Slashdot Mirror
Convincing the Military to Embrace Open Source
drewmoney writes "Misconceptions about what 'open source software' means has made elements of the US Defense Department reluctant to deploy in a live environment. DoD proponents of shared-source projects are now working to reverse this trend by educating IT decision-makers and demonstrating OSS usefulness. 'The cost of cleaning up a "network spill" that introduces classified material on an unclassified network is running about US$11,000 per incident on the Navy/Marine Corps Intranet (NMCI), so the free Secure Save tool could produce monetary savings for the Navy. Additionally, it would cover more file formats than the costly commercial redaction product currently available on the NMCI.'"
I can tell you, but then I'll have to shoot you...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
NT 4.0 and US naval ships...
I think Linux floats here. Just check www.top500.org
I can't guarantee that all other open source projects will float as well. But, who could?
maybe they just need to look around and open their eyes.
there are lots of projects. for example, http://brlcad.org/
It shouldn't matter. Some software has all the source code publicly available. Other software only has the machine code publicly available. The differences there are quite small. Most software is somewhere between (A lot of free source code is used legitimately in closed source apps).
But it makes no difference. It is ultimately just software. A tool that can do a job. Zealots proclaiming that open source is the only way make it sound like Open Source software is somehow different. It's all just software.
The article confuses two different problems. One problem is redaction, the other is a network spill. The two are very different. Redaction is "editing problem," deleting classified material from a document to make it unclassified. In a network spill, classified information is accidentally put on an unclassified system. A spill is a much more complicated problem. You have to determine how many systems were "infected," and sanitize those systems. And sanitizing may require the destruction/confiscation of the system. You also have to determine whether anyone without a clearance had access to the material. And I would guess that the vast majority of the cost is labor, not software.
I don't think the military should use OSS. I get the whole argument about 'more eyes to look = less bugs' but that only works if you actually upgrade to a newer version that doesnt have the bugs. If I know you're running version 1.0 after 1.1 has come out, I can look at the differences in the code and work out exploits. Surely the military has some kind of long winded process for updating software, so it's quite likely that old versions will remain.
Also what's to stop someone poisoning the source as a popular OSS project did that was recently reported on here? (I'm too lazy to look up which one)
The entire Future Combat System runs on RedHat Linux. The systems timeframe is a little lengthy, but it will be field tested in 2008. It certainly is based on Open Source technology, and it's going to be deployed service wide.
The entire "Future Combat Systems" of the US Army is based on SOSCoE, a virtual environment that currently runs on linux. It includes development environments for C/C++/Java, but not Microsoft or .NET (yet, anyway). I'm not sure where the meme came in that the DoD is anti-linux. They are certainly proportional in their linux market share as the rest of the world, I'd say.
E pluribus unum
It's gonna be hard to get the military to embrace open source. Heck, I've had trouble getting my girlfriend to embrace open source.
Haven't the US military been using Solaris with gnu tools since long before Slashdot and linux existed?
The military is starting to use open source software in more ways than people on the outside may realize. MediaWiki is used in some interesting ways, as is a certain open source instant messaging platform. Without going into detail on things that are best not discussed outside classified environments, there are other large open source software projects that have made their way into the server room.
The issue with Microsoft dependency is a long-standing problem having to do with extremely long certification processes. Another issue is the fact that in order to use anything new, the military winds up spending insane amounts of money on retraining personnel, restructuring documentation, testing in live combat environments, etc. Essentially, it's all the major problems of large corporate uptake of open source projects, with additional dependencies.
Things are slowly improving. The military uses what works, and for much of what we use in our infrastructure solutions developed on Microsoft platforms still work. That's not saying they're necessarily the best answer to a given technology need, but they're already in place and it will take some time for new ideas to get adopted.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Open source software is the only type of software that is often mostly made by foreigners that the DoD will use. Proprietary software that is owned by a foreign company cannot be used without extraordinary extenuating circumstances. Even if the whole development is done in America, the legal ownership by foreign nationals takes the proprietary software automatically off the approved software lists.
