On December 23, 2024, President Biden signed the Source Code Harmonization and Reuse in Information Technology Act (“SHARE IT Act” or “the Act”), which provides a formal mechanism for federal agencies to store and share custom-developed source code across the federal government by storing it in private or publicly accessible repositories. The Act applies to source code for noncommercial software that is developed exclusively with government funding, while commercial software and commercial off-the-shelf (COTS) software are expressly exempt from the Act’s requirements.
Under the standard data rights clauses of the Federal Acquisition Regulation (FAR) and Department of Defense FAR Supplement (DFARS), the government generally obtains “unlimited rights” in noncommercial software first produced in the performance of a government contract (in the language of the FAR) or developed exclusively with government funds (in the language of the DFARS). These rights permit the government to use, reproduce, and disclose the software and related data freely, and permit others to do all of the same, including by distributing copies to the public and performing or displaying the software and data publicly (with a limited exception for copyrighted computer software). Notably, though, these unlimited rights are limited to usage rights, and do not include a right to delivery of software or any particular software code; those rights must be specified separately in the contract.
The SHARE IT Act signals a policy shift toward maximizing the government’s benefit from its unlimited rights by directing agencies to take steps to secure delivery of unlimited rights source code and share that code across the federal government. As discussed above, the Act’s directive applies to source code produced in the performance of a contract with an agency or otherwise exclusively funded by the government. The Act expressly includes both source code for which the government “could obtain unlimited rights” and source code written for a software project, module, plugin, script, middleware, or application programming interface.
To enable governmentwide access to source code, the SHARE IT Act requires agencies to store such source code in public repositories or private repositories accessible to authorized users within the government. If source code is stored in public repositories, the public will be free to access that source code. The SHARE IT Act leaves to the agencies the task of establishing guidance or criteria for determining when source code should be privately versus publicly stored. As public records, such source code may be subject to Freedom of Information Act (FOIA) requests, but the SHARE IT Act clarifies that it should not be construed as requiring disclosure of otherwise exempt information, and all standard exemptions to FOIA, including trade secrets and confidential commercial information, will still apply.
The SHARE IT Act will not be implemented immediately; it applies to source code that is developed or revised under a contract awarded pursuant to a solicitation issued more than 180 days after enactment (i.e., on or after June 21, 2025), and FAR revisions necessary to implement the Act must be implemented within one year of the Act’s passage (i.e., by December 23, 2025, if timely). While the FAR Council begins developing new regulations pursuant to the SHARE IT Act, contractors should expect that any source code they develop specifically for government agencies in the future will be subject to the Act, and readily shared among agencies. Although this is currently the right of the government under the unlimited rights FAR and DFARS provisions, the implementation of a formal mechanism for exchange of source code all but guarantees significant and more widespread sharing within the federal government. Procurement strategies and negotiations should take this into account.
Thomas Lee, an associate in our Washington, D.C. office, contributed to the writing of this article.
[View source.]
