Comment on Disclosure of Information Regarding Foreign Obligations

The Center for AI Policy (CAIP) appreciates the opportunity to provide information on the Defense Federal Acquisition Regulation Supplement. We strongly support the proposed amendment to implement section 1655(a) and (c) of the National Defense Authorization Act (NDAA) for Fiscal Year 2019. These sections prohibit the Department of Defense (DoD) from acquiring products, services, or systems relating to information or operational technology, cybersecurity, industrial control systems, or weapon systems through a contract unless the offeror or contractor provides disclosures related to sharing source code and computer code with foreign governments. We also endorse specific clauses, such as the open-source exclusion and changes from the 2019 NDAA that expand disclosures from governments of countries of concern to any foreign person or government. 

We highlight two limitations to this amendment.

• Cyberattacks: The proposed amendment does not mitigate the risk of cyberattacks enabling foreign government visibility into DoD’s products, systems, or services.
• Open-source vulnerabilities: Since the original legislation and proposed rule exclude open-source technology from required disclosures, DoD will need to investigate other means to mitigate risks when using open-source software. 

Finally, we provide the following recommendations.

• Information collection: Provide a secure, automated information collection procedure with standardized multiple choice options.
• Utility of information: We recommend that DoD ask contractors to share their internal risk assessments and mitigations associated with any AI product. 
• Language clarification: Amend language to clarify the meaning of “other than commercial.”

Read the full comment here.