I hate to break it to you, but you failed miserably. In fact, the magnitude of your failure is so large that it would take me 30 years just to describe it accurately. Instead, I think I would prefer for you to just step in front of a train. It would make life easier for everyone involved.
The NAVI even created there own Ada compiler in open source (OK they had the NYU to help them). Today the compiler is part of the main GCC distribution.
Martin
both the arpanet (essential predecessor to the internet) and bsd unix (essential predecessor to linux) were open source projects funded in large part by darpa, which is the american military. so saying that the military doesn't embrace open source seems kind of wrong.
Didn't you mean to write "open-source"?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
NASA World Wind is open source and is uses by the DoD and other governmental groups.
They've kicked the linux tires a time or two. Secured it a bit.
Well.. maybe. Or Maybe not. But Definitely not sort of.
I work as an integrator and inserter of technology into military organizations.
Hence, I can say with some authority that they are, for the most part, Talready convinced. To best characterize them, it would be: "interested, but cautious". "Convinced, but careful". They want to save money, believe that open source can be good, but have certain matters of due dilligence that they need to attend to.
There remain "paperwork" issues of getting open source into SCIFs, particularly when the provenance of the open source is questionable. Not all open source is born equal, you know. Some is pretty shitty, and some is even written by people in countries that actually DO have active spying programs against us (if you were to say that because the source is there, and open for everyone to see, that this reduces risk, I would agree with you, however this statement that the risk "ought" to be less is sometimes insufficient for these classified area types, dontcha know).
BTW, there is a new DoD directive that has been issued, ordering all defense procurement to include an assessment of open source products as an alternative to proprietary software. How is this "not convinced"?
C//
Then they are as firmly entrenched in the M$ death spiral as we are. Although *some* of our kit is Linux, it's very specialized and it would be on
My Linux knowledge is practically nil, and I'm the "expert" in my unit.
I tried to think of a good sig, and this wasn't it.
Is the article summary talking about Open Source or Microsoft's Shared Source? They're Not At All the same thing.
Don't piss off The Angry Economist
Then they are as firmly entrenched in the M$ death spiral as we are. Although *some* of our kit is Linux, it's very specialized and it would be on less than 1% of computers that I have come in contact with. It's just too easy to keep the "status quo" going then to have to train the front line administrators in more than one OS (2000 and XP is difficult enough), let alone more than one office suite. When a data spill happens, (more often than not it's a computer error, rather than human error) I have yet to see an entire computer confiscated (although I'm sure it's happened). If anything the offending hard drive would be confiscated or *gasp* in a pinch we'd probably just slap a secret sticker on it to save time. Good thing I work for a country with not so many super duper secrets like the US, or even a budget worth 1/50th of the DoD, any orginization that large would be a major pain in the arse.
My Linux knowledge is practically nil, and I'm the "expert" in my unit.
I tried to think of a good sig, and this wasn't it.
The nicest thing about NMCI might be that it scares the Navy/Marine Corps off of all commercial software solutions. The system is incredibly dysfunctional and expensive. Moving a computer from one user to another or from one side of the room to the other usually costs several hundred dollars and weeks of delay. Moving a whole unit is a nightmare. Most software will not work on the network and users seem to devote themselves mostly to hacking printers and external drives onto the system because that is the only way they can get their work done. Open source software encourages the user to solve problems. If you know how to fix it, do so. If the Marine Corps/Navy adopted this concept (as opposed to just some open source software, rigidly controlled) it would be a perfect about face from the NMCI system where you have no access of any kind to your own machine and neither does the S-6 shop (the computer shop) in your unit. Instead you have to rely on some under trained and, in any case, unavailable, tech located on the other side of the world. We are literally ceding an advantage to our enemy with NMCI and Open Source (which in many ways had it's birth in DARPA) is the perfect solution to this strategic disaster.
cogito ergo oro
The Army and Marines use a lot of Linux. My company sells software to mostly the Army, and we have lots of Linux developers for a couple of Linux only intel software apps.
