It’s fair to say that most governments don’t choose to use open source by default. Despite efforts over the past two decades to make open source solutions a viable, or even default solution in government, there's still a lot of skepticism. Those in decision making positions often raise concerns around security and reliability compared to proprietary software that is viewed as being “safe” even if it is more expensive and less flexible in many cases.

So what should an open source government look like? And why would we want one?

To answer these questions, we are joined by Aaron Snow, Faculty Fellow, and former Acting Executive Director for the Georgetown University Beeck Center for Social Impact and Innovation in Washington DC. Prior to his work at the Beeck Center, Aaron was a US Presidential Innovation Fellow and was subsequently one of the co-founders, and then later Executive Director of 18F, the US government’s in-house technology and design consultancy. In 2018 he moved north of the border and became the first CEO of the Government of Canada’s Canadian Digital Service. And has twice been named one of the “World’s 100 Most Influential People in Digital Government" by Apolitical.

In our conversation, we talk about why our current approach to technology actually makes government less transparent, and how open source in government might be a moral imperative. If government is creating or procuring software using taxpayer’s money--something that has been in the news with the investigation into the ArriveCan app in Canada--shouldn't government have a requirement to share that code back with the public since it is the public who “owns” it? And how do we ensure that leaders in government know enough about technology to make good decisions about how it is used?

Watch on YouTube

https://www.youtube.com/watch?v=2ZJEuTgFK6M

Related Links

• Digital Service Network
• Aaron Snow's Website
• Georgetown University Beeck Center for Social Innovation and Impact
• Auditor-General to report Monday on how cost of ArriveCan app grew from $80,000 to more than $54-million (Globe and Mail)

Chapters

00:00 Introduction

04:41 Interview with Aaron Snow

06:13 The Security Aspect of Open Source

07:46 The Unrealized Promise of Open Source in Government

13:15 The Need for Strong Political Leadership in Digital Government

24:03 Modular, Reusable Components in Government

32:03 Conclusion

Ryan 0:05

Ryan 4:42

Aaron, welcome to Let's Think Digital.

Aaron Snow 4:44

Ryan

Ryan 4:45

Again! Aaron was actually, for listeners of the show, Aaron did a brief cameo appearance if I can put it that way from the back of a bus in Dubai when we were there for the World Government Summit in February. We had a short little chat, but I'm thrilled Aaron is here at the Forward50 conference in Ottawa. And we get a chance to connect again in person and talk live and have a little bit of a further in depth conversation. So thanks so much for being here, Aaron.

Aaron Snow 5:08

Thanks for having me.

Ryan 5:10

So Aaron, you know, has a long history in what I'll call the digital government movement, we actually I think first met on a phone call when you are at 18F leading the US government's, or one of the US government's digital team. Got to know each other when you came to Canada to lead the Canadian Digital Service and be its first CEO. And now you have left government, you're back in the States, and you're a fellow at the Beeck Center at Georgetown University. So I think you've got a really unique perspective on digital government from a few different vantage points. At Forward50, at the conference here this week, you were talking about how to open source government services. So I'm really curious if maybe you want to give a little bit of kind of a summary of what that means, and what you think the opportunity is in that space.

Aaron Snow 5:54

Sure. Thanks for having me. So for as long as I've been doing this work, and surely before I started doing this work at all, folks have been talking about the promise of open source software as a part of how to make government better in any number of ways. We talk about transparency, we talk about, about using open source to ensure that that there, that government doesn't get locked into long term situations with closed source from vendors, that leaves them incapable of changing or swapping out or updating without it being prohibitively expensive. We talk about the you know, the security of open source systems. There are any number of reasons why open source software in the government service delivery context makes a lot of sense.

Ryan 6:49

And I want to clarify one of these things, because the security piece I find is actually this piece that trips people up a lot of times, where there's this kind of default assumption that open source is less secure than proprietary systems. Just if you want to take a minute to talk about that, cause I think it's useful for the listeners, you know, I think the argument is an open source actually, perhaps paradoxically, for some folks is more secure.

Aaron Snow 7:10

Closed source software is only more secure than open source, if you believe in security through obscurity, right. And certainly there are aspects of any system that aren't meant to be public. But, but by and large, open source systems undergo more scrutiny, knowing- developers knowing that their code is going to be open source forces them to think more carefully about how they write their code.

Ryan 7:35

Right, they got to share their homework, yeah.

