the OMB memorandum\u2019s goal of releasing at least 20 percent of its new custom code as OSS [open source software],\u201d the GAO wrote.<\/p>\n\n\n\n
According to the report, the Pentagon also didn\u2019t create a metric to gauge the pilot program\u2019s performance \u201cdue to a lack of consensus in the department about what data should be collected.\u201d<\/p>\n\n\n\n
\u201cAccording to the CIO, if the measure is \u2018lines of code,\u2019 then it unfairly discounts projects that invest a significant amount on research, but are small otherwise,\u201d the GAO wrote. \u201cIf the measure is \u2018project hours,\u2019 then it discounts those projects that came about from sparks of innovation that took little time to develop. If the measure is \u2018project count,\u2019 then it ignores the other two possible measures.\u201d<\/p>\n\n\n\n
Some officials interviewed by the GAO also expressed concerns about cybersecurity risks posed by open source code. An official in the Navy CIO\u2019s office said they worried about malicious code being inserted by a disgruntled employee. Without a process to verify the integrity of open source code, the official told the GAO, the Navy lacks the risk assurance it needs, something the service has with commercial-of-the-shelf products. Another official feared problems due to the lack of governance structure.<\/p>\n\n\n\n
Other officials said that security concerns could be mitigated by building security into software, verifying code before its deployed, and creating a repository for verified code could mitigate risks.<\/p>\n\n\n\n
\u201cUntil DOD fully implements its pilot program and establishes milestones for completing the OMB requirements, the department will not be positioned to take advantage of significant cost savings and efficiencies,\u201d the GAO wrote.<\/p>\n","protected":false},"excerpt":{"rendered":"
Congress’ watchdog agency found that the Pentagon is well short of compliance on making custom code open source.<\/p>\n","protected":false},"author":7,"featured_media":62699,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["it-networks","home","watchdogs","federal-oversight","daily-brief","newsletters","it-cloud-report"],"primary_category":"it-networks"}}},"categories":[106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-20951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"EG3OBDCIP5FDNAUCXE2FTHGFZA","arc_canonical_url":"\/civilian\/omb\/2019\/09\/11\/why-cant-the-pentagon-use-more-open-source-code\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n