Towards a HumanCentred Cloud Computing:
an International Perspective on the Public Interest
The paradigm shift as a result of cloud computing has been addressed by IFIP and has lead to some observations that deserve follow up work. Looking at Cloud Computing as a SocioTecnical System, it is transforming the global Information and Communication Technologies (ICT) scenario: ICT become ICTasaservice. While this development represents one of the main leaps in the evolution of computing, it also
has many consequences from the social, organizational, and environmental point of views. For many organizations the use of ICT services “ondemand” is an opportunity that offers great flexibility and innovation. From another point of view Cloud Computing represents a big shift back again towards centralized architectures, where endusers and organizations consume ondemand resources provided by very large datacentres, and service centres.
–
IFIP proposes the following recommendations:
–
1. For all organizations
–
Since many resources would depend from an outside provider, when signing a contract with cloud providers, organizations should:
–
- understand that cloud computing cannot outsource the responsibility and
accountability of the management; - fully understand the risks associated with cloud computing adoption;
- understand that the borders of the organization and the corresponding information flows
may change (redefinition of the ‘perimeter’ of the organization); - carefully define the chain of domains of responsibility in the agreements;
- consider the new role for ICT personnel that will need new skills and competences for
governing ICT and data and for acting as a partner of the corebusiness,
ICT governance competences become critical; - consider the need of provider traceability and fourhands
authorization in some cases; - look into the importance of the location of data for jurisdiction and compliance
requirements - consider the issues of ownership and use of information stored and processed in the cloud;
- consider the nature of data and accordingly consider privacy and data security aspects
- including data encryption, strong authentication, and esignature;
address the risk of provider lockins - by asking for open formats, including the data portability to another provider among the requirements;
- apply notification laws (in case of data leaks) consider hybrid cloud solutions where mission critical data and applications are retained internally, while nonmission
- critical data and applications are purchased from cloud
providers.
–
2. For individuals
–
Users will have to be aware that, for various reasons, their personal data will be collected in Big Data repositories for analytics, data mining and profiling applications (for commercial and for public security applications).
–
3. For Public Policy Makers
–
Cloud computing is definitely a direction encouraged by the public authorities around the
world even if it also evident that coordination is required at policy and standardization levels.
–
Recommendations are:
–
- National and regional authorities should encourage their agencies to consider
adoption of cloud computing solutions for sharing services and resources, reducing costs,
standardize applications, and optimizing processes (e.g. the Internet Plus Government
Services in China); - Regional governments should consider Community Clouds for reaching an optimal
balance between cost savings and security: with cloud computing many local small datacentres - can be consolidated in one single “regional” datacentre delivering cloud computing
services to local public agencies; - Policy makers should help in harmonizing the different technical standards (like the
Cloud Native Computing Foundation for facilitating the building of cloud native applications and services, and other emerging “de jure” and “de facto” standards for interoperability) and legal frameworks taking into account the UN Human Rights Declaration, and help defining fair contract terms and agreements; it is important to underline that the place of storage or computation determines the legal situation of the data; - National authorities should work in harmonising the different levels of Data Privacy laws
worldwide and security for transborder dataflows; the accumulation of personal data
at a global scale in the Big Data repositories of the cloud introduces risks for individual
privacy and national security at a scale that will require international policies and
norms to be established; with cloud computing it becomes of fundamental importance data location and international policies, norms and legislation; - National authorities should encourage the wise use of ICT (e.g. in functional optimization,
processes streamlining, dematerialization) but should also increase awareness about the
impact on climate change for example due to the powering of large datacentres
and the production, use, and disposal of ICT itself; - National authorities should encourage the distribution of storage and processing
power at national or regional level in order to avoid the risks of cultural imperialism and
difficulties in dealing with diversity due to the concentration of major cloud providers in
certain countries or regions; - The scientific community is looking at cloud computing with interest since the cloud, with the promise of theoretically unlimited availability of computing power, can be an immense resource for scientific applications. National authorities should encourage the collection of computing resources that can be made available to the scientific community for public research. This resource sharing (storage and computation) could be also promoted at international level. This can be a base for a global proposal, that IFIP could support, like a Global Computing Scientific Cloud (similar to what the European CERN made in Physics or to the Research Data Storage Infrastructure (RDSI) project in Australia). This could represent a strong push for the evolution of cloud technology, and an opportunity for avoiding the commercial takeover of computational science.
–
IFIP will establish specific collaborations on Cloud Computing with its’ member societies and their committees on societal aspects.
–
For more info see IFIPDCCC Position Paper at www.ifip.org
