<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>Hello Friends of CAVO,</div><div><br></div><div>I wanted to give an update on the OSI's discussions with the LA County Registrar-Recorder/County Clerk regarding their "Open-Source Election Technology," Voting Solutions for All People (VSAP). After a few emails with various legal and business offices, I was offered an opportunity to discuss the program with the Registrar's office directly. I spoke with, Aaron Nevarez, Division Manager, Governmental & Legislative Affairs and Kenneth Bennett, Program Manager, Voting Solutions for All People.</div><div><br></div><div><br></div><div><b>TLDR:</b> There is no issue, other than LA County conflating the use of open source software as an internal platform, with the release (distribution) of open source software. I have explained the OSI's issues to them, asked them to modify their communications to recognize this differentiation, and they have agreed. They also invited the OSI to participate in their planning for the release of VSAP (if the choose), in order to ensure they are meeting the expectations of the open source community.</div><div><br></div><div><br></div><div><b>More information:</b> The issue boils down to a (perhaps) naive understanding, but poorly worded, press release which elevated their internal adoption of Open Source Software, in support of their elections system (think infrastructure, or "stack" / "platform") VSAP, with an implication that the VSAP elections system was Open Source Software (i.e. was distributed with an OSI Approved License). VSAP is not Open Source Software, but rather, simply a platform created from aggregating and customizing, 1. other Open Source applications, 2. Open Source components, 3. Open Source libraries, and 3. Open Source infrastructure. As we all know, 1. the label "Open Source Software" should only be applied to software distributed with an OSI Approved License, 2. Open Source licenses only take affect upon distribution (note the exception of the AGPL), and 3. there is no requirement for any organization that only downloads, uses, or modifies Free and Open Source software (never re-distributes or releases derivatives) to make their internally developed and internally deployed software available. Thus as LA County is not distributing modified code, or redistributing Open Source code, there is no obligation for LA County to apply an OSI license (or any license) or make that code available. However, it also means that they should not apply the "Open Source" label to their works while it is an entirely internal implementation.</div><div><br></div><div>Per the OSI FAQ:</div><div><br></div><div style="margin-left: 3ch;"><div>Q. What if I do not want to distribute my program in source code form? Or what if I don't want to distribute it in either source or binary form?</div><div>A. ...if you don't distribute at all, then by definition you're not distributing source code, so you're not distributing anything Open Source. </div><div>- <a href="https://opensource.org/faq#non-distribution">https://opensource.org/faq#non-distribution</a></div></div><div><br></div><div>Per the FSF FAQ:</div><div style="margin-left: 3ch;"><div><br></div><div>Q. If I only make copies of a GPL-covered program and run them, without distributing or conveying them to others, what does the license require of me?</div><div>A. Nothing. The GPL does not place any conditions on this activity.</div><div>- <a href="https://www.gnu.org/licenses/gpl-faq.en.html#NoDistributionRequirements">https://www.gnu.org/licenses/gpl-faq.en.html#NoDistributionRequirements</a></div></div><div style="margin-left: 3ch;"><div><br></div></div><div><br></div><div>While I know there are issues related to government transparency in elections systems for many on this list, and clearly the OSI would recommend Open Source Software to ensure transparency in elections technologies, those issues are outside the scope of authority for the OSI. The issues for the OSi are specific to the language used in the Press Release which implied LA County had developed Open Source Software, for example:</div><div><br></div><ol><li>"Secretary of State Alex Padilla Certifies Los Angeles County’s New Vote Tally System Making it California’s First Certified Open-Source Election Technology" should have read, "[...] Making it California’s First Certified Election Technology Built on Open Source Technologies" </li><li>Today, California Secretary of State Alex Padilla certified Los Angeles County’s Voting Solutions for All People (VSAP) Tally Version 1.0, making it the first publicly-owned, open-source election tally system certified under the California voting systems standards," should read, "[...] making it the first publicly-owned, election tally system certified under the California voting systems standards delivered with open-source software infrastructure."</li></ol><div><br></div><div>In all fairness, after speaking with LA County, the following line from the press release, "Los Angeles County’s VSAP vote tally system is now California’s first certified election system to use open-source technology" could be interpreted to appropriately describe the County's efforts. Although I doubt this, as most software today (96%) includes some sort of open source software (<a href="https://www.helpnetsecurity.com/2018/05/22/open-source-code-security-risk/">https://www.helpnetsecurity.com/2018/05/22/open-source-code-security-risk/</a>).