When Your Data's In The Cloud, Is It Still Your Data?

Your contract with a cloud provider should have language clearly affirming your ownership of your data.

By Thomas J. Trappler

Computerworld - When your data resides on a cloud provider's infrastructure, your ownership rights could be compromised. For example, what's to prevent the cloud provider from deciding to access your data and use it for its own purposes? That's why any contract for cloud services should include language clearly affirming your ownership of your data.

The good news is that well-established cloud vendors are beginning to include language along these lines in their standard contracts. For example, section 10.2 of the Amazon Web Services contract states:

"Your Applications, Data and Content. Other than the rights and interests expressly set forth in this Agreement, and excluding Amazon Properties and works derived from Amazon Properties, you reserve all right, title and interest (including all intellectual property and proprietary rights) in and to Your Content."

It hasn't always been this way with cloud computing, but as customers have voiced their ownership requirements, providers have made improvements in this area. As the cloud continues to evolve, if customers clearly state their needs, then smart cloud providers will listen and respond.

Other columns by Thomas Trappler

• When your data's in the cloud, is it still your data?
• Cloud adviser: Where's your data?
• Making sure your cloud provider can protect your data as promised
• Where there are clouds, there's lightning (and other cloud disaster tips)
• Why physical security matters, even in the cloud
• The Cloud Contract Adviser: Making sure your information is secure
• The Cloud Contract Adviser: Know your provider's infrastructure
• The Cloud Contract Adviser: Service-level agreements

Opinions 

Depending on the nature of your data and how it's processed in the cloud, it may also be necessary for the contract to include language affirming your institution's ownership of the results of any processing of its data that occurs while on the cloud provider's system.

With ownership clarified, the next step is to identify the limitations on how the cloud provider may use your data. In most cases, you'll want to limit the provider's use solely to that which is necessary for it to fulfill its obligations under the contract. It is also prudent to specifically exclude the provider from any mining of your data.

Be ready for the divorce

Once your data and processes have moved to cloud, you become more dependent upon the provider. You could be locked into its services, a situation that increases the cloud providers leverage over you in negotiating contract terms.

I know this sounds like advising someone to find a divorce lawyer before getting married, but to mitigate the risk of vendor lock-in, you need to plan in advance for the eventuality that you may decide to switch to a different provider or bring your data and processes back in-house. With this in mind, the contract should state your rights to access your data on an ongoing basis. Specifically, the contract should:

• Describe the process by which your data will be returned, whether done midterm or upon contract termination.
• State the amount of time the provider will have to turn over your data.
• Define how long after termination of the contract your data will remain accessible.
• Quantify the cost to you (ideally none) to export your data.
• Specify that the data must be provided in a commonly used format that is pertinent to your expected needs, and not in a proprietary or otherwise inaccessible format.

Some vendors have begun to embrace these ideas. For example, see Google's Data Liberation Front efforts and Microsoft's Office 365 commitments regarding Data Portability.

Other access issues

When codifying your rights to access your data, be sure to consider emergency situations. For example, e-discovery obligations to preserve, collect and produce data for litigation-related discovery actions can be more difficult to comply with when your data is in the cloud, because you do not have direct control. Yet your failure to produce pertinent data in a timely manner can result in significant fines. This risk can be mitigated by contractually requiring the cloud provider to establish mechanisms by which you can retrieve your data within a specified time frame.

Finally, the contract should obligate the provider to destroy your data after termination of the contract and should specify the manner in which this should be done, the time frame for doing so, the need for the cloud provider to produce certification of destruction, and your right to audit.

Are CIOs Missing the Cloud?

Four disruptive forces are causing executive teams to reconsider how the CIO function will add strategic value in a world where cloud computing, distributed architectures and mobile ubiquity are givens for future competitiveness.

·                       Rising Server-to-Admin Ratios

When 25 physical servers for each IT admin was the norm, CIOs built organizational structures suited to that reality. Hiring, training, reporting lines, compensation, key success factors, annual reviews, career advancement and social norms were all built around that 25:1 ratio. Now, enterprise IT is facing the near-term reality of ratios that are 100:1, 500:1 or even 1,000:1. Google is rumored to be aiming for a 10,000:1 goal.

