Cloud Computing: Billowing Toward Data Ownership - Part I

Let's begin with the definition of Cloud Computing as currently found in Wikipedia, the free encyclopedia -

"The term ... derives from the common depiction in most technology architecture diagrams, of the Internet ... using an illustration of a cloud. The computing resources being accessed are typically owned and operated by a third-party provider on a consolidated basis in data center locations. Target consumers are not concerned with the underlying technologies used to achieve the increase in server capability, [the availability of which] is sold simply as a service available on demand."

As reported in Data Center Knowledge, Microsoft Chairman Bill Gates recently spoke about the boom in data center growth -

"The shift of services to the Cloud is getting us to think about data centers on a scale we never have before .... When you think about design, you can be very radical and come up with some huge improvements as you design for this kind of scale ...."

As reported in The Economist there is indeed a boom in the data center industry -

"Data centers are essential to nearly every industry and have become as vital to the functioning of society as power stations are .... American alone has more than 7,000 data centers .... And each is housing ever more servers, the powerful computers that crunch and dish up data .... Google is said to operate a global network of about three dozen data centers with ... more than 1 million servers. To catch up, Microsoft is investing billions of dollars and adding up to 20,000 servers a month .... In America the number of servers is expected to grow to 15.8 million by 2010 - three times as many as a decade earlier."

This boom is building the Cloud where software as a service (SaaS) will find the 'oxygen' it needs to survive and thrive. The expansion of the Cloud augurs well that distributed data within the Cloud will come to substitute to some extent - perhaps substantially so - for data distributed outside of the Cloud.

One resulting consequence will likely be that mobile technology becomes promoted not as a storage device but as a utilitarian tool for taking a sip of data as needed, when needed, from the moisture of the Cloud. Imagine the Cloud holding the data for each user's personal mobile technology. Imagine users traveling as 'digital nomads' without laptop computers, because they will stay connected to the Cloud through their internet-accessible mobile phones.

Jonathan Schwartz, CEO of Sun Microsystems, spent a week recording his life as one such digital nomad for The Economist.

Click on image to play video podcast [5m 25s]

Here's the takeaway quote (paraphrased) from this podcast - "In my travels I keep a pen and a BlackBerry. My assumption is that the network has become ubiquitous across the world. The network is more a utility for me than a destination." 

Again, data distribution becomes more about distribution of data stored within the Cloud and less about distribution of data stored on mobile technology. Lost your internet-accessible mobile phone in Paris, France? Purchase another one when you land in San Francisco and re-connect to the Cloud (and your address book, scheduling calendar, etc.) without missing a beat.

Another likely consequence of the Cloud is that as people and businesses consider moving their computer storage and services into the Cloud, their direct technological control of information becomes more and more of a competitive driver. The buzz created by Dataportability.org is the early evidence of this driver. See Portability, Traceability and Data Ownership (Part I).

But mere portability is not enough. It only whets the appetite of people and business owners for more technological control - not just legislated or contractual privacy protections. See, e.g., Personal Health Records, Data Portability and the Continuing Privacy Paradigm. That is, the Cloud significantly increases the opportunities for privacy friendly technologies, including data ownership technologies.

"The [online] company that ... figures out ways of ... [technologically] building into [its] compliance systems ... [privacy] compliance mechanisms ... will be putting itself at a tremendous competitive advantage for attracting the services to operate in [the cloud computing environment]." Quoting Reidenberg in Computing in the Cloud: Possession and ownership of data.

Steve Inskeep of NPR's Morning Edition recently talked with Craig Balding, an information technology security expert for a Fortune 500 company, about Cloud Computing. Here's the takeaway exchange from the 3m 30s audio clip 'Cloud Computing' Puts Computer Resources on Tap -

Inskeep (2m25s): "Is somebody who runs a business, who used to have a filing cabinet in a filing room, and then had computer files and computer databases, really going to be able or want to take the risk of shipping all their files out to some random computer they don't even know where it is and paying to rent storage that way?"

Balding: "Yes, that's really a key question, even though these are reputable companies ... there's going to be a whole ecosystem that builds up around around [Cloud Computing] ... of smaller companies that will offer additional services on top of [Cloud Computing's] basic services .... so what I've done is [I've} actually started up a blog [called] cloudsecurity.org and what I'm trying to do is to get the various cloud providers to come and have a discussion about what security they are doing ..."

