Event Information

Cloud computing services over the Internet have the potential to spur a significant increase in government efficiency and decrease technology costs, as well as to create incentives and online platforms for innovation. Adoption of cloud computing technologies could lead to new, efficient ways of governing.

On April 7, the Brookings Institution hosted a policy forum that examines the economic benefits of cloud computing for local, state, and federal government. Federal Chief Information Officer Vivek Kundra delivered a keynote address on the role of the government in developing and promoting cloud computing. Brookings Vice President Darrell West moderated a panel of experts and detailed the findings in his paper, "Saving Money through Cloud Computing," which analyzes its governmental cost-savings potential.

After the program, panelists took audience questions.

Video

• Cloud Computing a Fiscally Smart Move
• Cloud Computing Saves Money, Makes Government More Open
• Cloud Computing Will Fundamentally Change Government Operations
• Government on Cloud Will Yield Cost-Effective System

Audio

• The Economic Gains of Cloud Computing

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20100407_cloud_computing
• 0407_cloud_computing_kundra_remarks
• 0407_cloud_computing_kundra_presentation

Technology offers the greatest source for innovation in the public sector and one of the best examples falls within the area of cloud computing. As I noted in a recent paper, the U.S. federal government spends nearly $76 billion each year on information technology, and $20 billion of that is devoted to hardware, software, and file servers. Traditionally, computing services have been delivered through desktops or laptops operated by proprietary software. But new advances in cloud computing have made it possible for public sector agencies alike to access software, services, and data storage through remote file servers.

I looked at possible cost savings a federal agency might expect from migrating to the cloud. After undertaking case studies of government agencies that made the move, I found that the agencies generally saw between 25 and 50 percent savings in moving to the cloud. Public officials can save money by reducing the number of file servers they need to purchase, cutting software costs, relying on fewer information technology specialists, and improving the efficiency of their data storage utilization.

In 2008, Washington, D.C. city government shifted many of its 38,000 employee email services across 86 agencies to the cloud, and the migration saved 48 percent on email expenditures. In 2009, the city of Los Angeles moved email service for its 30,000 employees to the cloud. An analysis undertaken by City Administrative Officer Miguel Santana for the City Council found that the five-year costs of running the new Google system would be $17,556,484, which was 23.6 percent less than the $22,996,242 for operating GroupWise during that same period. And in terms of personnel savings, the city needed nine fewer people in its information technology department.

The U.S. Air Force 45th Space Wing is responsible for launching and tracking unmanned space vehicles from Cape Canaveral Air Force Station and employs more than 10,000 workers. The Wing had 60 distinct file servers, but found that it utilized only 10 percent of central processing unit capacity. Commanders modernized their system and saved $180,000 per year in annual computing costs. In addition, the unit saved money by not buying new hardware or deploying new software. These are just some of the ways the government is using technology to save money and increase efficiency of its operations.

Executive Summary

Government information technology is subject to a variety of rules, regulations, and procurement policies.  Computing is treated differently depending on whether the platform is based on desktops, laptops, mobile devices, or remote file servers known as cloud computing.  There are differences between the executive, legislative, and judicial branches of government, as well as in the level of privacy and security expected for various applications.  

Some people perceive higher security on desktop or laptop computers and lower security with the cloud because the latter’s information is stored remotely through third-party commercial providers.  In reality, though, there are serious security threats to all electronic information regardless of platform, and cloud server providers often take security more seriously than mass consumers or government officials employing weak passwords on their local computers. 

In this paper, I review current federal IT policy and discuss rules, practices, and procedures that limit innovation.  There are a variety of obstacles that make it difficult for policymakers to take full advantage of the technological revolution that has unfolded in recent years.  After outlining these issues, I make recommendations on policy changes required to improve the efficiency and effectiveness of federal computing. 

