Open Source and Government Data Rights?

IAAL asks: "I am a long-time Slashdot lurker and I have an opportunity to speak to a group of tech folks who are involved in developing software for the federal government. Can anyone point me to any good information or discussions regarding the intersection of government data rights and open-source licensing? I am doing some research now and if I come across anything of note I will submit it here."

Comments

Re:Which Rights?

[Spoing]

Most governments have little problem with the GPL requirement that

• if they modify the software AND
• if they distribute modified software

that they must distribute the modified source.

There's part of what you say that implies that if any distribution occurs the source must be provide to everyone. If this is what you mean, it's a common misconception, and it is often repeated.

Here's the important difference -- and it covers software under a GPL-style license only;

• If you distribute within your orginzation, the orginzation does not have to disclose any changes to those outside the orginazation.

The requirement to release source only applies to those who you redistribute to -- even if you do not make source changes.

Note: If the binary is stolen or not intentionally redistributed (not provided to those outside the group)...there's still no source distribution requirement since it wasn't distributed.

If the licence is Apache, BSD, XFree or other similar open source licences, there is no requirement to provide source code at all. A large group of programs -- many quite important -- fit in this group.

In effect, for either GPL-style or Apache/BSD-style software, the software and any changes that are made become propriatory to the group -- commercial, governmental, private, or even if the group is just you.

There's not much of an advantage to this, though, since updates from the main 'public' branch become more painful and you loose any feedback to changes you make that could improve your code.

The best way to handle this is to keep internal configuration and data -- the parts that make your group important -- seperate from the core software. Contribute all source changes back to the main public project. There's little practical reason not to.