The NSA (and all the branches of service that work in/for it) uses a heavy mix of UNIX and Windows (and the largest chunk of Mac OS X of any gov't agency I know of).
Bascially, each branch operates in a fishbowl, separate from each other, so it is hard to generalize the Department of Defense's computer uses.
With the most advanced inertial navigation software, image sensors, microprocessors being developed in other countries, they have to use open source and download it from other countries just to survive.
We can stop errors like....uh...this.
Then stop contributing to GPL projects. The license allows users to do whatever they want with it, to whatever purpose.
Judging by parent's User ID, I'm going to karma hell for this, but too damn bad.
When you insert code into something like the Linux kernel, you agree that from that moment on, it is licensed under GPL version 2. That does not mean you have the luxury of deciding who uses it, despite your little political foibles on that topic. "Free software" means exactly that - if the United States Armed Forces opt to use the software, then they have every right to use it. It is no longer in your control.
On another note, why should you object to having the military using code you've written? You're failing to understand that the men in uniform are under a binding contract, and that they are sacrificing every day to defend their nation. The US Military does not create policy, civilian politicians do - the military is just a tool of policy. They need all the tools at their disposal to do their job of keeping the United States safe, however that job is defined by the politicians.
It's a waste of time pitching the Navy anything. NMCI outsourced their entire network infrastructure to EDS. A monumental cesspool of pork barrel contracting that puts Haliburton's Iraq contracts to shame. There are hurdles and endless reviews for getting any piece of software approved for use on Navy or Marine networks. And between SPAWAR and EDS they're busy trying to squeeze out what little internal development is left in the Navy and move everything to the giant hosted service architecture. The very people most likely to use and promote any type of open source software or a project built on open standards are the ones jumping ship and going elsewhere.
You can waste your time trying to educate DoD if you want but it's maddeningly frustrating. They'll listen and understand, then go off and do something entirely different. Which is a shame because the military is an organization that would benefit the most from an open, flexible infrastructure. One that could scale on demand, integrate disparate information sources and is reliable on legacy hardware. You would think with the massive paperwork hassles of buying anything through the government, the military would pounce on technology that let them side-step the entire procurement process and load it when you need it.
It would all be funny if it wasn't billions of your tax dollars going down the crapper.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
On Navy ships workstations are Windows 2000 for office work and for Sailors to email home (everyone has a UNCLAS account).
The more specialized gear (Aegis, and various consoles) are usually Unix or Linux, depending on the piece of gear and the Aegis baseline.
A few pieces of gear run on Windows variants, the Navigation gear (Voyage Management System) the most notable. I think it is a civilian product the military uses.
From what I can tell the Navy doesn't give two shits about what the software runs on, so long as it works. Contractors do all of the upgrades and major overhauls anyway. Sailors just troubleshoot.
Not to mention that hardware and software varies greatly from ship to ship. A Aegis tech from the original Arleigh Burke destroyer would be hard pressed to trouble shoot a system from the latest variant of that class of ship, if he was able to accomplish it at all.
Navy enlisted techs are usually sent to a specific school for a certain piece of gear to help alleviate this problem, though it complicates the Navy's already dire manning problems as certain pieces of gear may only be on a few ships. It is no wonder that civilians do so much these days.
Just my two cents.
Remember folks, slashdot doesn't have a -1 "disagree" moderation!
OSS focuses on the latest and greatest features, government doesn't, they want tested and proven versions. OSS EOL's stuff long before it would be considered "tested" in something like a DoD environment.
I know the linux fanboys here will go batshit crazy over this, and i guess the truth stings.
the ONLY situation i can see OSS being any advantage to the DoD is if they hired the developers of an OSS project they are interested in to maintain a fork of the software for them.
If you mod me down, I will become more powerful than you can imagine....