My specific recommendations include:

1. Public officials should develop more consistent rules on computing across desktop, laptop, mobile, and cloud platforms.  
2. The use of video, collaboration, and social networking should be authorized for congressional offices.  This would make legislative branch policy consistent with that of the executive branch.
3. Judicial branch computing should be modernized, with greater emphasis on cloud computing. 
4. There should be a more uniform certification process for federal agencies.  Right now, each agency is responsible for certifying its own applications.  It makes sense to have a “joint authorization board” with the power to review management services and certify particular products for use across the government. 
5. Congress should update the Electronic Communications Privacy Act to change the process by which law enforcement agents obtain electronic information.  Instead of using a prosecutor’s subpoena, legislation should require a “probable cause” search warrant that is approved by a judge.  This would provide greater safeguards in terms of online content, pictures, geolocation data, and e-mails.
6. Privacy rights should be placed on the same footing regardless of whether a person is using desktop or cloud computing.  It makes little sense to have weaker standards on one platform than another.  Consumers and government decision-makers expect the same level of protection whether they are accessing information on a desktop, laptop, mobile, or cloud storage system. 
7. Congress should amend the Computer Fraud and Abuse Act to strengthen penalties for unwanted intrusion into computing systems.  The law has inconsistent penalties and prosecutors have found that it is hard to prosecute cyber-crimes. 
8. Apps.gov represents a big step forward and government use should be expanded because it makes procurement easier and speeds public sector innovation.  It is a model of how the government can reinvent itself through digital technology in ways that improve efficiency and effectiveness.
9. Countries need to harmonize their laws on cloud computing so as to reduce current inconsistencies in regard to privacy, data storage, security processes, and personnel training,  
10. There should be mechanisms for data exchange that encourage portability across platforms.  We should avoid vendor lock-in that precludes data exchange.
11. Data on uptime, downtime, recover time, archiving, and maintenance schedules would help build public trust by providing information on computing performance.

Downloads

• Download the Full Paper

Event Information

The U.S. government spends billions of dollars each year on computer hardware, software and file servers that may no longer be necessary. Currently, the public sector makes relatively little use of cloud computing, even though studies suggest substantial government savings from a migration to more Internet-based computing with shared resources.

On July 21, the Center for Technology Innovation at Brookings hosted a policy forum on steps to enhance public sector adoption of cloud computing innovations. Brookings Vice President Darrell West moderated a panel of experts, including David McClure of the General Services Administration, Dawn Leaf of the National Institute for Standards and Technology, and Katie Ratte of the Federal Trade Commission. West released a paper detailing the policy changes required to improve the efficiency and effectiveness of federal computing.

Audio

• Moving to the Cloud: How the Public Sector Can Leverage the Power of Cloud Computing

Transcript

• Uncorrected Transcript (.pdf)
• Download Dawn Leaf's PowerPoint Presentation (.pdf)
• Download David McClure's PowerPoint Presentation (.pdf)

Event Materials

• 20100721_cloud_computing
• 0721_cloud_computing_leaf
• 0721_cloud_computing_mcclure

Event Information

Although research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter government and private-sector firms from migrating to the cloud. By its very nature, storing information or accessing services through remote providers would seem to raise the level of privacy and security risks. But is such apprehension warranted? What are the real security threats posed to individuals, business and government by cloud computing technologies? Do the cost-saving benefits outweigh the dangers?

On October 26, the Brookings Institution hosted a policy forum on the privacy and security challenges raised by cloud computing. Governance Studies Director Darrell West moderated a panel of technology industry experts examining how cloud computing systems can generate innovation and cost savings without sacrificing privacy and security. West will also present findings from his forthcoming paper “Privacy, Security, and Innovation in Cloud Computing.”

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20101026_cloud_computing

Executive Summary

Cloud computing can mean different things to different people, and obviously the privacy and security concerns will differ between a consumer using a public cloud application, a medium-sized enterprise using a customized suite of business applications on a cloud platform, and a government agency with a private cloud for internal database sharing (Whitten, 2010). The shift of each category of user to cloud systems brings a different package of benefits and risks.

What remains constant, though, is the tangible and intangible value that the user seeks to protect. For an individual, the value at risk can range from loss of civil liberties to the contents of bank accounts. For a business, the value runs from core trade secrets to continuity of business operations and public reputation. Much of this is hard to estimate and translate into standard metrics of value (Lev, 2003) The task in this transition is to compare the opportunities of cloud adoption with the risks. The benefits of cloud have been discussed elsewhere, to the individual to the enterprise, and to the government (West, 2010a, 2010b).

