Open Source Software in Public Policy

Governments globally recognize cybersecurity’s importance, establishing partnerships and strategies to secure digital infrastructure. However, this attention risks unintentional government policies inconsistent with open-source software (OSS) development and use, often due to a lack of understanding of OSS.

The OpenSSF is a “community of software developers, security engineers, and more who are working together to secure OSS for the greater public good.” This includes the secure development, distribution, deployment, and use of OSS. This short document gives a clear stance on OpenSSF policy work, whether regional or general, as a basis for policy summits, member discussions, and solidarity across our policy representatives.

We, the OpenSSF, take steps to constructively engage with stakeholders worldwide to help improve the security of OSS globally, including working to ensure that OSS will continue to be sustainably available to everyone. This includes responding to government requests for information (RFI), providing expert advice, engaging in processes to develop relevant standards, reporting vulnerabilities/incidents and working to improve related processes, providing fora for discussions and collaboration, and developing educational materials. Per the Linux Foundation bylaws section 8.8, we do not perform any political expenditure or lobbying that might impact our status as a tax-exempt organization.

The OpenSSF focuses on following (per the OpenSSF Public Policy Committee):

1. Encourage governments to responsibly consume OSS in general and contribute upstream, particularly in areas concerning security
2. Encourage public funding of OSS ecosystems, particularly targeting security enhancements and maintenance
3. Encourage OSS consumers to be responsible for OSS security outcomes
4. Encourage governments to engage with or join OSS communities
5. Encourage governments to adopt secure-by-design, secure open source software, and software supply chain security best practices as three key pillars of cyber workforce and education strategies
6. Encourage governments to collaborate, internationally, to secure open source software
7. Encourage governments to include OSS consumption, contribution, appropriate regulation, engagement, education, and international collaboration as key prongs of their AI strategies, and use AI to accelerate each of these.

We advocate for flexible approaches that are efficient, agile, and enable innovation. We note that many OSS projects have small communities (often only one person) and don’t have a source of finances, so many OSS projects cannot develop extensive documentation or provide specialized responses to regulations without additional assistance. The OpenSSF develops tools, guidance, education, and other materials to make it easier for maintainers and communities to develop more secure OSS.

The OpenSSF has a global focus, with international policy and standards experts who advise and work with our communities. We recognize that cybersecurity concerns transcend political borders and want to address universal challenges that all creators and consumers of software face today.