This massive increase in administrative density signals wholesale changes in the enterprise IT org chart. It changes who is hired, what skills they must have, how they will be trained and managed, evaluated and compensated, how they interact with and support business units, and what their long-term career paths will look like.

·                       IT Becomes a Variable Cost

In the early 90s, when the CIO title was gaining popularity, the chief driver for bringing IT into the executive suite was the massive capital allocations required to give organizations a competitive advantage through rapidly changing technologies. These technologies demanded larger and larger percentages of the corporate budget, so a direct line to the president or CEO was paramount in justifying these spends.

Cloud and next-generation IT strategies dramatically change this. What was once CAPEX increasingly becomes OPEX, and long-term risk falls accordingly. So, where’s the strategic value in having IT in the executive suite? Arguably, it’s more important than ever.

The increase in business agility and responsiveness that cloud computing makes possible shifts the strategic value of the CIO from a technical role to a business role. CIOs must understand the functions they support, so they can help these functions quickly put the infrastructure and applications in place to support quickly moving new ideas to market, testing them, and iterating them to general release. Competitors will be doing this (and already are, in several industries).

·                       End-User Auto Provisioning

End users are gaining a level of power that makes past demands for integration of Blackberries and iPhones seem whimsical by comparison. CIOs accustomed to pushing back against new ideas based on security threats and support burdens will increasingly find themselves cut out of the deal by end users who can go online and provision SaaS (software as a service) and IaaS (infrastructure as a service) with a credit card.

As Vivek Kundra, until recently the White House CIO, has said, “the more a CIO says ‘no,’ the less secure his organization becomes.”

·                       Infrastructure Becomes Commodity

New — and largely uninvented — processes are required to deal with all of this change. Governance, compliance and security are all matters that 20 years of client/server policy is ill equipped to deal with. On top of this, CIOs must develop policies for the rapid growth of collaboration technologies (and, yes, social media) that employees will increasingly require in order to do the job the CEO is asking of them.

These shifts signal the need for the new CIO to bring an entirely new set of skills to the game. Yes, the new CIO’s job will continue to require an understanding of infrastructure and architecture, but a knowledge of how to turn the dials and knobs will be far less important tomorrow than it was yesterday. Tomorrow’s winning CIO will bring an MBA’s understanding of finance, marketing, operations, HR and the other functions. CIOs will understand how to say “yes” to new services that make their companies competitive, while mitigating risks and allowing for small-scale failures in the pursuit of long-term success.

Written by Scott Bils

Scott Bils is a partner at the Everest Group, an IT consulting firm.

Cloud Video Startup Zixi Raises $4M

As more and more companies look at cloud computing as the next wave and to save on IT infrastructure costs the cloud is growing in video as well. 


Cloud video startup Zixi has raises $4 million in a round of funding for its web video broadcasting business.

The Waltham, Mass.-based company will use the money to build out a worldwide team and complete its infrastructure for delivering high-definition video via the cloud, or web-connected data centers. The company focuses on delivering cloud video with high quality, security, and the ability to make a return on investment.

Schooner Capital, a Boston-based private investment firm, led the round. Other investors include Sidney Topol, former chief executive of Scientific Atlanta, and Maurice Schonfeld, former CEO of CNN.

Zixi’s chief executive is Israel Drori. He said the company will offer high-quality video over the internet for broadcast, enterprise and video-on-demand services. Potential customers include companies that operate networks, video-on-demand services, web broadcasts, and device makers. Zixi could be used to broadcast video such as a Netflix streaming movie to a tablet computer or a smartphone without any noticeable hiccups. Customers include CNN, Reuters, CBS Sports and Netgear.

Zixi tries to set itself apart by making the best use of available network bandwidth. It minimizes startup delay, or the seconds it takes to launch a video, and eliminates buffering (or loading video into memory to ensure smooth playback) without sacrificing quality.

A company could use Zixi to securely telecast a high-definition video conference to multiple locations around the world in real time with low infrastructure costs. Zixi was founded in 2006 and it has 11 employees. Check out the Youtube demo: http://www.youtube.com/watch?v=B2KGkz9qtwk&feature=player_embedded