</div><div><br></div><div>Mr. Nevarez and Mr. Bennett also took the time to respond to each of the questions I submitted. My notes are included (please note these are my notes, and they have not been reviewed/approved by Mr. Nevarez or Mr. Bennett):</div><div><br></div><ol><li>What open source license is the VSAP software distributed with? Can you please point me (URL) to the text of that license?</li><li>No license is included as the software is for internal use only. Much of the software used in the development of VSAP, as well as the software infrastructure, is open source. However again, none of this is being released / redistributed. Currently LA County is only a consumer of Free and Open Source Software, i.e. "using an open source stack."</li><li>Where is the current code repository (URL), and the location where the VSAP software can be downloaded (URL)?</li><ol><li>While the County does have a GitHub account for development, it is private.</li></ol><li>Did the VSAP developers build the system from scratch, or was this a derivative work?</li><ol><li>VSAP is built with custom code and also uses third party open source licensed resources.</li></ol><li>Secretary Padilla referenced several benefits of open source, "modernize election administration, security, and transparency", "publicly-owned technology", how were county and state officials introduced to, and educated about, about these benefits and maybe others. (My goal here was to understand how open source was introduced and apparently accepted--with a true understanding or not--in order to help us gain adoption with other government agencies.)</li><ol><li><span style="white-space: pre-wrap;">Mr. Nevarez and Mr. Bennett mentioned s</span>everal state and county initiatives on “new ways to get software certified” with open source technology, They specifically mentioned Senate Bill 360. They also suggested reaching out to the Secretary for more details.</li></ol><li>Is there a community of practice working with you, i.e. a group of open source developers who are contributing to the project? (My interest here was to assess who might be advising them and also if they have been working with experienced open source communities)</li><ol><li>The County currently has an advisory committee called TAC (Technical Advisory Commission), and is working with the local community. The County is also planning on hosting a meeting in January after the elections to discuss how the County may be able to release VSAP and build a community around the project. The OSI was invited to participate with a promise to follow up.</li><li>There was also an interest in engaging with local area communities and experts, SCaLE was mentioned? I offered to suggest other resources as well.</li></ol></ol><div><br></div><div>Generally Mr. Nevarez and Mr. Bennett offered:</div><div><br></div><ul><li>The VSAP implementation was developed as a platform through the use of “open technologies.” There is some concern about releasing VSAP as “open source”, due to security concerns, and they my not fully appreciate the scope of responsibilities (resources) in managing a project. They also recognized they may not fully appreciate how various groups may define "Open Source" and the expectations those groups will have for the use of that term. (I of course highlighted the Open Source Definition as the standard, but acknowledged issues/differences among groups, e.g. around "Free" and "Open")</li><li>The primary goal of the County was to obtain certification from the Secretary of State due to the approaching elections.</li><li>An emphasis was put on meeting security standards. (I offered to introduce the County to OSI contacts at security-focused organizations, e.g. DoD and code.mil).</li><li>The County is Interested in governance models that ensure development meets their needs, but also allows other organizations ro realize benefits from adoption and contribution.</li><li>Bith <span style="white-space: pre-wrap;">Mr. Nevarez and Mr. Bennett highlighted that neither they nor the Country are </span>meaning to be elusive, but they simply are not sure how to create a secure community of practice.</li></ul><div><br></div><div>I hope this helps. I am happy to discuss.</div><div>Patrick</div><div><br></div><div></div><div><br></div><div><span><pre>-- <br></pre><div> || | | || | || || | || | ||| | ||| </div><div><br></div><div>Patrick Masson</div><div>General Manager & Director, Open Source Initiative</div><div>855 El Camino Real, Ste 13A, #270</div><div>Palo Alto, CA 94301</div><div>United States</div><div>Office: (415) 857-5398</div><div>Mobile: (970) 4MASSON</div><div>Freenode: OSIMasson</div><div>Email: <a href="mailto:masson@opensource.org">masson@opensource.org</a></div><div>Website: <a href="http://www.opensource.org"><a href="http://www.opensource.org">www.opensource.org</a></a></div></span></div><div class="-x-evo-signature-wrapper"><span class="-x-evo-signature" id="1475551325.4547.0@patrick-HP-EliteBook-Folio-9470m"><div></div></span></div></body></html>