It is ridiculous to suggest that the military is concerned about cost or spending. The taxpayer pays the bill, and the bill can grow to whatever is politically possible. Why would a department choose open source when a few well connected companies stand to make hundreds of millions selling closed source solutions. The primary role of the military in US society is to funnel tax money and reward political power and connection. A large percent of military spending is for parts that are scrapped months before they are even delivered. They go from the factory to the dump.
The navy doesn't care how much it costs because, in the end, you will pay. The navy will never go bankrupt no matter how much they spend.
It doesn't sting. It reminds me of my boy when he was 8 years old. We would take him out to nice restaurants where we could get decent food. No matter what was available he wanted the same boring things: chicken nuggets, grilled cheese, cheeseburger.
I encouraged him to try new things but it's pointless to push it because there's something in the human condition that makes us think any unfamiliar food is toxic.
So be it. Enjoy your kid's meal. I'll be over here with the diverse selection of culinary creations from all the world's cultures. Thanks.
Help stamp out iliturcy.
Painful point, but I think that's true in the hardware world as well.
Every military project I've ever worked on has demanded a copy of all source code "for security reasons" - to make sure I wasn't slipping anything extra in there.
No sig today...
Accountability and maintenance is the issue that keeps US DoD from adopting open source for the most part.
As far as the article goes, I don't truly see open source as making an impact on network spills.
MyNameIsFred was right on, in his labor assessment.
Most of the network spills that I have been involved with cleaning up, are due to human error, who are generally writing a report, and inadvertently include some information that is of a higher classification. They then, publish this, or email it to everyone under the sun, and it is mostly manpower that is spent on trying to track down who got it, and what they did with it, and how to get the horses back in the bar after the fact. Education is the issue there, not technology.
As far as redaction goes, I don't know, I've never been involved with that, so I don't feel I can speak on the subject.
Accountability: DoD doesn't trust most open source programing, as they do not know who did the actual coding. It could have been an American or an allied nation, who is friendly to the US, or they could be from a country that is not as friendly. With closed source programing the idea (though not necessarily the reality) is that they can require that only US citizens or allied nations do the work, thus preventing a foreign national from an unfriendly nation from putting in some sort of back door that could be used to exploit the system... (again, the reality is that code is often outsourced and there is nothing from keeping a US citizen from putting exploitable code into the system, but again, this is the intent, not reality).
"But, if you have the source code, you can check it yourself, to make sure there are no back doors!" -- this is a great argument, but it isn't really practical. Who would do this work? There just isn't enough manpower for this task. Personally, I think this could be the biggest strength of open source code, used in a defense environment. You take a product, customize it to your missions needs, then sign and hash it to verify that it hasn't been tampered, and require that only that version of the code is used. Releasing this code to the public generally isn't that big a deal, as if a new feature is added, it probably needs it, but most likely, features would be removed, making the product simpler. IRC clients that certain commands insist on using, irregardless to the security threat they provide is a great example (Yes, it is on a secure network, but that doesn't mean you shouldn't insist on all applications following best practices).
Until DoD starts doing something like this on a large scale basis, the argument that some evil foreign power COULD have put something bad into the code, is going to carry a lot of weight. And everyone in DoD knows what foreign powers are most likely do so... after all, you would have to be stupid not to try and do the same thing if you could!
Maintenance: This is the other big issue DoD has with open source. If there is an issue with the program, we may need to talk to someone to fix it. Also, we need to make sure that if it is going to take 5 years to get it implemented, that it will be supported when we finally get to use it in production.
"But, you can get maintenance on Red Hat or (insert names of product or company here)!" -- this argument is heard all the time, but just because you can get product support, doesn't mean that it is going to be around long enough. Thunderbird is about the only example I can think of to back this up (and it is probably not a good example, but you know what I mean). The open source project could be abandon at any time due to the main developer getting tired of it, or perishing, or going to jail for murder or whatever. Now, this can also apply with any closed source, commercial product, as well, where the company goes under, or gets bought out, etc... but again, this is the an argument that carries a lot of weight in DoD. This is why they generally choose to use MS or Unix, they are pretty sure that it will be around
I'll tell you what... Why don't you go to your local military base and say that to a soldier's face?