Aaron Snow 7:36

That's right. It is more auditable. And I think, I think there's, there's a fair amount of writing out there about the virtues of open source in the security context. All of this is, is, in my, in my view, there's a fair amount of unrealized promise. Because as it stands, most of governments, most of the time, are not using open source. There- though let me be clear, they're often using open source, either without knowing it or without acknowledging it, because almost everything that is built by almost every one, closed or open, is being built, at least on part, in part on open source components. You know, whether its whole operating systems like Linux, and BSD, whether it's Apache systems, whether it's, there are any number of components out there that folks are using. But that doesn't make the systems themselves transparent and open in the end. And so we're not just talking about building on top of open source, but it's still in a closed way, we're talking about the systems themselves actually being open for that kind of auditability, scrutiny that the public should have and deserves, I think, especially when you're spending public tax dollars on the systems. So the conversation we want to have this afternoon is about that promise, and the reality that so little of government is actually, you know, open that way, and why. So what what has happened such that, you know, we continue not to use those solutions, for the most part, we don't go in that direction. You know, is it, is it the fear and the uncertainty and the doubt about security or about reliability? Is it, is it we just have never done it that way, so we keep not doing it that way? Are there other reasons? And, you know, are there policy and regulatory reasons here in Canada? There, there, there, there's some reg that that makes it difficult.

Ryan 9:38

Are there regs in Canada that you think make it uniquely difficult in Canada compared to the US or other jurisdictions?

Aaron Snow 9:44

No, I don't think it's uniquely difficult. I just I think that it's especially when you're procuring a lot of your solutions. Both regulations and contracts, including some, often contracts that aren't visible to the public, have terms in them that make it very difficult.

Yep. That makes a lot of sense. And, you know, I've also often thought too on the flip side, you know, when government is developing software in house, in my mind, there's almost like a moral responsibility to publish that code as open source, right? I mean, Canadian Digital Service, that was very much part of the practice. You know, you go on GitHub, there's a big GitHub repo with all of CDS' project, GDS in the UK, you know, Ontario Digital Service in Ontario, lots of examples of this. But that's the exception, not the rule. Right, in terms of government sharing its own code base out to the world.

Yeah. So one of the, one of the bits of the conversation I hope we'll get to this afternoon is does it require a regular, a law? Do we need to say in a law that that code that's developed for government and or by government should need to by default, be open unless, you know, specific conditions?

I love that.

Certainly, certainly, there's plenty of opportunity. And, but but just recognize that, you know, without that, open source is at best a second class policy citizen right now, it's a recommendation in, in government, sometimes. In the US government, and in the Government of Canada there are certain nods in policy and guidance toward open source. But you know, when that brushes up against or nud-, or bumps up against other priorities, policy priorities, and implementation priorities and budget and deadline priorities, and procurement priorities, it gets relegated so, you know, in the scheme of things, if it's simpler and easier to do what the vendor is asking, and the vendor is asking you to buy their software, which is closed source. There needs to be an incentive inside government to saying no, I want an open source solution. You know, that's going to take me a little, you know, it might take me some extra work on the government side to do that. And I might have to go a couple rounds with, you know, vendors to convince them that that needs to be part of this. So you know, and so the part of this is, you know, how to incentivize the Gov tech market to, you know, to offer up solutions that are open? And some of it is, you know, okay, so what, those incentives, where do they come from? Well, they have to come from government, unless they're coming from, you know, oversight inside or outside government.

And it makes me think, I mean, there is precedent for this, right? Like, I think back to, you know, 15 plus years ago, when the Patriot Act came up in the States, there was a whole lot of discussion around kind of cybersecurity, when it came to like data centers, and in Canada, whether we had data centers in Canada or in US and kind of the off prem on prem. And I think there's a very big debate about whether our kind of rules around you know, where data is hosted makes sense. But government had rules that said, we had to, for any kind of secure information, have it in Canada, companies responded by building Canadian data centers, right? And that notion of kind of using laws or regulations to shift the marketplace. So maybe to shift gears I want, I wanted to talk a little bit about, you know, your experience leading the Canadian Digital Service, you know, you lead 18F in the US as well, you've seen that comparative experience. And I think, you know, my, give you a little bit of my kind of thesis statement here on this, my hypothesis is, you know, the last decade kind of 2010-2020 in that period, you know, it was the rise of GDS, we saw these digital government teams being built around the world, right, there was a lot of excitement about the possibility around that. And I kind of feel like we've moved globally into a bit of a lull now, where it's like, the shininess of that approach has kind of worn off a bit, there's been some successes, some things maybe not as successful. And I get the sense anyways, and certainly here in Canada, I kind of feel like we're stuck in the mud a little bit where it's kind of like, we know where we want to go. But we seem to not quite be able to get there. And and I'm curious, your perspective, you know, kind of having worked here, but also working globally, do you think that's a fair assessment? Or do you think there's more cause for optimism that I'm maybe leading on around that?

