Would a federal government agency be required to comply with a FOIA request for (unclassified) computer source code (specifically for a mobile app)?
2
-
Who wrote the app? The government, or a private entity for the government use?– Ron BeyerCommented Jun 30, 2022 at 3:22
-
@RonBeyer I believe the government wrote it. The app has no copyright information, so I don't know how to tell (that's probably an indication that the government wrote it, since they can't hold copyrights?)– SomeoneCommented Jun 30, 2022 at 3:23
Add a comment
|
4 Answers
If the software is a work of the federal government and not, as is usually the case, a licensed copy of contractor-provided software, it is most likely in the public domain. There should be records pertaining to the system, including system authorization under the RMF (NIST 800-37 et al). The actual source code would probably be a record, but depending on the nature of the program, may be excluded under some of the various exclusions pertaining to internal processes, national security systems, banking industry confidential info, or exclusions required by other laws, etc. In particular, 44 U.S.C. 3555 (f) may be of interest:
(f) PROTECTION OF INFORMATION.—Agencies and evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate with the risk and comply with all applicable laws and regulation
This, under FOIA exception 3, authorizes agencies to deny requests which might compromise computer security. One could argue (with strong arguments for and against) that the source code might contain undiscovered/undisclosed errors which could compromise the security of the system while that system is in use.
If you are really interested, as mentioned in earlier comments, your best bet would be to ask. Depending on your interest, you might look for any and all records pertaining to the procurement and development of the system, including source code if available. This might get you information about the contractor who developed the system, for example.
Depends on the state - appears the jury is still out at the federal level.
Take a look at this page on Reports Committee for Freedom of the Press
Some states have explicitly said Software is not a public record like Nevada
Computer software developed by the government is not a public record, but the computer software may generate public records. The software can generate public records which are deemed to exist so long as computer is already programmed to generate these records.
Other states say it's not a public record depending on the license like Mississippi
Software is not public if the license prohibits disclosure and it is a trade secret, or if it is “sensitive” i.e., controls access to exempt information, or security reasons, or information whose disclosure would “require a significant intrusion into the business of a public body.”
Other states like Montana explicitly say it IS a public record.
Software and meta-data residing on government computers are subject to public inspection.
Even the Montana statute just says "residing" on government computers, which doesn't mean you'd be entitled to the source code if they only received a compiled binary.
As for the feds, looks like it was discussed (note it's proposed) but the law wasn't modified. From this I'm also guessing the justice department wouldn't automatically interpret software as a public record.
The government "makes" very little software. Even bespoke software for them is handled by contractors and licensed to them, which likely would not make it a public record anyway.
answered Jul 6, 2022 at 16:14
-
What about the federal government? The source code I want is a program that the federal government distributes to the public, not one that a state uses.– SomeoneCommented Jul 6, 2022 at 16:21
-
1@Someone - edited slightly. The answer is - it doesn't appear anyone has taken them to court to ask. Commented Jul 6, 2022 at 16:28
-
1@Someone - no. The most they'd do is deny the request. It's not illegal to ask. Commented Jul 6, 2022 at 16:30
-
1@Someone - I highly doubt it. They can charge for hours worked to find the record. If they denied it then they would have worked 0 hours. I do not believe they can charge for reviewing it. Commented Jul 6, 2022 at 16:43
-
1Since the question is about a federal agency, state law is irrelevant.– user6726Commented Jul 11, 2022 at 16:21
Federal agencies are required to disclose any records, under the Freedom of Information Act, and each agency publishes its regulations. HHS summarizes their regulations, noting that all record must be made available except for 9 exemptions and 3 exclusions. Those records are described here. Authorship of the code is irrelevant. State law is irrelevant (federal law trumps state law). The exemptions are (summarily) "classified; personnel; statutory exemption; trade secrets; invasion of personal privacy; stuff about law enforcement; some stuff about regulating financial institutions; geo data about wells. The exclusions are in the realm of criminal investigations. The only imaginable connection between software and an exception (given the premise that the software is not classified) is the "trade secrets" exemption. This page, from foia.gov, says more or less the same thing – because the exemptions and exclusions are set by Congress, so the basic requirements are the same across agencies (HHS is clearer, IMO).
The Trade Secret exemption is discussed in more detail here. It is not out of the question, if for example the software implements a nifty algorithm that gives the company a competitive advantage.
answered Jul 11, 2022 at 16:43
-
-
If the agency has it, it is a record: it is a tangible recordation of information.– user6726Commented Jul 11, 2022 at 17:20
Mostly not needed...
Works of the government are public domain. Work licensed by the government is not.
Works of the government however might not be released because they are means of national security though. This is why we have the source code for the Apollo Program but we might neve see the source code for the workings of an ICBM.
