How To Use the NDAA Pages

Back to NDAA Contents

TITLE VIII--ACQUISITION POLICY, ACQUISITION MANAGEMENT, AND RELATED MATTERS

Subtitle H - Provisions Relating to Software Acquisition

P. L. 115-

House Conference Report. 115-404

(a) In General.—Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall initiate for the Department of Defense the open source software pilot program established by the Office of Management and Budget Memorandum M-16-21 titled “Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source Software” and dated August 8, 2016.

(b) Report To Congress.—Not later than 60 days after the date of the enactment of this Act, the Secretary of Defense shall provide a report to Congress with details of the plan of the Department of Defense to implement the pilot program required by subsection (a). Such plan shall include identifying candidate software programs, selection criteria, intellectual property and licensing issues, and other matters determined by the Secretary.

(c) Comptroller General Report.—Not later than June 1, 2019, the Comptroller General of the United States shall provide a report to Congress on the implementation of the pilot program required by subsection (a) by the Secretary of Defense. The report shall address, at a minimum, the compliance of the Secretary with the requirements of the Office of Management and Budget Memorandum M-16-21, the views of various software and information technology stakeholders in the Department of Defense, and any other matters determined by the Comptroller General.

The Senate amendment contained a provision (sec. 886) that would direct the Secretary of Defense to manage the Department’s unclassified, non-defense article, custom developed computer software code using open source licenses and an open source software repository. This provision would also direct the Secretary of Defense to consult with experts from the Defense Innovation Board, DARPA, the NSA, and the Defense Digital Service when updating the DFARS and drafting additional policy or instructions on the use of open source software and to make use of existing Department of Defense open source resources where possible. This provision would further direct the Department to make use of technology prize competitions for improving, repurposing, or reusing software, and to identify methods to reverse engineer Department of Defense software for which source code is unavailable.

The House bill contained no similar provision.

The House recedes with an amendment that would change the section of title 10 the provision amends, clarify the use of an appropriate software repository, reaffirm the existing unlimited rights terms in the Defense Federal Acquisition Regulations Supplement under which the Department of Defense may apply open source software licenses, and remove the requirement for DARPA to identify methods to locate and reverse engineer existing DOD software for which the source code is unavailable.

The conferees note that establishing an appropriate repository for open source software will be critical for maintaining security and also to fostering a community of collaborative software experts.

The conferees are pleased with the early success of the Department’s code.mil initiative and encourage the Secretary to consider use of that repository to implement this provision. The conferees also note the importance of ensuring that the Department of Defense uses appropriate open source licenses. The Secretary of Defense shall therefore, no later than 180 days after the enactment of this Act, establish guidance to ensure that the Department of Defense applies the appropriate Open Source Initiative approved licenses to its source code.

The Secretary of Defense shall also, not later than one year after the date of the enactment of this Act, submit to the congressional defense committees a report that identifies methods by which the Department of Defense could reverse engineer legacy software for which source code is unavailable.