![[NASA Logo]](../Images/nasaball.gif) |
NASA Procedures and Guidelines |
||||
This Document is Obsolete and Is No Longer Used.
|
|||||
|
|
|||||
|
|
||||
| | TOC | ChangeHistory | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | | |||||
2.1 Center Awareness and Orientation Activities
2.1.1 The Center SRA shall conduct awareness activities and orientation sessions for Center civil servants and contractors to support the implementation of this NPR.
2.2 Software Reporting
2.2.1 Software subject to this NPR, as described in paragraph P.2 and as determined by the Center SRA under paragraph 1.7, shall be reported to NASA.
2.2.1.1 The Center SRA shall ensure that software is reported in accordance with this section 2.2 and is inventoried in the NTTS.
2.2.2 This reporting requirement applies to new software subject to this NPR that has not yet been reported and to software previously reported where new functionality or new innovators have been added to the software since it was reported.
2.2.2.1 The reporting requirement does not apply to bug fixes or minor enhancements that the Center SRA has determined are not subject to this NPR. If there are questions on reporting software, contact the Center SRA for assistance in contacting the appropriate personnel responsible for assisting in the reporting of new technologies.
2.2.3 Except for an Approved for NASA Release (as defined in 2.2.3.1), software will be reported prior to any release.
2.2.3.1 To minimize delays during software development or review among NASA Centers, if approved by the Center SRA, software released as an Approved for NASA Release may be reported after the release.
2.2.4 In accordance with NPD 2091.1, Inventions Made By Government Employees, each NASA employee who makes an invention embodied by software will report such invention to the personnel responsible for assisting in the reporting of inventions.
2.2.5 In accordance with the Patent Rights or New Technology clauses in NASA contracts and subcontracts, contractors and subcontractors shall report subject inventions and reportable items that include software created by their employees to the NASA New Technology Representative named in their contracts.
2.2.5.1 The NASA New Technology Representative shall provide the Center Patent or IP Counsel with access to contractor New Technology Reports (NTR) disclosing software.
2.2.6 Generally, NASA does not use grants to develop software; however, where a grantee has developed software as a consequence of performing activities under a grant, the grant obligates the grantee to report the software if it is considered to be a potentially patentable subject matter.
2.2.7 Software is normally reported electronically using the NASA electronic New Technology Reporting system (e-NTR) located at http://invention.nasa.gov (preferred method) or in hard copy using NASA Form (NF) 1679 "Disclosure of Invention and New Technology (Including Software)," also available at the e-NTR web site.
2.2.7.1 All software disclosures will:
a. Identify the individuals contributing to the concept expressed by the software (i.e., the underlying functional method or process that is implemented by the software) as well as those individuals involved in coding the actual software;
b. Indicate where the software is an improvement or innovation and provide version number;
c. Identify any proprietary software, software owned by a non-Federal entity, or open source software that is incorporated into the software being disclosed; and,
d. Indicate whether a license has been obtained in situations where proprietary software, software owned by a non-Federal entity, or open source software has been incorporated into the software being disclosed and attach a copy of the license to the disclosure.
2.3 Review and Assessment Coordination
2.3.1 The Center SRA shall coordinate the review and assessment of reported software by the Center Patent or IP Counsel as described in Section 2.4, the Center official designated by the Center Director, or his/her designee(s), as described in Section 2.5, the CEA as described in Section 2.6, and the Center CISO as described in Section 2.7.
2.3.2 The Center SRA may use the Software Release Request authorization (SRRA) checklist and Compliance Matrices for Software Classification to gather information from software developers that is needed to software release assessments. Both of these completed documents may be attached to the appropriate record in NTTS for historical reference purposes.
2.4 Intellectual Property and Releasability Rights Assessment
2.4.1 The Center Patent or IP Counsel shall provide appropriate legal counsel with respect to an Intellectual Property and Releasability Rights Assessment of all reported software defined in paragraphs 2.4.4.1 to 2.4.4.5 to determine NASA's rights in the software, to determine the suitability of software for patent and/or copyright protection, and to identify any appropriate transfer restrictions.
2.4.2 The Center Patent or IP Counsel shall provide appropriate legal counsel with respect to the Government's rights in software for the purposes of assessing NASA's right to release the software. Determination of the Government's rights is required before the software may be released.
2.4.2.1 In order to release the software, the Government must have clear rights in the software, such as an ownership interest, a Government purpose license, or other appropriate license or permission from third party owners. If the reported software does not include any proprietary software or software owned by a Non-Federal entity, or the Government has a license/permission to use any such software included in the reported software (e.g. Government Purpose or Open Source license), the software may, at its most restrictive, be accepted as Approved by U.S. Government Purpose Release. Centers, however, should still explore whether a broader release category is permitted.
