,,ii #aahth ,,congress #b;d ,session ,s4 #ceid ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #af1 #bjbd,mr4 ,cruz 7for himself and ,mr4 ,peters7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to require governmentwide source code sharing1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,source code ,harmonization ,and ,reuse in ,information ,technology ,act or the ,,share ,,it ,act4 #b4 ,findings2 ,purpose 7a7 ,findings 7#a7 ,in general ,congress finds the following3 7,a7 ,duplication of efforts ,federal agencies often engage in the development or procurement of similar software solutions for comparable problems1 leading to a duplicative allocation of resources that could otherwise be avoided4 7,b7 ,cost inefficiency ,the absence of a mechanism for inter-agency source code sharing results in the ,federal ,government incurring unnecessary costs for software development1 licensing1 and maintenance1 an inefficiency highlighted by the ,government ,accountability ,office in numerous reports1 including-- 7i7 ,government ,accountability ,office ,report ,federal ,software ,licenses3 ,better ,management ,needed to ,achieve ,significant ,savings ,government-,wide 7,,gao-#ad-dac71 published on ,may #bb1 #bjad2 7ii7 ,government ,accountability ,office ,report #bjaf ,annual ,report3 ,additional ,opportunities to ,reduce ,fragmentation1 ,overlap1 and ,duplication and ,achieve ,other ,financial ,benefits 7,,gao-#af-cge,,sp71 published on ,april #ac1 #bjaf2 7iii7 ,government ,accountability ,office ,report ,information ,technology3 ,do,d ,needs to ,fully ,implement ,program for ,piloting ,open ,source ,software 7,,gao-#ai-deg71 published on ,september #aj1 #bjai2 7iv7 ,government ,accountability ,office ,report ,information ,technology3 ,federal ,agencies and ,,omb ,need to ,continue to ,improve ,management and ,cybersecurity 7,,gao-#bj-fia,t71 published on ,august #c1 #bjbj2 and 7v7 ,government ,accountability ,office ,report ,do,d ,software ,licenses3 ,better ,guidance and ,plans ,needed to ,ensure ,restrictive ,practices are ,mitigated 7,,gao-#bc-ajfbij71 published on ,september #ab1 #bjbc4 7,c7 ,technological fragmentation ,the isolated development efforts of each agency contribute to a landscape of fragmented technologies that impede interoperability and data exchange between ,federal systems4 7,d7 ,slow adoption of best practices ,the lack of software sharing hinders the diffusion of engineering best practices and innovations across agencies1 whereas learning from the successes and failures of other agencies would accelerate the modernization of government systems4 7,e7 ,security vulnerabilities ,redundant development efforts mean that security weaknesses inadvertently introduced in the software of an agency could go unnoticed by other agencies1 whereas a shared codebase would benefit from collective security auditing and updates4 7,f7 ,public accountability ,software funded by taxpayers should be available for scrutiny by the public to the greatest extent possible1 to ensure transparency and accountability4 7,g7 ,pilot success ,preliminary initiatives aimed at making federally funded custom-developed code freely available to the public have demonstrated the viability and benefits of such sharing schemes1 including-- 7i7 ,memorandum ,m-#af-ba issued by the ,office of ,management and ,budget on ,august #h1 #bjaf1 entitled ,federal ,source ,code ,policy3 ,achieving ,efficiency1 ,transparency1 and ,innovation through ,reusable and ,open ,source ,software2 and 7ii7 ,code4gov1 which documents how agencies already extensively use public repositories1 demonstrating the ability of agencies to share code using existing infrastructure4 7#b7 ,conclusion ,based on the findings in paragraph 7#a71 it is imperative for ,congress to enact legislation that mandates the sharing of custom-developed code across agencies to promote efficiency1 reduce waste1 enhance security1 and foster innovation in the ,federal information technology ecosystem4 7b7 ,purpose ,the overarching aim of this ,act is to maximize efficiency1 minimize duplication1 and enhance security and innovation across ,federal agencies by requiring the sharing of custom-developed code between agencies by-- 7#a7 enabling agencies to benefit mutually from the investments of other agencies in custom-developed code2 7#b7 promoting technological consistency and interoperability among agencies1 thereby facilitating seamless data exchange and system integration2 7#c7 fostering a culture of sharing engineering best practices and successful technological innovations among agencies2 7#d7 enhancing transparency by making federally funded custom-developed code available for public scrutiny1 subject to necessary security considerations2 and 7#e7 leveraging inter-agency collaboration for better security auditing of the shared codebase1 aiming for a more unified and secure technological infrastructure across agencies4 #c4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,custom-developed code ,the term custom-developed code-- 7,a7 means source code that is-- 7i7 produced in the performance of a ,federal contract or is otherwise fully funded by