Recently Jonathan Zittrain, a law professor at Harvard, and the author of “The Future of the Internet — And How to Stop It” published an op ed piece “Lost in the Cloud” in the New York Times. The article was forwarded to me by a number of IT security colleagues along comments like “I told you that cloud computing is risky.” I’ve ordered Professor Zittrain’s book, ironically from Amazon, a cloud computing pioneer, to more fully explore his ideas. But in the meantime, let's take a look at the "real dangers" that Zittrain claims come with the cloud.
The typical fears: financial stability, security and data privacy in the cloud
In the article, Zittrain cites the typical fears about financial stability, security and data privacy and backs these up with examples about online subscription services going out of business, the recent hack of a Twitter employee’s account, the Feds abusing the authority granted by the Patriot Act and the admittedly egregious Internet monitoring by the Chinese government. Each of these examples has more nuance than suggested, and represent a phases of growth vs. being "showstoppers."
1) Financial stability/long-term viability of online services: My local newspaper or manufacturing company is just as much, if not more, at risk of going out of business (they just stopped printing a Monday edition) than a reputable cloud provider. Last check, iTunes and Google, are a safer bet. As with any business relationship, choose your partners carefully and have a backup plan... but don’t fail to act.
2) Security of online services: The Twitter hack was great example of user naivete about strong passwords, but any company that provides remote access to their internal systems would be equally vulnerable. In addition to teaching users how to make good password choices, options exist to improve login security via multi-factor authentication from companies like Ping Identity and MyOneLogin. What the cloud does is provide more transparency around "what is secure" across people, processes and technology. It also provides a better view of where risk lies so that companies can take the right actions. For security addressing only the subset you know about doesn't make things better - in this case ignorance is not bliss.
3) Data privacy: Without debating what constitutes appropriate governmental access to private data, it is fair to say that governments can overstep their bounds. I agree with Professor Zittrain that my data on the cloud should be afforded a degree of legal protection equivalent to my data stored in my house. As with any disruptive technology, the cloud will require adjusting (or perhaps rewriting) existing laws and regulations. His comments that “With a little effort and political will, we can solve these problems” certainly rings true. Cloud providers will need to develop corresponding capabilities to ensure compliance with the intent of regulations.
A more concerning fear: does the cloud really reduce our ability innovate?
The most concerning statement by Professor Zittrain is that the cloud puts “the freedom to innovate" at risk. His concern about the cloud is that “the vendor of a platform has much more control over whether and how to let others write new software”. His cited examples are Facebook and Apple. Perhaps SAP and Oracle would be his examples of inspiring innovation ?
I grew up with the PC revolution. I wrote my first line of code at 12 on an Apple II which my parents paid several thousand dollars to acquire. I worked within the limitations of 48KB RAM, 140KB floppy disk drives, and Apple BASIC (with the occasional peek in to 6502 Assembly to do the tricky stuff). Today, because of the cloud my 8-year-old son has virtually infinite access to compute power, languages, databases, open source tools, etc. for free or pennies to use. Not only does he have significantly greater freedom to innovate, he will be able to innovate much more rapidly than his old man, because the cloud has eliminated the burden of building, maintaining and understanding the infrastructure (hardware, operating system, etc.) required.
Professor Zittrain’s concern is that the market could settle in to a handful of “gated” cloud communities who control the availability of new code. He believes that software developers are writing “less adventurous, less subversive, less game-changing code under the watchful eyes of Facebook and Apple”. But, as Professor Zittrain himself cites, far less restrictive development environments exist in Amazon Web Services, Salesforce's Force.com, Google App Engine and Google Android to name just a few. Although the ecosystem of cloud providers will certainly evolve over the next decade, I cannot imagine that we will end up with a few “gated” providers that are anywhere close to the level of restriction imposed by today's enterprise software vendors and architectures. The Internet and the cloud change the drivers for the vendor - it still wouldn't be in their best interest to stifle innovation (as David Schatsky explains in his response to Professor Zittrain).
Our conclusion: the cloud will drive enterprise IT innovation
The ability to innovate has and will be lost without cloud. The contrast between consumer and business driven technology innovation over the last decade is a staggering proof point - online banking and trading, job search, finding where I am going and what to do, e-commerce, social networking and a score of other innovations ranging from mission critical to just fun have made it nearly impossible to remember how we survived pre-Internet. The cloud can bring that level of innovation and productivity to enterprise IT. After all, its hard to imagine my eight year old or anyone in the future workplace settling for less than the near infinite scale and freedom cloud computing.