2.4.2.2 Where it is known that Open Source Software, as defined in A.1.7, is included in software proposed for release, the Center Patent or IP Counsel shall prior to any release:
a. Review the external Open Source Software license and assess any special risks that may be involved; and
b. Confirm that NASA has obtained clear rights from any third party rights owners (such as through an assignment or license) to make the Open Source Release.
2.4.2.3 When it is known that Open Source Software Development, may be used as part of a NASA project, the Office or Project that has responsibility for acquisition or development of the software (see 1.8.3) to assess any risks that may negatively impact NASA's intended use.
2.4.3 The Center Patent or IP Counsel shall provide appropriate legal counsel for determining the suitability of reported software for patent and/or copyright protection.
2.4.3.1 The Center Patent or IP Counsel shall provide appropriate legal counsel in the determination of authors and inventors of software and whether (1) the software qualifies as patentable subject matter, and (2) is a work of the U.S. Government as defined in paragraph 2.4.3.3. The software invention, e.g., the underlying functional concepts and/or ideas implemented by the software, may be protected through patenting, whereas the actual software code, which expresses those concepts, may also be protected through copyright.
2.4.3.2 Patents. NASA can obtain domestic and/or foreign patents on the ideas, algorithms, and processes underlying the software if they satisfy the requirements for patentable subject matter. Normally, all parties with an ownership interest must assign their interest in the software to the Government before NASA will file a patent application. Consistent with guidelines set forth in NPR 7500.2, patents will only be sought when a clear determination has been made that patent protection would be a more effective method of ensuring broad distribution and adoption of the technology than the conventional Software Release Process.
2.4.3.3 Copyrights. Software created solely by an officer or employee of the U. S. Government as part of that person's official duties is a work of the U. S. Government. Copyright protection is not currently available in the United States for a work of the U. S. Government. However, the Government can claim foreign copyrights for software created by its employees and can receive and hold U.S. and foreign copyrights transferred to it by assignment.
2.4.3.4 NASA can direct its contractors to assert their worldwide (U.S. and foreign) copyright and assign it to the U.S. Government when software is created under a NASA contract. If the contractor provides an acceptable plan to commercialize the software, the Contracting Officer, in consultation with the Center Patent or IP Counsel and the Center Office or Project that has responsibility for the software, may provide the contractor written permission to assert copyright in the software code. Where such permission is provided, the contractor retains the copyright with the Government retaining a license for use by and for the Government. This Government purpose license does not, however, include the right to distribute the software to the public. Such software may be distributed for Government purposes as defined in paragraph 2.4.4.3 and A.2.6, unless a broader license has been obtained by the Government.
2.4.4 Center Patent or IP Counsel shall provide appropriate legal counsel with respect to evaluating and classifying reported software under one or more of the categories listed in the following subparagraphs. As circumstances change, the software may be reevaluated and reclassified.
2.4.4.1 Releasable Without Nondisclosure Obligations. Software that has been categorized as Approved for Public Release and becomes Publicly Releasable Software is releasable without nondisclosure obligations in the SUA. Software that has not been categorized as Approved for Public Release but (a) is a work of the U.S. Government as defined in paragraph 2.4.3.3, (b) is not export restricted, (c) is not and is not expected to be the subject of a patent application, and (d) for which there is no plan for further development or beta testing, may be released without nondisclosure obligations in the SUA. This type of release will be used with caution to avoid creating a statutory bar to patenting.
2.4.4.2 Releasable With Nondisclosure Obligations. In general, software, as valuable property, is not an Agency record under the FOIA, and, therefore, is not subject to the mandatory disclosure provisions of the FOIA. Thus, with limited exceptions, software may be categorized as releasable with nondisclosure obligations. The limited exceptions include software that (a) contains an embedded computer database that is itself releasable under the FOIA, (b) is so related to a releasable computer database that the computer database would be unintelligible or unusable without the software, and (c) preserves information relative to the Agency's structure, operation, or decision-making process.
a. To avoid creating a statutory bar for patenting, software that is being reviewed by the Center Patent or IP Counsel for patentable subject matter and the filing of a patent application shall be categorized as releasable with nondisclosure obligations.
b. Additionally, software that is part of an application for patent filed in the U. S. Patent and Trademark Office, or with any foreign patent office, will be categorized as releasable with nondisclosure obligations.
c. Software categorized as Releasable with Nondisclosure Obligations will include nondisclosure provisions in the SUA when released.