This document explores how to think about privacy and security on the cloud. It is not intended to be a catalog of cloud threats (see ENISA (2009) for an example of rigorous exploration of the risks of cloud adoption to specific groups). We frame the set of concerns for the cloud and highlight what is new and what is not. We analyze a set of policy issues that represent systematic concerns deserving the attention of policy-makers. We argue that the weak link in security generally is the human factor and surrounding institutions and incentives matter more than the platform itself. As long as we learn the lessons of past breakdowns, cloud computing has the potential to generate innovation without sacrificing privacy and security (Amoroso, 2006; Benioff, 2009).

Downloads

• Download the Full Paper

EXECUTIVE SUMMARY

Many web services are examples of cloud computing, from storage and backup sites such as Flickr and Dropbox to online business productivity services such as Google Docs and Salesforce.com. Cloud computing offers a potentially attractive solution to customers keen to acquire computing infrastructure without large up-front investment, particularly in cases where their demand may be variable and unpredictable, as a means of achieving financial savings, productivity improvements and the wider flexibility that accompanies Internet-hosting of data and applications.

The greater flexibility of a cloud computing service as compared with a traditional outsourcing contract may be offset by reduced certainty for the customer in terms of the location of data placed into the cloud and the legal foundations of any contract with the provider. There may be unforeseen costs and risks hidden in the terms and conditions of such services.

This document reports on a detailed survey and analysis of the terms and conditions offered by cloud computing providers.

The survey formed part of the Cloud Legal Project at the Centre for Commercial Law Studies (CCLS), within the School of Law at Queen Mary, University of London, UK. Funded by a donation from Microsoft, but academically independent, the project is examining a wide range of legal and regulatory issues arising from cloud computing. The project's survey of 31 cloud computing contracts from 27 different providers, based on their standard terms of service as offered to customers in the E.U. and U.K., found that many include clauses that could have a significant impact, often negative, on the rights and interests of customers. The ease and convenience with which cloud computing arrangements can be set up may lull customers into overlooking the significant issues that can arise when key data and processes are entrusted to cloud service providers. The main lesson to be drawn from the Cloud Legal Project’s survey is that customers should review the terms and conditions of a cloud service carefully before signing up to it.

The survey found that some contracts, for instance, have clauses disclaiming responsibility for keeping the user’s data secure or intact. Others reserve the right to terminate accounts for apparent lack of use (potentially important if they are used for occasional backup or disaster recovery purposes), for violation of the provider’s Acceptable Use Policy, or indeed for any or no reason at all. Furthermore, whilst some providers promise only to hand over customer data if served with a court order, others state that they will do so on much wider grounds, including it simply being in their own business interests to disclose the data. Cloud providers also often exclude liability for loss of data, or strictly limit the damages that can be claimed against them – damages that might otherwise be substantial if a failure brought down an e-commerce web site.

Although in some U.S. states, in E.U. countries and in various other jurisdictions the validity of such terms may be challenged under consumer protection laws, users of cloud services may face practical obstacles to bringing a claim for data loss or privacy breach against a provider that seems local online but is, in fact, based in another continent. Indeed, service providers usually claim that their contracts are subject to the laws of the place where they have their main place of business. In many cases this is a US state, with a stipulation that any dispute must be heard in the provider’s local courts, regardless of the customer’s location.

Perhaps the most disconcerting discovery of the Cloud Legal Project’s survey was that many providers claimed to be able to amend their contracts unilaterally, simply by posting an updated version on the web. In effect, customers are put on notice to download lengthy and complex contracts, on a regular basis, and to compare them against their own copies of earlier versions to look for changes.

The cloud computing market is still developing rapidly, and potential cloud customers should be aware that there may be a mismatch between their expectations and the reality of cloud providers' service terms, and be alive to the possibility of unexpected changes to the terms.

Downloads

• Download the Full Paper

Our former Brookings colleague Rebecca Blank, now at the Commerce Department, is today leading the first meeting of the Obama Administration’s Innovation Advisory Board, looking at the innovative capacity and economic competitiveness of the United States.

I applaud the effort.  Nothing is more important to America’s longterm competitiveness than emphasizing innovation.  As the council looks to the private sector and global markets, I urge it to examine how the U.S. government can lead innovation and contribute to economic growth.  The best place to look is new and emerging digital technologies that can make government more accessible, accountable, responsive and efficient for the people who use government services every day.

Here are some of the recommendations I made in a recent paper I wrote with colleagues here at Brookings as part of our “Growth Through Innovation” initiative:

• Save money and gain efficiency by moving federal IT functions “to the cloud,” i.e., using advances in cloud computing to put software, hardware, services and data storage through remote file servers.