the ,federal ,government2 or 7ii7 developed by a ,federal employee as part of the official duties of the employee2 7,b7 includes-- 7i7 source code1 or segregable portions of source code1 for which the ,federal ,government could obtain unlimited rights under part #bg of the ,federal ,acquisition ,regulation or any relevant supplemental acquisition regulations of an agency2 and 7ii7 source code written for a software project1 module1 plugin1 script1 middleware1 or application programming interface2 and 7,c7 does not include-- 7i7 source code that is solely exploratory or disposable in nature1 including source code written by a developer experimenting with a new language or library2 or 7ii7 commercial off-the-shelf software or configuration scripts for such software4 7#c7 ,federal ,chief ,information ,officer ,the term ,federal ,chief ,information ,officer means the ,administrator of the ,office of ,electronic ,government4 7#d7 ,federal employee ,the term ,federal employee has the meaning given the term employee in section #baje7;a7 of title #e1 ,united ,states ,code4 7#e7 ,metadata ,the term metadata1 with respect to custom-developed code-- 7,a7 has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code2 and 7,b7 includes information on whether the custom-developed code-- 7i7 was produced pursuant to a contract1 and the contract number1 if any2 and 7ii7 is shared in a public or private repository1 and includes a hyperlink to the repository1 as applicable4 7#f7 ,private repository ,the term private repository means a software storage location-- 7,a7 that contains source code1 documentation1 and other files2 and 7,b7 access to which is restricted to authorized users4 7#g7 ,public repository ,the term public repository means a software storage location-- 7,a7 that contains source code1 documentation1 and other files2 and 7,b7 access to which is open to the public4 7#h7 ,software ,the term software has the meaning given the term computer software in section #b4aja of title #dh1 ,code of ,federal ,regulations1 or any successor regulation4 7#i7 ,source code ,the term source code means a collection of computer commands written in a computer programming language that a computer can execute as a piece of software4 #d4 ,software reuse 7a7 ,sharing ,not later than #baj days after the date of enactment of this ,act1 the head of each agency shall ensure that-- 7#a7 the custom-developed code of the agency is contained at not less than #a public or private repository and is accessible to ,federal employees via procedures developed under subsection 7d77#a77;,a77ii77,,iii72 and 7#b7 all software and other key technical components1 including documentation1 data models1 schemas1 metadata1 and architecture designs1 are owned by the agency4 7b7 ,software ,reuse ,rights in ,procurement ,contracts 7#a7 ,in general ,the head of an agency that enters into a contract for the custom development of software shall acquire and enforce rights sufficient to enable the governmentwide access1 execution1 and modification of the custom-developed code relating to the software4 7#b7 ,best practices 7,a7 ,contract administration ,with respect to a contract described in paragraph 7#a71 the head of an agency shall ensure appropriate contract administration and use of best practices to secure the full scope of licenses and rights for the ,federal ,government of the custom-developed code developed under the contract1 to allow for access1 execution1 and modification by other agencies4 7,b7 ,development process ,with respect to a contract described in paragraph 7#a71 the head of an agency shall ensure the use of best practices to require and obtain the delivery of the custom-developed code1 documentation of the custom-developed code1 configuration and artifacts required to develop1 build1 test1 and deploy the custom-developed code1 and other associated materials from the developer throughout the development process4 7c7 ,discovery ,not later than #baj days after the date of enactment of this ,act1 the head of each agency shall make metadata for the custom-developed code of the agency publicly accessible4 7d7 ,accountability mechanisms 7#a7 ,agency ,c,i,os ,not later than #ahj days after the date of enactment of this ,act1 the ,chief ,information ,officer of each agency1 in consultation with the ,chief ,acquisition ,officer1 or similar official1 of the agency and the ,federal ,chief ,information ,officer1 shall develop an agency-wide policy that-- 7,a7 addresses the requirements of this ,act1 including-- 7i7 ensuring that agency custom-developed code follows best practices for operating repositories and version control systems to keep track of changes and to facilitate collaboration among multiple developers2 7ii7 managing the sharing and discovery of source code1 including developing-- 7,i7 procedures to determine whether any custom-developed code meets the conditions for an exemption under this ,act2 7,,ii7 procedures for making metadata for custom-developed code discoverable1 pursuant to section #d7;c72 7,,iii7 procedures for ,federal employees to discover and gain access to private repositories2 7,,iv7 standardized reporting