united-states foia
Does FOIA apply to computer code?
<p>Would a federal government agency be required to comply with a FOIA request for (unclassified) computer source code (specifically for a mobile app)?</p>

<p>If the software is a work of the federal government and not, as is usually the case, a licensed copy of contractor-provided software, <a href="https://www.copyright.gov/title17/92chap1.html#105" rel="nofollow noreferrer">it is most likely in the public domain</a>. There should be records pertaining to the system, including system authorization under the RMF (NIST 800-37 et al). The actual source code would probably be a record, but depending on the nature of the program, may be excluded under some of the various exclusions pertaining to internal processes, national security systems, banking industry confidential info, or exclusions required by other laws, etc. In particular, <a href="https://www.govinfo.gov/content/pkg/USCODE-2019-title44/pdf/USCODE-2019-title44-chap35-subchapII-sec3555.pdf" rel="nofollow noreferrer">44 U.S.C. 3555 (f)</a> may be of interest:</p>
<blockquote>
<p>(f) PROTECTION OF INFORMATION.—Agencies and
evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate
with the risk and comply with all applicable
laws and regulation</p>
</blockquote>
<p>This, under <a href="https://www.foia.gov/faq.html" rel="nofollow noreferrer">FOIA exception 3</a>, authorizes agencies to deny requests which might compromise computer security. One could argue (with strong arguments for and against) that the source code might contain undiscovered/undisclosed errors which could compromise the security of the system while that system is in use.</p>
<p>If you are really interested, as mentioned in earlier comments, your best bet would be to ask. Depending on your interest, you might look for any and all records pertaining to the procurement and development of the system, including source code if available. This might get you information about the contractor who developed the system, for example.</p>

<p><strong>Depends on the state - appears the jury is still out at the federal level.</strong></p>
<p>Take a look at <a href="https://www.rcfp.org/open-government-sections/9-computer-software/" rel="nofollow noreferrer">this page on Reports Committee for Freedom of the Press</a></p>
<p>Some states have explicitly said Software is not a public record like Nevada</p>
<blockquote>
<p>Computer software developed by the government is not a public record, but the computer software may generate public records. The software can generate public records which are deemed to exist so long as computer is already programmed to generate these records.</p>
</blockquote>
<p>Other states say it's not a public record depending on the license like Mississippi</p>
<blockquote>
<p>Software is not public if the license prohibits disclosure and it is a trade secret, or if it is “sensitive” i.e., controls access to exempt information, or security reasons, or information whose disclosure would “require a significant intrusion into the business of a public body.”</p>
</blockquote>
<p>Other states like Montana explicitly say it IS a public record.</p>
<blockquote>
<p>Software and meta-data residing on government computers are subject to public inspection.</p>
</blockquote>
<p>Even the Montana statute just says &quot;residing&quot; on government computers, which doesn't mean you'd be entitled to the source code if they only received a compiled binary.</p>
<p>As for the feds, looks like it was <a href="https://www.justice.gov/oip/blog/foia-update-proposed-electronic-record-foia-principles" rel="nofollow noreferrer">discussed</a> (note it's proposed) but the law wasn't modified.  From this I'm also guessing the justice department wouldn't automatically interpret software as a public record.</p>
<p>The government &quot;makes&quot; very little software.  Even bespoke software for them is handled by contractors and licensed to them, which likely would not make it a public record anyway.</p>

<p>Federal agencies are required to disclose any records, under the Freedom of Information Act, and each agency publishes its regulations. HHS summarizes their regulations, noting that all record must be made available except for 9 exemptions and 3 exclusions. Those records are described <a href="https://www.hhs.gov/foia/exemptions-and-exclusions/index.html" rel="nofollow noreferrer">here</a>. Authorship of the code is irrelevant. State law is irrelevant (federal law trumps state law). The exemptions are (summarily) &quot;classified; personnel; statutory exemption; trade secrets; invasion of personal privacy; stuff about law enforcement; some stuff about regulating financial institutions; geo data about wells. The exclusions are in the realm of criminal investigations. The only imaginable connection between software and an exception (given the premise that the software is not classified) is the &quot;trade secrets&quot; exemption. <a href="https://www.foia.gov/faq.html" rel="nofollow noreferrer">This page</a>, from foia.gov, says more or less the same thing – because the exemptions and exclusions are set by Congress, so the basic requirements are the same across agencies (HHS is clearer, IMO).</p>
<p>The Trade Secret exemption is discussed in more detail <a href="https://www.justice.gov/archives/oip/foia-guide-2004-edition-exemption-4" rel="nofollow noreferrer">here</a>. It is not out of the question, if for example the software implements a nifty algorithm that gives the company a competitive advantage.</p>

<h1>Mostly not needed...</h1>
<p>Works <strong>of</strong> the government are public domain. Work <strong>licensed</strong> by the government is not.</p>
<p>Works of the government however might not be released because they are means of <strong>national security</strong> though. This is why we have the source code for the <a href="https://github.com/chrislgarry/Apollo-11" rel="nofollow noreferrer">Apollo Program</a> but we might neve see the source code for the workings of an ICBM.</p>