If you are an IT security expert, I would encourage you to take a moment to familiarize yourself with Mr. Balding's Cloud Security blog. Security is an absolute essential for the Cloud, as it has been for databases of any size since they were first engineered.

But security ... is not enough.

As Bruce Schneier has written in Secrets And Lies - Digital Security In A Networked World -

"The average person can not tell good security from bad security... the world is filled with specialties that are critical to public safety and security, and yet are beyond the comprehension of the general population... Commerce works the same way. When was the last time you personally checked the accuracy of a gas station's pumps, or a taxicab's meter, or the weight and volume information on packaged foods?" [emphasis added]

Schneier's language parallels the central theme of Banking on Granular Information Ownership -

"People are comfortable and familiar with monetary banks. That’s a good thing because without people willingly depositing their money into banks, there would be no banking system as we know it .... [By comparison, we] live in a world that is at once awash in on-demand information courtesy of the Internet, and at the same time the Internet is strangely impotent when it comes to information ownership ....

In many respects the Internet is like the Wild West because there is no information web similar to our monetary banking system. No similar integrated system exists for precisely and efficiently delivering our medical records to a new physician, or for providing access to a health history of the specific animal slaughtered for that purchased steak. Nothing out there compares with how the banking system facilitates gasoline purchases."

Banks meet the expectations of their customers by providing them with security, yes, but also credibility, compensation, control, convenience, integration and verification. It is the dynamic combination of these that instills in customers the confidence that they continue to own their money, even while it is in the hands of a third-party bank.

No, security is not sufficient by itself to compel the hypothetical business owner, whom Inskeep was referencing, to take the risk of putting his or her information into the Cloud.

As blogged in Portability, Traceability and Data Ownership (Part IV), nobody has done a better job of describing why data ownership matters to the use and effectiveness of big databases than Marshall Van Alstyne. And I continue to be charmed with the 1994 publication he co-authored entitled, Why Not One Big Database? Ownership Principles for Database Design.

You might have seen this before, but here’s my favorite quote from Van Alstyne's paper -

“The fundamental point of this research is that ownership matters. Any group that provides data to other parts of an organization requires compensation for being the source of that data. When it is impossible to provide an explicit contract that rewards those who create and maintain data, "ownership" will be the best way to provide incentives. Otherwise, and despite the best available technology, an organization has not chosen its best incentives and the subtle intangible costs of low effort will appear as distorted, missing, or unusable data.” (emphasis added)

I know I am in effect bootstrapping Van Alstyne's research results.

I am taking liberties by stretching his research from big organizational databases to cover that of the Cloud. I recognize that the Cloud is already of a scale that is astronomically larger than even what Van Alstyne in his mid-1990's research could have possibly imagined it would become today.

But when I read Van Alstyne's paper there is an insistent voice inside of me that says "data ownership matters to the Cloud for the same reasons it matters to big, organizational databases." 

Clouds V1 from Robert Beyer on Vimeo.

[This concludes Part I of a three part series. On to Part II.]

Computing in the Cloud: Possession and ownership of data

The following video is provided by UChannel, a collection of public affairs lectures, panels and events from academic institutions all over the world. This video was taken at a conference held at Princeton University's Center for Information Technology Policy on January 14, 2008. The conference was sponsored by Microsoft.

What you will see is a panel and discussion format moderated by Ed Felten, Director of the CITP. The panel members are:

1. Joel Reidenberg, Professor of Law, Fordham University
2. Timothy B. Lee, blogger at Technology Liberation Front and adjunct scholar, Cato Institute
   
3. Marc Rotenberg, Executive Director, Electronic Privacy Information Center
   

Here is a paragraph descriptive of the questions addressed by the panel. 

"In cloud computing, a provider's data center holds information that would more traditionally have been stored on the end user's computer. How does this impact user privacy? To what extent do users "own" this data, and what obligations do the service providers have? What obligations should they have? Does moving the data to the provider's data center improve security or endanger it?"

The video, entitled "Computing in the Cloud: Possession and ownership of data", is useful and timely. And the panel is well constructed.