• Continue to prioritize the Obama administration’s existing efforts to put unparalleled amounts of data online at Data.gov and other federal sites, making it easier and cheaper for citizens and businesses to access the information they need.

• Use social media networks to deliver information to the public and to solicit feedback to improve government performance.

• Integrate ideas and operations with state and local organizations, where much of government innovation is taking place today. 

• Apply the methods of private-sector business planning to the public sector to produce region-specific business plans that are low cost and high impact.

These improvements in government services innovations in the digital age can help spur innovation and support a robust business climate.  And, as a sorely needed side benefit, they can also serve to eliminate some of the current distrust and even contempt for government that has brought public approval of the performance of the federal government to near historic lows.  

Event Information

While research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter governments and private-sector firms from migrating to the cloud. Senator Amy Klobuchar (D-Minn.) has advanced discussion of the “Cloud Computing Act of 2011,” draft legislation that would address these challenges by encouraging the U.S. government to negotiate with other countries to establish consistent laws related to online security and cloud computing. The bill also creates new enforcement tools for investigating and prosecuting those who violate online privacy and security laws.

On June 16, the Brookings Institution hosted a forum on the policy proposals in the Cloud Computing Act of 2011. Discussion included an overview of the international policy implications as governments and firms adjust to a coherent legal framework, changes and innovations in public procurement, and challenges for private industry as it balances consumer needs and compliance with these proposed cloud computing safeguards.

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20110616_cloud_computing

Listen to the chatter from top officials, and you’d think that World War III was about to break out on the Internet. The defense secretary is warning about a digital “Pearl Harbor.” Former director of national intelligence Mike McConnell declares that the United States is “fighting a cyber war, and we’re losing.” Every new hack brings more pronouncements of network doom.

The scare talk, however, is misplaced. Yes, we’re facing enormous cybersecurity problems — just look at the high-profile penetrations of such companies as Sony and Lockheed or the millions of Americans whose personal information has been stolen online.

But these aren’t signs of some impending cataclysmic showdown as I explain in my new cybersecurity paper for The Brookings Institution. They’re markers of a rising tide of online crime that, in its own way, could be more dangerous than a cyberwar. According to the British government, online thieves, scammers and industrial spies cost U.K. businesses an estimated $43.5 billion in the past year alone. Crooks-for-hire will infect a thousand computers for $7 — that’s how simple it’s become. Sixty thousand new malicious software variants are detected every day. Forget “Pearl Harbor”; if we’re not careful, the Internet could be in danger of looking like the South Bronx circa 1989 – a place where crooks hold such sway that honest people find it hard to live or work there.

Could there be some online conflict in the future? Maybe. But crooks are draining billions from the legitimate global economy right now. Even the Pentagon’s specialists are worried, noting in their new cybersecurity strategy that “the tools and techniques developed by cyber criminals are increasing in sophistication at an incredible rate.”

Those tools also are becoming easier to use. The latest crimeware makes stealing passwords about as simple as setting up Web pages. One gang, recently arrested, used it to drain $9.5 million in just three months.

Read the full article at washingtonpost.com >>

Executive Summary

The move to the cloud is one of the defining information technology trends of the early 21st century. By providing businesses, universities, government agencies, and other entities with access to shared and often physically dispersed computing resources, cloud computing can simultaneously offer increased flexibility, reduced cost, and access to a wider array of services.

Cloud computing has also created a set of new challenges. For example, the issues of privacy and security in the cloud are well recognized and have been extensively discussed in the business and popular press. However, one critical issue that has received very little attention with respect to cloud computing is export control.

In the broadest sense, export control relates to regulations that the United States and many other countries have put in place to restrict the export of various sensitive items, information, and software.

There is an inherent tension between cloud computing and export control. While the concept of the cloud is centered on the premise of removing the need to track the details of data movement among various destinations, export control regulations are built largely around restrictions tied to those very movements.

If cloud computing is to reach its full potential, it is critical for providers and users of cloud services to address its implications with respect to export control. It is equally important to adapt the export control regulations to reflect the increasing prevalence of cloud computing in a manner that preserves the ability of American companies to benefit from the efficiencies of the cloud while also ensuring that American national security and foreign policy interests are adequately protected.

Downloads

• Download the Paper