I mean, yes and no, I do think it's fair to say that... well, looking back over my time at 18F, and my time with the Canadian Digital Service, I think, I think there are very few political leaders with enough understanding of this, of why it's important of the size of the prize. And and, you know, relative to other priorities, being willing to spend, small p political capital internally to government to make the kind of changes that result in the stuff that Tom was talking about this morning in terms of like, you know, moving government to a place where small fast feedback loops, to ensure that we are meeting users needs are, you know, is at the center of how we do our work.

Right.

I think, ultimately, you know, so the easy part is convincing anyone, politician and executive, anyone that that's important, that we should, you know, be testing our, our work with the people who are affected by it and making sure that it's doing what we want it to do what they need it to do. That's the easy part. The hard part is how to get there in a thicket of, you know, how budgets work in government, how regulation is in place in government, how people are hired and organized in government, as you've talked about over and over, in terms of structures and incentives, and all the rest. All, and how, and how initiatives are communicated from government to the public. All of that pushes toward a level of predictability and a level of you know, of plan and announce first then do... that is, you know, difficult to overcome. It's not, not, not impossible, obviously, governments that do it, many governments that do it. But, you know, we've got, we've got layers to go through.

But it's, and I'm glad you picked up on the political leadership point, because it's something I've been thinking about a lot, too. And I would share your assessment that again, certainly in Canada, but I think this is true in other countries, we have not had strong political leadership on this issue, I think, I think politicians are feeling the effects of public service capacity not being there to deliver on digital, but I'm not sure there's kind of an articulation of what those challenges are. And you know, and I wonder, actually, to be honest, this is, you know, a bit more of kind of a meta question. But, you know, our political leaders in general, I think this is true both in the US and Canada and a lot of Western democracies tend to be less kind of specialists on government than they used to be, we used to have kind of longer tenures in the political sphere, where people kind of deeply understood the machinery of government, I think we have less of that now. And I think, to your point, you know, if you've got a politician coming in to portfolio for a couple of years maybe, before they get shuffled, it's tough for them to like, understand the depth of how the machinery works, to really know how to be able to move it.

So. And this is actually what I was going to try to get out earlier too. Technology is part of the machinery of government. When we talk about MOG, we talk about organization, we talk about hierarchy, we talk about authorities. The fact of the matter is, you know, if you roll back to a pre-digital state, in any of these, any service delivery context. You know, when the service was being delivered via human interaction, papers, envelopes, stamps, pens, you know, even printers, folders, file cabinets, etc, when that those were the the technologies in use, all of that was incredibly transparent, for the most part, except for the stuff that might happen in a backroom, in government office, you know, you can get a pretty good picture of how exactly decisions are being made, who's making them, etc, etc. Technology, and especially close technology has hidden away much of that. And to Jen's point earlier yesterday, sometimes, you know, sometimes that IT is also hiding the ambiguity, or people are making decisions about what the ambiguity means, because they're the ones stuck with an implementation, and a deadline, and a budget and no access to the policy and lawmakers who, whose intentions they're attempting to interpret. And so IT has made, I think, has made government less transparent, in a lot of ways.

Which is paradoxical, right? Because if you go, if you rewind back to 15 years ago, the government 2.0 movement, there was this whole hope that you know, social media, online networks, things like wikis, open data, would make government more transparent. And I don't disagree with you. I think a lot of people today kind of say that, like the optimism maybe we had about that back then hasn't come to fruition.

Well, and I think it mirrors the optimism back then about the private sector world of technology and the internet.

Right.

And what's happening today, as increasingly, there is capture and more and more, you know, attempts to capture that value to garden, you know, to wall, wall things off. Yeah. That's, that's happening in both sectors, in government I think, you know, we have the tools at our disposal in a different way to, to reverse course on that. I think, honestly, it's much harder in the private sector to reverse course, you have arguments about regulation of capitalism and all the rest. But in government, I think, you know, we can get there and I think in part we can get there because there are there are positive examples out there. And if we, if we can put aside our instincts to exceptionalism, oh, it's different here, it's harder here, you know, we have different set of parts. In the end, there are some lessons we can learn from places that are being more transparent. And, you know, again, they're few and far between. And those examples come and go as governments get more and less supportive of this sort of thing. But I think, as a, as a cohort of people who, who work in in this particular space, I think it's incumbent upon us to, to make the effort. Not, you know, if we're user centered, but, but opaque, how user-centered are we really being?