practices across the agency to capture key information relating to a contract for reporting statistics about the contract2 and 7,v7 procedures for updating metadata1 private repositories1 and public repositories on a quarterly basis2 7iii7 identifying points of contact for roles and responsibilities relating to the implementation of this ,act2 and 7iv7 if practicable1 using existing procedures and systems2 and 7,b7 corrects or amends any policies of the agency that are inconsistent with the requirements of this ,act4 7#b7 ,federal ,,cio 7,a7 ,framework for review ,not later than #a year after the date of enactment of this ,act1 the ,federal ,chief ,information ,officer shall establish a framework for reviewing the software being developed across the ,federal ,government to surface and support the goals of existing digital priorities4 7,b7 ,minimum standard reporting requirements ,not later than #abj days after the date of enactment of this ,act1 the ,federal ,,cio shall1 in coordination with the ,director of the ,national ,institute of ,standards and ,technology1 establish minimum standard reporting requirements for the ,chief ,information ,officers of agencies1 which shall include information relating to-- 7i7 measuring the frequency of reuse of code1 including access and modification2 7ii7 whether the shared code is maintained2 7iii7 whether there is a feedback mechanism for improvements to or community development of the shared code2 and 7iv7 the number and circumstances of all exemptions granted under section #e7;b77#b74 7,c7 ,annual report ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,federal ,chief ,information ,officer shall submit to ,congress a report on the status of the implementation of this ,act by each agency1 including-- 7i7 a complete list of all exemptions granted under section #e7;b77#b72 7ii7 a table showing whether each agency has updated the acquisition and other policies of the agency to be compliant with this ,act2 and 7iii7 an evaluation of the compliance of the agency with the framework described in subparagraph 7,a74 #e4 ,scope and applicability 7a7 ,new custom-,developed code only ,this ,act shall apply to custom-developed code that is developed or revised-- 7#a7 by a ,federal employee not less than #ahj days after the date of enactment of this ,act2 or 7#b7 under a contract awarded pursuant to a solicitation issued not less than #ahj days after the date of enactment of this ,act4 7b7 ,exemptions 7#a7 ,automatic ,this ,act shall not apply to classified source code or source code developed primarily for use in a national security system1 as defined in section #aaajc of title #dj1 ,united ,states ,code4 7#b7 ,explanation required 7,a7 ,in general ,the ,chief ,information ,officer of an agency may exempt from the requirements of this ,act any source code for which a limited exemption described in subparagraph 7,b7 applies1 after documenting the limited exemption and providing to the ,federal ,chief ,information ,officer a brief narrative justification1 with redactions as appropriate4 7,b7 ,limited exemptions ,the limited exemptions described in this subparagraph are the following3 7i7 ,the sharing or discovery of the source code is restricted by ,federal law or regulation1 including the ,export ,administration ,regulations1 the ,international ,traffic in ,arms ,regulations1 regulations of the ,transportation ,security ,administration relating to the protection of ,sensitive ,security ,information1 and the ,federal laws and regulations governing classified information4 7ii7 ,the sharing or discovery of the source code would create an identifiable risk to individual privacy4 #f4 ,guidance ,the ,director of the ,office of ,management and ,budget shall issue guidance1 consistent with the purpose of this ,act1 that establishes best practices and uniform procedures across agencies under section #d7;d74 #g4 ,,gao report on information technology practices 7a7 ,initial report ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to ,congress a report that includes an assessment of-- 7#a7 duplicative software procurement across and within agencies1 including estimates of the frequency1 severity1 and dollar value of the duplicative software procurement2 7#b7 barriers to agency use of cloud-based platforms for software development and version control and how to address those barriers2 7#c7 how source code sharing and open-source software collaboration can improve cybersecurity at agencies2 and 7#d7 other relevant matters1 as determined by the ,comptroller ,general of the ,united ,states4 7b7 ,supplemental report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to ,congress a report that includes an assessment of-- 7#a7 the implementation of this ,act2 and 7#b7 other relevant matters1 as determined by the ,comptroller ,general of the ,united ,states4 #h4 ,rule of construction ,nothing in this ,act shall be construed to require the disclosure of information or records that are exempt from public disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act74 #i4 ,no additional funding ,no additional funds are authorized to be appropriated to carry out this ,act4