Terry Gray
Aug 2008

1. What is it?
Ask ten people what cloud computing is and you'll get ten different answers, but the general idea is that you are using hardware and software that "belongs to someone else" and is accessed via the Internet "cloud". In fact, you may be using a lot of computers, in multiple data centers. Related concepts include "Software-as-a-Service" (SaaS), "Platform-as-a-Service" (PaaS), grid computing, utility computing (which derives from the parallel with the electrical power grid). In the case of SaaS you are typically using a web-based application (hosted "in the cloud" rather than at your own facility). With PaaS, you can run your own application, of any type, on someone else's computer (or cluster of computers).

2. Isn't this just grid computing?
Not exactly. There are a lot of parallels, but the term grid computing is most often used in the context of high-performance scientific computing, and several different scientific communities (e.g. physics) have each developed their own "grid middleware" to facilitate remote resource sharing and scheduling jobs across a distributed pool of comute and storage resources. Parallel algorithms that can leverage multiple computers concurrently are a major focus. In contrast, the major cloud computing purveyors are more focused on "consumer" computing needs.

3. Isn't this just like the old time-sharing service bureaus?
Yes, but with more modern capabilities, especially web-based GUI applications, and lots of clustering for scalability and redundancy. Advances in speed and availability of the "Internet cloud" was a key enabler, and the need for large compute clusters for Internet search drove the deployment of high-scale compute and storage infrastructure that is evolving into the next generation computing utility.

4. Is this just about "Google Apps"?
No, there are lots of cloud services being used today. For example:

• the usual suspects re email: Yahoo, AOL, Hotmail, Gmail, etc
• MS ExchangeLabs, Google Apps, Zoho, and a bunch of others for collab apps (cf oren's list from the QRM)
• Web publishing via project partners at other universities, gov labs, or commercial labs. (e.g. LIGO researchers apparently use a dozen different WIKIs...)
• Facebook, Youtube, Research1, etc.
• People here and elsewhere using their own apps running on PaaS providers (like Amazon's EC2 and S3 services).

5. Is anyone at UW really using these services yet?
Yes:

• about 1/3 of our students forward their email to cloud providers.
• when Google introduced their "Team Edition" offering, over 500 UW individuals signed up.
• many (but we have no data on how many) faculty/staff currently use cloud-based collaborative apps as an integral part of their daily work; notably Google Calendar and Google documents.

6. There has been a lot of talk about the privacy, security, and compliance (e.g. eDiscovery) risks associated with the Google "Apps for Edu" offering. What's the scoop?
There are risks associated with information technology provisioned ourselves, and there are certainly risks associated with cloud computing. Opinions vary on the tradeoffs, but our experts are working on assessments and policy recommendations to address the general issue of "non-UW computing", not just the Google and MS cloud offerings.

7. Doesn't a contract with Google, MS, Amazon, etc, create unnecessary risk for UW?
A UW contract (with Google, MS, etc) helps UW manage and contain our risk; it doesn't create the risk --which exists already. That's because a) people are already using these services as individuals; b) one contract is better than many slightly different ones; c) a contract allows us to carry out our compliance obligations that we cannot currently do; and d) a contract is an enabler, it is not itself coercive, in terms of driving people unwillingly into the cloud.

8. Aren't there things we should not use cloud services for?
Of course. No one is talking about putting all manor of sensitive stuff in the cloud, and we need **UW policies** to help people navigate the choices. These are needed regardless of whether or not we have Google or MS cloud contracts.

9. Isn't it true that no large corporations are using these services due to security and compliance concerns?
The primary target for the cloud providers today is individuals and small/medium sized businesses, who do not have or seek their own IT departments. If you model a research university as a federation of a thousand independent businesses, or a hundred thousand individuals, we fit into that target demographic. However, I am aware of some *very* large companies that are seriously assessing use of cloud-apps in order to leverage the cost advantages of high-scale service providers --in spite of security and compliance concerns. MS has stated they expect 25% of their Office customers to be using some MS cloud services within a couple of years. Google doesn't disclose comprehensive customer info, but an article on a recent GMail outage included the following: "More than 500,000 businesses and universities with about 10 million active users have signed up for the free and fee-based versions of Google Apps."

10. If we ignore this problem, won't it just go away?
No, it will get worse. Cloud computing is happening, whether we like it or not. We can choose to ignore it, but if we do, the natural evolution of such things will lead to a more chaotic, more risk-inherent scenario, than if we quickly establish institutional guidelines and contracts that permit us to carry out our compliance obligations at an institutional level.