- Author
- Angela Dixon
- Role
- Managing Director
This post is the first in our Responsible Tech series, in which we explore open source technology and data privacy, security, and sovereignty. Written by our Managing Director, Angela Dixon, this post is aimed at executives who care deeply about delivering citizen and societal outcomes but also understand they have to balance the books.
—
I’ve often warned my team to beware of people like me; the leaders or executives who hold the power of decision making in areas outside their expertise. We may be deeply versed in traditional approaches to strategy and have risen through the ranks due to our level heads, our commitment to real world results, and demonstration of returns on investment. What we know is useful and important, but it is what we don’t know that creates risk in the organisations we serve.
No one can be an expert in everything and that’s ok. But for decisions about complex problems that exist within even more complex systems with evolving and uncertain variables, if we (and others) don’t recognise our knowledge gaps and limitations, then we risk the outcomes we are working for.
The technology choices made for public services are of critical importance. These decisions intrinsically contain the power for improving lives and the potential to cause significant harm. Any executive who makes decisions over which technology is to be deployed in the service of the public good has the responsibility to hold a good enough understanding of what effective and reliable technology looks like and be open to listening and asking the right questions of the experts.
The benefits of open and reusable source code
UK Government Service Standard 12, the standard used to define what “good” looks like for digital public services, states ‘Make new source code open’. All new source code should be open and reusable and if this is not possible, a convincing explanation should be provided. Deviation from the use of open-by-default is the exception, not the rule. But why is this important?
- Open source code can be reused by developers working in government, avoiding duplication of work and reducing costs
- Publishing source code under an open licence means that you’re less likely to get locked in to working with a single supplier.
The Technology Code of Practice has also shared guidance on the open source preference for software advising public services to be open and use open source to improve ‘transparency, flexibility, and accountability.’
Commercial software suppliers vs open source
Open source software shared and reused across Government creates the opportunity for large financial savings and maintains the balance of power with the commercial software market. Whether software is built and maintained in-house or outsourced to a supplier, if it is the product of public spend, then it should be built to be reused and shared.
Commercial software suppliers may try to prevent this as it will erode their profit margins. However, there is a negotiation to be had if public authorities worked together to address the balance of power. MHCLG has undertaken work to develop their understanding of the local government software market and address common concerns about poor interoperability between systems, lack of transparency in pricing, limited competition and choice, and difficulties with migration and implementation. There will hopefully follow heightened expectations for more suppliers that are paid by the public purse to be open by default.
“If it is the product of public spend, then it should be built to be reused and shared”
There are already private-public sector partnerships that exist to maintain open source software for the public sector. These operating models balance the paying of sensible wages to the private suppliers (who accept they will not become rich out of public funds) with having a sustainable model for implementation, development and maintenance of public sector open source software. For example, LocalGovDrupal, an initiative originally funded by the Local Digital Fund, is now governed by a cooperative model to sustain and develop its open source web publishing platform for councils. SocietyWorks represents another sustainable model: a social enterprise that develops and runs citizen-centred, flexible, open source software for local government and other public bodies. Phil Rumens, Principal Technologist for GDS Local posted that “Open‑source products can deliver significant value for local government, but adoption is often held back by risk and uncertainty, not a lack of options.”
Open source software is designed to be publicly accessible which means it can be seen, modified and reused. While originally intended for distributed communities to contribute and develop together, this does not mean that it is at risk of any member of the public changing live code. People outside of public authorities may voluntarily submit suggested improvements or bug fixes, and there should be processes baked in for review before accepting any new code or changes to the live sites.
Reducing risk with open code
The NHS created an outcry when it reversed its long-standing open source policy citing cyber security and hacking fears, specifically the ability of advanced AI models like Mythos to spot vulnerabilities. The Government Digital Service and DSIT promptly responded by publishing guidance on AI, open code and vulnerability risk in the public sector. The guidance emphasises that “the primary driver of exploitation risk is the presence of weaknesses in systems – including unpatched vulnerabilities, insecure implementation, and unsafe configuration or deployment – and the inability to remediate them quickly” and that publishing open source code reduces those risks. Open code is a strength, not a vulnerability.
With the power and availability of AI-assisted software analysis moving at pace, doubling down on robust secure-by-design architecture and implementation, deployment, configuration, dependency hygiene and access control is the pragmatists approach to secure public service software. Embedding secure-by-design principles to software development and maintenance at the outset and throughout the service lifecycle is how the public sector will also continue to benefit from reuse and transparent delivery, as well as avoid the duplication of builds, costs and vendor lock-in.
Open source software provides “the freedom to keep the repair path open after the original author is gone”. This is critical for infrastructure sustainability and succession planning. Access to legacy or proprietary closed code, that which the majority of technology vendors provide to the public sector at high cost, can be lost if an authority ends a contract. Open source software avoids vendor lock-in as a public authority may switch vendors to continue developing or maintaining the software and are equally free to bring this in house. This is the strategic move for the pragmatists undertaking sustainable infrastructure planning.
—
Connect with Angela on LinkedIn to chat more about open source software.
—
Image: Alice C via Pexels