2.4.4.3 Releasable Only for U.S. Government Purposes. Software that has U.S. Government purpose only restrictions on use, copying, distribution, etc., should be categorized as Releasable Only for U.S. Government Purposes.
a. Software so categorized should be used only for U.S. Government purposes. A U.S. Government purpose is any activity in which the U. S. Government is a party, including contracts, grants, cooperative agreements, and non-reimbursable Space Act Agreements. Center Patent or IP attorney may be consulted for any questions that arise as to whether an activity is a government purpose.
b. Government purposes include a release for use in competitive procurements for the Government, but do not include a release for commercial purposes or a release to the public. Thus, the Government may release or disclose such software outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose the software for Government purposes only.
c. Center Patent or IP Counsel shall determine whether nondisclosure provisions should be included in an SUA for release of software categorized as Releasable Only for U.S. Government Purpose.
2.4.4.4 Not Releasable. This category includes software in which the associated copyright is owned by a non-Federal party. Software in the lawful possession of NASA that was obtained under a contract, license, or other agreement that prohibits any further use, duplication, or disclosure, will be categorized as Not Releasable; and, unless subsequent permission is granted by its owner, such software should not be released. Even with such permission, an export control assessment in accordance with paragraph 2.6 is required if the proposed release is to a foreign person.
2.4.4.5 Licensable Software. Software categorized as Licensable Software, will be consistent with technology transfer objectives and should be coordinated with the Center Patent or IP Counsel and the Center official designated by the Center Director, or his/her designee(s).
a. The licensing of software is governed by Government-wide licensing regulations (37 CFR Part 404) and NPR 2090.6, Authority to Enter Into License Agreements and Implementation of Licensing Authority.
b. While the licensing of software under NPR 2090.6 is not considered a release under this NPR, however, before Licensable Software is approved for licensing, it normally goes through the same review and assessment process as described in this Chapter.
2.5 Technology Transfer Assessment
2.5.1 The Center official designated by the Center Director, or his/her designee(s), shall coordinate an assessment of any reported software's TRL and technology transfer potential.
2.5.1.1 The assessment should consider the software's value or utility to potential private or public sector users and applications outside of NASA. Software Technology Readiness Levels are provided in Appendix E. Section 4.6 of NPR 7500.1, NASA Technology Commercialization Process, provides guidance on providing assessments of technical transfer potential.
2.5.2 External individuals or organizations and NASA contractors, grantees, and Space Act Agreement partners, with whom NASA has nondisclosure arrangements to protect against the unintended public release of NASA-funded software, may provide research and analysis in support of the Technology Transfer Assessment.
2.5.3 The assessment shall include strategies and recommendations for the transfer of the software which will maximize its benefit to NASA, the U.S. public, and the U.S. economy.
2.5.4 Upon approval by the Center SRA, a Project Release for use under a NASA contract or grant may be made prior to a Technology Transfer Assessment (see also 3.2.5.3.c).
2.6 Export Control Assessment
2.6.1 The decision to support a foreign release of software (i.e., a release made directly to, or made accessible to, any individual outside of the United States or a foreign person in the United State) should be made by the Center SRA in consultation with the Center Office or Project that has responsibility for the software and the CEA.
2.6.2 A foreign release of software may be made only if the CEA approves the release. Prior to approval of a foreign release, the CEA shall conduct an Export Control Assessment of software to determine export control requirements and will provide guidance and oversight to ensure that any intended foreign release of software complies with applicable export control laws and regulations as well as the NASA Export Control Program.
2.6.2.1 The CEA shall ensure that any intended foreign release of NASA software complies with:
a. The U.S. State Department's International Traffic in Arms Regulations for software falling within the scope of the United States Munitions List, or
b. The U.S. Department of Commerce's Export Administration Regulations for software falling within the scope of the Commerce Control List.
2.6.2.2. While an export control assessment is only required for a release that legally constitutes an export, it may be requested and used for decision making by the Center SRA in determining appropriate categorization and availability for release in other situations.
2.6.3 All requests for the release of command and control (C&C) software for flight operations will have the endorsement of the NASA Center or Program officials with management responsibility for development, acquisition, and implementation of the requested C&C software.
2.6.3.1 All requests for the release of C&C software are subject to the Export Control Assessment established by this NPR.
2.6.3.2 During the Export Control Assessment of C&C software considered for release, the CEA, as warranted, should consult with the Center Inspector General's Office.
2.6.4 Applicability - The export control laws cover the release of technical data, including software, outside the United States and the release of technical data, including software, to a foreign person in the United States, to a U.S. person representing a foreign person, or to persons on U.S. sanctioned-parties or denied-parties lists (see NPR 2190.1).
2.6.4.1 A release of software to a foreign person located in the United States or abroad or broad access by the public (e.g., on the Internet) are both considered to be an export.
2.6.4.2 A Public Release or an Open Source Release, as described in paragraph A.2.3, is always considered an export due to its availability to any foreign person, and thus requires CEA approval.