Right?

In the end, where by user-centered I mean, you know, the, the polity center, the public centered.

Yeah, yeah. It's, I think there's a number of fascinating issues there to unpack and, and so this is some of the work that you're doing in a sense now. I mean, you are now in this new vantage point, you've left government, at least for now, until you get roped back in at some point, maybe who knows. But the last couple of years now, you've been at Georgetown University with the Beeck Center, maybe talk a little bit about the work you're doing there? Because I think, you know, I think there's a really interesting kind of catalytic role. You know, you were talking about this notion of getting away from exceptionalism trying to share, you know, some of the things we know that works, and certainly from what I see, that seems to be part of the mission of the work you're doing at the Beeck Center.

Yeah, yeah. So the mission of the Beeck Center is to create positive social change through tech, data design policy. The projects that I've worked on at the Beeck Center include something called the Digital Service Network, which the largest circle of which is a network of hundreds and hundreds of public servants and people interested in the role of digital in public service. The smaller, smaller combinations, which include a little sub-network of people interested specifically in user experience issues in government and other sub network of folks who run 18F and CDS style organizations at the state and provincial and local levels throughout North America. Which, you know, is often, like, you know, one part mutual support one part therapy, the digital service network is also developing a library of useful resources for folks in this space. I will plug digitalservicenetwork.org.

We'll put that in the notes for people to follow up on.

I've also worked on a project called the intergovernmental software collaborative at the Beeck Center, and more of my attention is, is, is a little bit in this direction. Now that that project began as a, an attempt to, to push the idea that by default, similar jurisdictions, whether it be states or provinces, or municipalities or counties, when they have very similar software, slash government service delivery problems, they should work together on solutions rather than all going their separate ways and solving those problems independently. And so there's the, the ISC project, over its years has done a bunch of research on existing inter-state and inter-governmental collaboration, and how that works, how the governance of those things works, how the funding works, you know, what kind of results they've gotten, because sometimes it works and sometimes it absolutely doesn't. With an eye toward making things better across the board. And that's where some of my energy and attention is focused right now. Just, just started a project with the National Association of State Workforce Agencies and the Department of Labor in the US to help states with their unemployment insurance system, what you'd call employment insurance up there. You know, what you call EI, we call UI. And, and part of that effort is going to be to try to map out what a canonical UI system looks like, what the core components of it should be, and then to try to bring the states together to some agreement about you know, the the core formats, the core API's, the core data structures, and all the rest so that so that we can help, so they can help themselves with that. In terms of what good look-, you know, can we, do you want to build off of a codebase that, you know, that is a reference implementation, do you want to take this to vendors and say, Hey, we want something that matches up with this or that built on this to help states in the buying?

Yeah, I mean, it's amazing. It makes me, you know, makes me think back again, to like 15 years ago, that early gov 2.0 phase, people like Tim O'Reilly, who were talking about government as a platform, right. And this very much fits into that government as a platform kind of vision. Which again, I think has not been realized to the degree that people would want to. But there's surreal potential magic that could happen there. You know?

One of the things that I'm hoping is that, you know, if there are projects like this UI project, like the work that just Khan and some other folks have done with Medicare Services in the states or, and some other work that looks a little like this, you know, one of the things we all know is that as you look across those systems, you're going to find that there are some just common components, which are your government platform systems, right, your notifies and your logins and your web design systems and what have you. And I do think that like, this is one area where the US and Canada are both behind a lot of their friends and peers of all sizes and shapes around the world, that have built out more robust government platforms that serve, you know, that sort of their citizens, I think, I think you can't have that conversation without talking about X-Road and Estonia, you know, dozen or more countries and jurisdictions that have adopted X-Road in one form or another, you can't have a conversation without talking about Ukraine and what they've done with their DIIA app, and that stack. And as more of this, there are, there's an increasing number of organizations out there internationally, that are getting their hands around all this, some of the conversation is now using phrases like digital public goods, which includes, but it's not limited to the stuff we're talking about here. You know, there, there's gov stack. There's the Nordic initiative, I can't remember, the NIIS is the the acronym that, that sort of stewards, the X-Road code, there's digitality now, which is the steward for DIIA and for some other code coming home of Poland. And anyway, there are these organizations and of course, the foundation for the code. Full disclosure, I'm a board member of the North America Branch of Funding for Public Code, finding more and more ways for jurisdictions to learn from each other. And, and work in this space. And tomorrow, in fact, Gates and UNDP, and a couple other organizations that the names which are slipping my mind, are launching this 50, 50 in 5 initiative to try to get more countries over the next five years to adopt some reusable, reused open solutions that they're sharing with each other.