Judging by your tone of voice, you obviously don't understand that there are millions and millions of men and women who have sacrificed themselves so you can speak those very words of hatred for their cause. So, because they have signed their life away to defend you and your family, you are going to deny them the tools that could very well save their lives, and yours in the process, because you take issue with the politicians on Capitol Hill?
And since when did a country need to threaten the US in order for there to be justification of a war? The US is suddenly forbidden from coming to the defense of other nations? I'm sure the Kurds would love to speak with you - well, those that survived the gas attacks, that is.
Fuck politics, you can believe whatever you want to (by the way, thank a soldier for that), but the one thing you do not do is speak ill of a man who would die for you and your family.
There goes my karma, but it was worth it.
http://www.lynuxworks.com/solutions/milaero/in-action/ddx.php
http://www.spacewar.com/reports/Concurrents_Redhawk_Linux_Selected_For_THAAD_Missile_Defense_Program.html
The military is already embracing real-time linux distros. . .
The military does use open source software and they are extremely knowledgeable about it, so the premise of this article is flawed. However, most desktop (office) computers within DoD are Windows and Office based, the military likes interoperability for day to day communications. However, mission or weapon systems vary widely; I have seen VMS, Unix, Linux, Windows, OS/2, etc... used. These systems, depending on use, are typically in a standalone or closed network configuration. Closed networks, particularly those that are classified, are encrypted. So in order to take advantage of a software flaw one must first break the encryption or gain physical access to the system, unlikely. There is always the internal threat, but that is why DoD issues security clearances and controls physical access to systems. Also the military will not arbitrarily patch their software, especially on mission systems. They must test the patch and ensure it doesn't affect mission critical software, this doesn't happen overnight. If a patch is available in less than 24 hours from when a major flawed is discovered it doesn't necessarily benefit the military.
Iraq billions
Yoo dont haf too convins tha milateri too yooz owpen sors softwer. Thei iz alredi yoozing it.
You've got a great point! In fact, let's take it a bit further. Why should we do ANYTHING to help the military? I say you start a campaign of civil disobedience aimed at destroying the US military's ability to wage any sort of warfare whatsoever. Don't stop until they're down to using shoelaces and plastic forks. I'm sure this will make the entire world a much safer place, and you'll have PLENTY of time to rebuild the military once foreign troops start rolling over your borders! Plus I'm sure it won't affect your global standing or your quality of life in the slightest! Yep, clearly we could achieve a true utopia if only we could disarm the US military!
Comment removed based on user account deletion
So are you saying that keeping the military in a state where it must funnel money to corporate interests is a _good_ thing?
If the military stopped using MS software all together, it would remove Microsoft as an entity who would gain by increased military expenditure. Thank you for promoting the military-industrial complex.
- These characters were randomly selected.
It could be that the person is against those policies and/or against the actions taken to defend/enforce those policies.
It could be that the person is against military alltogether.
As a sidenote: your excuse you are giving the military is very close to "An order is an order." and that does not work since a very long time.
Don't fight for your country, if your country does not fight for you.
Really? Exactly how long ago did the excuse stop working? Besides, I doubt most decisions about what software to use in the military have anything to do with policy. A soldier might refuse an order to kill civilians because he thinks it's immoral. A general might even refuse to order an invasion because he believes it's illegal or immoral. But under what circumstances would someone in the military choose a proprietary application instead of a Free one on moral grounds? If he simply wants to sabotage the effectiveness of the military, there are probably much easier ways.
You must be new here. Otherwise you would know that the port of Linux to sharks with lasers is making good progress already.
