102 lines
4.5 KiB
HTML
102 lines
4.5 KiB
HTML
<?xml version="1.0" encoding="utf-8"?>
|
||
<html newsdate="2026-05-04">
|
||
<version>1</version>
|
||
|
||
<head>
|
||
<title>FSFE: NHS England should not hide public code behind closed doors</title>
|
||
</head>
|
||
|
||
<body>
|
||
|
||
<h1>FSFE: NHS England should not hide public code behind closed doors</h1>
|
||
<figure>
|
||
<img src="https://pics.fsfe.org/uploads/medium/1b/d9/d996b92ce2dc7513cce6b6ae939b.png" alt="FSFE Press Release picture"/>
|
||
|
||
</figure>
|
||
|
||
<p>England’s National Health Service (NHS England) is preparing to make
|
||
most of its public source code repositories private by default,
|
||
according to recent reports. The move appears to be based on concerns
|
||
that public code repositories could be scanned by AI systems to identify
|
||
vulnerabilities. The reported internal guidance, referred to as
|
||
“SDLC-8”, would require public repositories to be made private unless an
|
||
explicit exception is approved.</p>
|
||
|
||
<p>The Free Software Foundation Europe (FSFE) considers this a serious move
|
||
in the wrong direction. Taking already public repositories offline does
|
||
not prevent attackers from analysing deployed systems, dependencies,
|
||
interfaces, or binaries. Depublishing does not make code unseen, nor
|
||
does it remove existing copies, and it is not an effective security
|
||
measure. Instead, it removes a fundamental pillar for security: the
|
||
ability of independent experts, researchers, and other public bodies to
|
||
inspect, reuse, and improve the code, and to report on security issues.</p>
|
||
|
||
|
||
<blockquote>
|
||
<p>“Depublishing public code is not a security strategy. 'Security through
|
||
obscurity’ has been debunked as a security measure for a long time. Making
|
||
repositories private does not protect NHS systems. It only limits who
|
||
can help find and fix problems. The same is true for future code:
|
||
releasing publicly funded software as Free Software creates better
|
||
conditions for scrutiny, accountability, and security than locking it
|
||
away by default”,</p><cite>says Johannes Näder, FSFE Senior Policy Project Manager</cite>.
|
||
</blockquote>
|
||
|
||
<p>
|
||
Releasing publicly funded software as Free Software is the core
|
||
demand of the FSFE’s “<a href="https://publiccode.eu/en/">Public Money?
|
||
Public Code!</a>” initiative. It is also the principle behind existing
|
||
NHS and UK guidance: NHS England’s own Service Standard states that
|
||
<a href="https://shkspr.mobi/blog/2026/05/nhs-goes-to-war-against-open-source/">new
|
||
source code for public services should be open and reusable</a> because
|
||
public services are built with public money. UK government guidance
|
||
similarly requires new source code to be open and reusable, while
|
||
allowing only narrowly defined exceptions.
|
||
</p>
|
||
|
||
<blockquote>
|
||
<p>“If NHS England decides to depublish its services' code, that would
|
||
directly contradict its own guidance and the wider UK principle of
|
||
making publicly funded code open by default. Security
|
||
concerns should be addressed through proper software engineering:
|
||
secret management, vulnerability handling, dependency maintenance,
|
||
reviews, and defence in depth. A blanket shift from open by default to
|
||
closed by default is disproportionate and counterproductive,"</p> <cite>says Näder.</cite>
|
||
</blockquote>
|
||
|
||
<p>
|
||
Free Software enables independent audits, fosters local expertise, and
|
||
allows public bodies to share and improve solutions together. In the
|
||
health sector, where trust, resilience, and accountability are
|
||
essential, these benefits are particularly important. Furthermore,
|
||
“Public Money? Public Code!” fosters innovation and is one of the most
|
||
effective tools to reduce lock-in, reducing public administrations’
|
||
dependency on proprietary vendors, and enabling digital sovereignty.
|
||
</p>
|
||
<p>
|
||
The FSFE therefore calls on NHS England to reverse any blanket
|
||
private-by-default policy for publicly funded code, to publish the
|
||
reported guidance, and to reaffirm that Free Software remains the
|
||
default for publicly funded software.
|
||
</p>
|
||
<p>
|
||
Source: Terence Eden's Blog: <a href="https://shkspr.mobi/blog/2026/05/nhs-goes-to-war-against-open-source/">NHS Goes To War Against Open Source</a>
|
||
</p>
|
||
<p>
|
||
<strong>Update 06.05.2026:</strong> An open letter calls on NHS England to keep its code open: <a href="https://keepthingsopen.com">https://keepthingsopen.com</a>
|
||
</p>
|
||
</body>
|
||
|
||
|
||
<tags>
|
||
<tag key="press">Press Release</tag>
|
||
<tag key="front-page"/>
|
||
<tag key="highlights">highlights</tag>
|
||
</tags>
|
||
|
||
<discussion href="https://mastodon.social/deck/@fsfe/116521220907835900"/>
|
||
<image url="https://pics.fsfe.org/uploads/medium/1b/d9/d996b92ce2dc7513cce6b6ae939b.png" alt="FSFE Press Release picture"/>
|
||
<translator/>
|
||
</html>
|
||
|