2.6.4.3 A U.S. and Foreign Release may be an export, depending on the recipient.
2.6.4.4 A release of export-controlled software will include the appropriate export determination and be limited to U.S. persons as defined in title 22 CFR 120.15 and parties not appearing on any U.S. sanctioned-parties or denied-parties lists unless approval to export the software has first been obtained by the CEA.
a. Additionally, any software that is being exported will prominently display appropriate Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) legends, if the software has been determined to be export controlled by the CEA.
2.6.5 Unauthorized Foreign Release - An employee who releases export-controlled software without authorization risks violating the EAR or the ITAR, which may result in criminal, civil, or administrative action against both the Agency and the employee.
2.7 Information Technology Security Assessment
2.7.1 The Center CISO shall advise and assist the Center SRA and the responsible software development and assurance organizations in the identification and the mitigation or elimination of information technology security risks associated with the release of software considered within the scope and purpose of this NPR. A key objective of Center CISO advice and assistance is to ensure the integrity of NASA information technology systems and to prevent unauthorized access to NASA computing resources.
2.7.2 CISO guidance may include a standard checklist or specific criteria for use by the Center SRA and/or the responsible software development and assurance organizations in performing an IT security assessment of all software considered for release.
2.7.3 If the checklist requires interpretation in its application, the Center SRA or the responsible software development and assurance organizations will consult with their Center CISO to provide clarification.
2.7.3.1 Software that is modified to mitigate or eliminate identified IT Security risks prior to its release should be reassessed upon the documented completion of risk reduction measures.
2.7.4 The results of the IT security assessment of the software considered for release shall be documented by the software development organization project manager, in accordance with NPD 7120.4, and provided to the Center SRA for use in determining the release of software in accordance with the ITSM guidance.
2.7.4.1 A copy of the assessment results will be provided to the Center CISO. The Center SRA and the Center CISO, as deemed warranted by either party, should jointly consider a given IT security assessment prior to the release of the subject software.
2.8 SRA Release Determination
2.8.1 The Center SRA shall ensure that the release of applicable software created by and for the Center is accomplished in accordance with this NPR and in a timely manner.
2.8.2 Upon consulting with the Software Innovator, the Center SRA has the authority to categorize software as Software Code Baseline, Software Product Baseline, Software Accepted (As Built) Baseline, or Publicly Releasable Software.
2.8.3 When a release of NASA software is requested, the Center SRA shall consult with the Center Office or Project that has responsibility for the software to determine a recommended release category.
2.8.4 In establishing release restrictions for specified software, the Center SRA shall consider Agency technology transfer objectives along with the recommendations and determinations resulting from the release assessments.
2.8.4.1 The Center SRA shall then identify, consistent with the established release restrictions, the approved option(s) for releasing specified software as implemented.
2.8.5 Finally, the Center SRA will consult with the Center Patent or IP Attorney to determine the proper SUA for a release of NASA software. Model SUAs have been prepared and adopted for use by the SRA's. Model SUAs may be revised for a particular release only after consultation with the Center Patent or IP Counsel or designee.
2.8.6 Except in the case of an Open Source Release (see 3.2.2.2.), a SUA will be signed, or otherwise agreed to, or acknowledged by the recipient before the requested software may be released to the recipient.
2.8.6.1 In the case of a software where NASA is seeking to expedite broad dissemination such as with a Public Release or an Open Source Release, a recipient's agreement may be, for example, by click-wrap agreement or terms of use under the agreement.
2.8.6.2 In the case of a Project Release under a Government contract, software may be released by NASA to NASA's support service contractors as Government Furnished Information (GFI) under the contract, and the contract or other Contracting Officer direction may serve as the SUA if the Center Patent or IP Counsel concurs. If software is to be released as GFI, the SRA shall work with the applicable Contracting Officer and obtain sufficient information to document the release.
2.8.6.3 A SUA issued for any purpose other than an Open Source Release will, at a minimum, include a Software Release Record described in 3.6.1, the disclaimer and indemnification provisions as required in 3.4 and the notices of 3.5 as required in this NPR and may also include provisions for nondisclosure and export control as required.
2.8.6.4 A SUA will also specify any restrictions on use and disclosure of said software imposed by NASA on the recipient.
2.8.6.5 For all releases other than an Intra-NASA Release, Open Source Release or Public Release via click wrap agreement, a SUA will be issued by the Center SRA (or Contracting Officer if released under 2.8.6.2), or designee, and an original SUA or Software Release Record shall be retained by the SRA, or designee.
2.8.7 An SUA is a Government record and will be maintained in NTTS for disposition per guidance provided in NPD 1440.6, NASA Records Management, and NPR 1441.1, NASA Records Retention Schedules.
| TOC | ChangeHistory | Preface | Chapter1 | Chapter2 | Chapter3 | AppendixA | AppendixB | AppendixC | ALL | |
| | NODIS Library | Legal Policies(2000s) | Search | |