In 2020 the Dutch government adopted the 'open, unless' principle, promoting the use and procurement of open source software, unless impossible. But what happens after such a policy is published? This isn’t as straightforward as we’d think. Within government projects, we still regularly need to answer practical questions such as “are we allowed to build or buy this? Are we allowed or required to publish our code? What do we need security wise? What do our procurement policies say? Where do we put the code? Does code need to be archived like documents? How do we collaborate with other government tenants? And how do we support the open source communities whose code we use?” The ‘open, unless’ principle is clear on paper, but applying it turns out to be more complex.

In this talk, we will look at how the Dutch are putting 'open, unless' into practice inside the Ministry of the Interior (BZK), through the daily work of our Open Source Program Office (OSPO). Instead of focusing on just policy, the focus is on the operational side. Once the choice for open source is made, what challenges arise then? This will be illustrated with concrete project examples. The first is MijnBureau, a sovereign open source workspace for the government, that has been built openly from the start. The second example is the Dutch Government Codeplatform, a shared development environment, based on Forgejo. A third example is OpenKat, a collectively built open source vulnerability scanner. Together we’ll explore how 'open, unless' is applied in a consistent way (spoiler alert: it’s not).

These examples show what “from policy to practice” actually looks like for the public-sector. For instance, many open source projects start bottom-up. How do we ensure proper top-down alignment with national strategies, adequate funding and sponsorship? When a project is done, who is going to manage and maintain it? How do we make sure we don’t take advantage of open source communities?

This talk is aimed at anyone interested in public-sector open source, OSPOs, procurement and policy implementation, or in understanding why “just publish code” is rarely as easy as it sounds, and what we can do to make it easier.