Wow.

So there's a lot of motion out there. I think not, not enough of it on the side of the Atlantic.

And do you think part of that is because of our kind of federated systems of government in Canada and the US? I mean, you and I were talking about this a little bit when we were in Dubai together kind of on the sidelines, and like to what degree does the structure of the government impact our ability to move or how much of it is more kind of cultural, if I can put it that way, in nature?

There's definitely some of that. So, you know, governments of all sizes are heading this way, Estonia is a country of 1 million, and people can look at Estonia, well, they had special circumstances, they weren't a Brownfield, they were a Greenfield, etcetera, etcetera. But, you know, India with its well more than a billion people has also done incredible things in the, you know, with open source, including, you know, just with one example, the digital vaccine certificate that they were able to stand up in a matter of weeks, because they had the platform components already there from the eGov Foundation, and, and then that system was adopted by other countries around the world, in short order. So, it happens in countries of all sizes. Now, the Federation of Canada, and the US is a difficulty, but it's, it really just pushes the problem down, right? So, you know, in the, in the US, we have 50 states and, you know, 10s of 1000s of government, and each of them needs to undergo a digital transformation. And, you know, the smaller ones have a different set of constraints and incentives, and the larger ones, too. They each have a different set of problems, yeah, I think. So, in our work at the Beeck Center we have focused quite a bit in recent years on the states, because that's a layer of government where there is not has not been as much, you know, nonprofit world attention aid to how to help them as there is say to the federal government, federal programs where, in theory, you can, you know, you know, spike the ball once and make a big difference. But states are where, you know, where a ton of service delivery happens including a ton of service delivery of federal programs that are by law, state and state administered.

Yeah.

The same thing is true in Canada, where you know, you've got, you know, provinces and territories each have to undergo their own change to work in it, you know, in a technology driven digital world, and, and have varying levels of sophistication in house at the moment about it and various levels of intentionality and, and priority about that sort of thing, so, yeah.

But, but almost that, that fractured nature in these countries makes the notion of having modular reusable types of components, all that more of a pressing case, right? In terms of the potential benefits.

There's definitely a, okay, who's going to get... so in my mind, if, if you accept the hypothesis that there are these common components that would be useful to, to all. And if they existed, then those jurisdictions, at least some of them would use them, and get the benefits of using them, rather than going their own, on their own for everything. Then, then the question is, alright, so how do you bootstrap the process of getting those things up and running and out into the open, whether it's code, whether it's designed, whether it's actual SAS services out there? And paths, you know, where do you start? So, do you know, do you start by finding, you know, there's a chicken and egg thing of alright well, I'll invest in it if it's going to be useful. But, you know, until then, I'm going to wait. And in the meantime, like, there's no, there's no, there's no resources to create things that would be useful that you'd want to invest out. So it's something you know, somehow we've got to figure out a way to make that core investment, knowing that it's an experiment, right. It's a bet that may or may not pay off. But the potential benefits I think, are vast.

Yep. Well, I agree. And I am excited and heartened to know that you were working on this problem to break the chicken and egg paradox. Aaron, thanks so much for spending some time talking with us today. This was great, great to hear about the work you're doing and your perspective, as always, and I look forward to having you on the podcast in the future again.

Always great to be here, Ryan.

Thank you. The chicken and egg paradox, it seems to be a good framing for the challenge with open source software in government. Common components that can be shared across government departments or across jurisdictions seem like a no brainer and a potential win-win for governments and taxpayers alike. But who's going to move first and put their money where their mouth is when it comes to open source in the public sector? As we've talked about before on the podcast, it's always easier to do things that have been done before, even if a new approach might have significant benefits. The good news, as we talked about with Aaron, is that there are people actively working on this problem. And hopefully, we'll be able to help break the cycle that makes it so hard for governments to take advantage of open source solutions. And that's the show for this week. Tell us what you think. Do you agree with Aaron that we need more open source software in government? Do you think that government transparency has gotten worse in the digital era and can open source be a way to address this? If you're watching on YouTube, tell us in the comments below. You can also email us at podcast@thinkdigital.ca or use the #letsthinkdigital on social media. And while you're at it, make sure to like and subscribe. And if you're listening to us on your favorite podcast app and you liked this episode, be sure to give us a five star review afterwards. And remember to go to letsthinkdigital.ca and sign up for our newsletter to catch up on past episodes of the podcast. Today's episode of Let's Think Digital was produced by myself, Wayne Chu and Aislinn Bornais. Thanks so much for listening. And let's keep thinking digital.