I attended an excellent talk last night about GCPedia that was presented by Jeff Braybrook, Deputy Chief Technology Officer for Canada at a Third Tuesday Ottawa Gathering. It was excellent to hear more about the history of the adoption of the open source tool Mediawiki within the Government of Canada. Jeff described Canada's CTO office as being "Hawkish about open source", and wanting to use it as much as possible. At a time when procurement officers and IT departments are still questioning whether or not open source can be used within government, this was great news.

His view that wiki's would become as integrated in the government workplace as the phone and email were very refreshing too. Grabbing notes off of Joseph Thornley's Tweet, "Jeff Braybrook wants to open source not just because it is cheap - but also for its mentality: participation; cooperation; standards." Doug wrote up a detailed post about the event here in his blog.

After writing this post I've been sent a number of interesting links that I thought were very important to point out. The US Department of Defense has set up a Forge.mil project to promote open source development within the US military. When looking at procurement of open source within the government, we really have to look at Europe. Three really solid sites that the Canadian government should be looking towards are previously OSOR.eu - supporting and encouraging the re-use of publicly-financed Open Source Software developments, FLOSSPOLS - Free/Libre/Open Source Software: Policy Support, and Public Sector OSS - the European Commission's DG Information Society and Media

On a related note, a client of ours pointed us to the MERX listing that PWGSC added to gather information on how to obtain open source in Government. I'm not sure how many people will see it, as lots of open source folks don't use MERX, but do have an interest in seeing the government apply this well (even just as tax payers). I pulled the relevant questions out of the 7 page PDF and created a simpler questionnaire about government adoption of no charge licensed software. There is also a wiki response that folks can contribute to.

There's an Appendix to this document that I'd also like to see feedback on. Please address comments on this Appendix directly to this post.

Appendix B – DRAFT Guidelines - Decision Process for acquiring 
No Charge Licensed Software 

Draft proposed Process description 

The process begins with a request from an application delivery 
group or end user to use a particular piece of software. 
Depending on the nature of the acquisition (specifically, 
whether or not the acquisition involves a cost greater than $0), 
the process proceeds either through a conventional procurement 
workflow (not detailed here) or through the "No Charge" 
acquisition process. 

The No Charge process consists of five concurrent streams of 
activity, each of which is critical to the successful 
acquisition, management and integration of the software within 
the GC or departmental environment. 
These five streams consist of the following:

1. Architectural Review and Approval – This involves the 
applicable Enterprise Architecture group reviewing the product 
to ensure that it: 
- Is appropriate for the use specified in the request 
- Works well within the technical environment 
- Does not violate or overlap with any existing standards.

2. Financial Risk Assessment – Per Treasury Board Secretariat 
direction, the use of No Charge Software (particularly Free and 
OPEN SOURCE Software) requires the completion of a financial 
risk assessment. The financial risk assessment must consider the 
risk exposure per year against the financial benefit. Depending 
on the level of risk involved, approval of the risk assessment 
will be required by: 
-The applicable Senior Financial Officer or delegate – for 
substantive risk 
-The business owner of the impacted or system – where risk is 
non-substantive

3. Justification of No Charge Acquisition - A Procurement 
Officer must review the justification for acquisition of No 
Charge Software, for clarification and as due diligence for the 
validity of reasons and that they will stand possible future 
scrutiny.

4. Investigation of Security Risks – Given the potentially 
heightened security risk of downloadable No Charge Software, the 
appropriate IT Security Officer must investigate and approve No 
Charge Software before it is approved for use. In particular, 
the security assessment will assure that the product does not 
contain viruses, malware or other means for an attacker to 
compromise the GC or departmental environment.

5 Software License Review – Due to the diverse nature of license 
models associated with No Charge Software, a review must be 
conducted to identify potential legal/policy impediments for the 
GC in agreeing to a particular license agreement. The intent is 
to accumulate a list of acceptable licenses (including popular 
ones such as GPL, LGPL, Apache etc.) so that a particular 
license model would only have to be examined once across the 
entire GC. 

Some of the most significant legal/policy concerns would 
include: 
- No warranty or limitation of liability, the imposition of 
flow-through obligations to 3rd parties, and obligations that the 
Crown indemnify licensors or 3rd parties. 
- ownership of data manipulated/stored with the product 
- limitations on the use of the product conflicting with GC or 
departmental intent 
-instances where the Government of Canada could be obliged to 
pay the creator.

If all five approvals are received, then the software can be 
installed on the appropriate environment(s), be they servers or 
desktops. The same change management and deployment processes 
apply as to software that has been acquired through conventional 
procurement.