Tim Lee, who readily states that he is not a lawyer, very much serves as an apologist for the online companies who believe that "total, one-hundred percent online privacy would mean ... that there wouldn't be any online [sharing] services at all" (Video Time ~ 2:07).

The online services Lee briefly touches upon by way of example are the ubiquitous use of Web cookies for collecting a wide variety of information about usage of the Internet by online users (~5:30), Google's Gmail which employs a business model of examining contents of users' e-mail and tailoring advertising presented to users (~8:05), Facebook's News Feed service which permits users to keep track of changes to their 'friends' accounts, and Facebook's Beacon service which sends data from external websites to Facebook accounts for the purpose of allowing targeted advertisements (~10:54).

Joel Reidenberg, a professor of law, believes that the distinction between government and the private sector loses its meaning when we think of computing in the cloud (~ 15:10), but that the prospect of cloud computing also reinforces the need for fair information practice standards (~16:00). He is of the opinion that as computing moves into the cloud it will be easier to regulate centralized gate-keepers by law and/or by technical standards (~23:50).

• This is my first 'take away' from this video clip in that Professor Reidenberg reinforces the need for centralized standard setting bodies as I concluded in Portability, Traceability and Data Ownership - Part IV.
  

Marc Rotenberg, also a law professor, emphasizes that without user anonymity, and without transparency provided by the online companies, there will be no privacy for users in the cloud (~29:47 - 37:20). And in doing so Rotenberg challenges Tim Lee for his statement that there cannot be complete user privacy for online companies to provide the services they provide (~33.30). This actually makes for the most interesting exchanges of the video from the 38:00 minute mark to the 44:00 minute mark. 

There is also an interesting dialogue regarding the application of the Fourth Amendment. One of the conference attendees asked the panel why there had been no mention of the Fourth Amendment in any of their presentations. Here is the response from Reidenberg at the 53:30 mark:

"Cloud computing is threatening the vitality of the Fourth Amendment ... [because] the more we see centralization of data [by private, online companies], and the more that data is used for secondary purposes, the easier it is for the government to gain access outside the kind of restraints we put on states in the Fourth Amendment."

In other words, why should the government worry about overcoming Fourth Amendment hurdles about confiscating a person's data when it can sit back and relatively easily purchase or otherwise obtain the same personal data from the big online companies? And do so even in real-time? Why, indeed.

For me, the second 'take away' from this video is found in another cogent comment by Professor Reidenberg at the 88:53 mark:

"The [online] company that ... figures out ways of ... building into [its] compliance systems ... [privacy] compliance mechanisms ... will be putting itself at a tremendous competitive advantage for attracting the services to operate in [the cloud computing environment]."

The technological data ownership discussed and described in Portability, Traceability and Data Ownership - Part IV, supra, is a privacy compliance mechanism.

For those who are interested in the legalities and government policies revolving around burgeoning data ownership issues related to software as a service, the Semantic Web and Cloud Computing, and who are motivated to sit through a 90 minute presentation, here is the video clip ....

Update on Thursday, June 5, 2008 at 12:09PM by Steve Holcombe

In the United States, and notwithstanding the impotency of the Fourth Amendment protections against government search and seizure, it is an irony that the growing centralization of the Cloud may well render it more amenable to government regulation and lawsuit liability.

"Cloud computing opens doors for privacy enhancements [driven by regulation]. It's easier to target for regulation by law or by technical configuration [the] gatekeepers. So to the extent there is a central management, they're easier to find, they're easier to regulate, and they're easier to hold liable than distributed systems."

Quoting Reidenberg at the 23:50m mark.

The Disruption of Cloud Computing

Any move toward 'Cloud Computing', like any move toward the Semantic Web, will have to mean a greater and greater need for on-demand data traceability that goes way beyond mere password protection.

Listen to the NPR report, Cloud Computing Puts Computer Resources on Tap.

See also Peter Rip's journal entry entitled The Quiet Disruption in Process.

At the very least, data ownership is about on-demand data traceability. That is, knowing who is doing what with one's information when one wants to know.

People and businesses need to feel as comfortable with placing their valuable information into the hands of an online company as they are in placing their valuable money into the hands of their banker. See Banking on Granular Information Ownership.

The calculus is really just that simple.