Ezekiel 23:20
You are appalled at this process in the military, I am glad. This isn't some tiny server farm you're running for kicks - when your systems are compromised or fail outright, people die. I for one am glad that there are certification processes in place to ensure that the code we are running in mission critical systems is SECURE. Sure, we have a *reasonable* expectation that Ubuntu is technically sound, won't go kaput at a moment's notice, and doesn't contain any Chinese communist espionage code... but we don't KNOW that. The security of a nation is not run on hunches and educated guesses.
Open source software promotes Competition Closed source software promotes Collusion.
Slashdot = Sarcasm
That's like saying murderers and humanitarians are all just people. It's true if you exclude lots of factors, but in the wider sense of contribution to society, it's complete BS.
That's like saying murderers and humanitarians are all just people
They both work as well as organ donors.
There is a lot of philosophy about whether Open Source is in itself good for society. Really though, this shouldn't affect government buying decisions any more than someone's political opinions affect whether they should be hired.
Is there any public list of what software is already approved?
I know for a fact that some of the major decision makers in the UK MoD (my little brother is one of them) know just enough about open source to be dangerous.
He knows that the source code is fully in the open. He knows that the projects invariably are a sum of contributions from all over the planet by programmers who have never met each other...
BUT
until I put him straight, he seriously believed that open source projects - even the major ones like the linux kernel itself - where contributed to in a free-for-all wiki arrangement with no overseer at all.
This is a misconception that is often completely overlooked and contributes massively to the lack of trust in open source in secure environments.
People always said the main thing slowing down the adoption of Linux was the lack of a killer app...
"Yes, this village of children and their parents reduced to a smoky hole in a ground made possible by missiles running Linux!" Really, do we want that kind of association for something that is otherwise so wonder and represents the major achievement of OpenSource?
Sorry, I do not wish to OpenSource death and destruction. If the military wants to use Linux to manage their death infrastructure, not much we can do to stop them. But to encourage them to do so? Not in the name of OpenSource!!!!
Ruby Neural Evolution of Augmenting Topologies
You really should listen to Peter Quinn's talk on ODF, and learn about sovereignty before you say that. You'll almost certainly find it enlightening.
p.s.: the Venezuelan open-source related stuff on encouraging their own economy is also directly relevant to why governments should care about open source. Not to mention the underhanded (and prooven) bribes from companies like Microsoft while attempting to keep things closed. The fact that such things can't happen with open development ALONE should make you want your government leaning towards that.
That is only not an excuse if the action is against the rules of warfare. If a military superior gives a soldier an order, unless that order is illegal, under the laws of the military the soldier is in, or the international rules of warfare his country has agreed to, the soldier has a responsibility to follow those orders. Failure to do so can have severe consequences, up to and including execution for mutiny. So, if it's only a moral issue, then it is the job of the soldier to shut up and soldier.
That which is done from love exists beyond good and evil
I am aware of the Nuremberg trials, but the principle applied there was that following orders is not an excuse for committing war crimes. It was not decided that members of militaries are always responsible for harm resulting from orders they followed. Obviously, that would put soldiers in a precarious legal position since they're often ordered to kill people and blow stuff up.
But I consider open standards and open source to be different arguments. Unless you're employing your own developers, freely available source code (as opposed to restrictedly available source code) is not the most important aspect of the software.
If you give me a bat, and I break it over your head, would you give me another bat? If you have any shred of common sense, no, you wouldn't.
How many people do you think would want to fight for your freedom, if the first thing you do with it is stab them in the back? How many people do you think would die for you if you're so vehemently opposed to the cause that they are fighting for?
This isn't about freedom of speech, it is about human decency. Freedom of speech is wonderful, but if one has any shred of decency, one will at least show some form of respect for those who sacrifice their lives to defend the very freedoms that allow you to spit in their face.
So ... in 1998 they used NT on a ship that has been decomissioned for three years?
That was ten years ago.
Technology has changed slightly, and the military loves throwing money at contractors to do upgrades.
Remember folks, slashdot doesn't have a -1 "disagree" moderation!