How To Understand Cloud Computing

Transcription

1 Cloud Computing The Rise of Service-Based Computing i

2 CLOUD COMPUTING: THE RISE OF SERVICE-BASED COMPUTING KEMP LITTLE LLP TABLE OF CONTENTS A. INTRODUCTION The move to the Cloud: under way, but at the beginning of the shift Scope Service-based computing Four stages of service-based computing: ASP, SaaS, cloud and utility SaaS characteristics Cloud computing characteristics X aas IaaS and PaaS Utility computing characteristics Cloud and utility vs grid and on demand User benefits of service-based computing... 4 B. SOFTWARE DEPLOYMENT TECHNIQUES FOR THE CLOUD: VIRTUALISATION, OSS, SOA AND APPS Software development techniques as Cloud accelerators Virtualisation OSS SOA Apps... 7 C. THE MOVE TO THE CLOUD: ADDRESSING THE ORGANISATIONAL ISSUES Introductory The compelling supply-side economics of the Cloud A structured approach to Cloud migration Policy considerations (1): the Commission Communication on Unleashing the Cloud Policy considerations (2): data protection Policy considerations: (3): sector specific regulation Policy considerations (4): law enforcement Policy considerations (5): the Cloud and standards The BSA s Global Cloud Computing Scorecard Cognitively addressing organisational change D. SERVICE-BASED COMPUTING: LEGAL ISSUES AND CHECKLIST Contracting in the Cloud Key issues Supplier stability what if the supplier goes bust? Customer service/dependence what s the worst that can happen? Lifecycle contract issues Regulatory issues to be addressed in contract negotiations ii -

3 CLOUD COMPUTING: THE RISE OF SERVICE-BASED COMPUTING 1 A. INTRODUCTION 1. The move to the Cloud: under way, but at the start of the shift. The move to the Cloud, and the generational shift in computing that it represents, is well under way at the start of 2013, but we are still at the start of the journey. Illustrating the point, Amazon Web Services head Andy Jassy speaking at the end of analogised the shift to the Cloud with the development of the electricity grid: "One hundred and fifty years ago, most companies generated their own electricity on the premises and it was a completely natural thing to do. But then, with the advent of the grid, the economies were such that it didn t really make sense to generate your own electricity, even though you could. I think that we re at the beginning of a similar shift." Just how far this change will take us is brought home by the US National Intelligence Council (NIC) in its Global Trends 2030: Alternative Worlds report published on 10 December 2012 aimed at stimulating thought about possible global trajectories during the next 15 to 20 years. In characterising the role of IT as one of a number of game-changers, the report spoke of the coming comprehensiveness and pervasiveness of the Cloud: Information technology is entering the big data era. Process power and data storage are becoming almost free; networks and the cloud will provide global access and pervasive services; social media and cybersecurity will be large new markets. This growth and diffusion will present significant challenges for governments and societies, which must find ways to capture the benefits of new IT technologies 3 The NIC foresees three trends and four technological developments accelerating the use of IT globally by The trends, really applications of Moore s law that computer processor power doubles every eighteen months, are that computer memory costs will drop to 5% of today s prices, data storage prices will be 1% of today s and network efficiency will increase by a factor of over 200. The technological developments are the coming supremacy of mobile devices, cheap and smart digital storage, bots for running automated tasks and the Cloud, of which it says: The shift to cloud architecture will improve utilization rates of computing infrastructure and optimize network use. The cloud also will put increased computing capability and meaningful analysis in the hands of 80 percent of the world s population Scope. Against this background, this paper overviews Cloud computing in the context of the rise of servicebased computing generally and reviews what it is, where it has come from and where it is going (this Section A); considers the associated software deployment techniques like OSS, virtualisation, SOA and Apps that are accelerating the availability and adoption of service-based computing generally (Section B); reviews key economic, strategic, policy and organisational drivers and issues that an organisation must address as the move to the Cloud gets firmly underway (Section C); and, from a legal perspective, briefly looks at the ins and outs of Cloud service contracts (Section D). 3. Service-based computing. Service-based computing and the Cloud are all about the Internet, a digital river in full spate. The Internet has enabled new service delivery techniques for software that are now rapidly 1 Richard Kemp, Andrew Joint, Rebecca Anderson, Ed Baker, Calum Murray and Kathryn Dooks, Global Trends 2030: Alternate Worlds, p.ix (National Intelligence Council, December 2012) at page ix 4 Ibid, at page 55 1

4 hardware software internet data services Copyright in Software Cases of 2012 displacing the traditional software licensing models that held sway since the software industry was born when IBM first unbundled software from hardware in 1969 (see Figure 1: the Rise of Service-Based Computing). Figure 1 the Rise of Service-Based Computing Mid 60s to early 80s: IBM heyday 80s: rise of the PC 90s to mid-00 s: Wintel heyday Mid 00s onwards: Google heyday 10s: rise of Cloud & Big Data Utility Computing Cloud Computing SaaS ASP adoption Outsourcing ITO BPO LPO, etc Cloud data standards Advent of data centres Advent of 100k+ server data centres early/mid 60s: development of packet switching 1969: the software industry is born as IBM unbundles hardware & software 1969: first ARPANET message sent 1970: UNIX released by AT&T 1981: Microsoft develops MS-DOS 1989: first message between http client & server via internet 1985: open source FSF set up 1995: Netscape IPO ; Bill Gates Internet tidal wave memo 1990: Microsoft launches Windows : Linux Early 2000s onwards: broadband replaces dial up internet 2001:.com bust mid 00s onwards: open source (OSS) in the mainstream 2004: Google, salesforce.com IPOs; web 2.0 Key product launches 2008: 2012: Android, Windows 8, Chrome, Azure ios6 2007: IPO of hypervisor developer VMware 1940s: Adoption of programmable computer 1957: IBM 1964: IBM introduces introduces FORTRAN System 360 programming computer language family 1971: Intel 4004 the first microprocessor developed 1981: IBM 90s: rise of launches 1984: PC Apple laptops Mac 1984: launched Apple Mac launched 00s: rise of anytime PDAs anywhere devices 2001: 2007: launch ipod launched of iphone Rise of Smartphones, Tablets, etc 2010: launch of ipad 1940s 1950s 1960s 1970s 1980s 1990s 2000s 2010s 4. Four stages of service-based computing: ASP, SaaS, cloud and utility. Easy to use, faster, and more secure, reliable and scalable broadband Internet communications connections lie at the heart of the rise of service-based computing, with ASP (application service provision), SaaS (software as a service), cloud computing and utility computing as stages one to four. Table 1 below describes the key attributes of each stage. Internet access, periodical payment on a subscription basis, and provision on a one to many basis characterise all these stages, but ASP is properly characterised as hosted application management and although still popular today is viewed as rather cumbersome outside the enterprise (large system/requirement) market. 5. SaaS characteristics. There is a step change between ASP and SaaS, with the latter characterised by: built for the web applications; supply of web ready services to the customer; the addressing of consumer as well as professional markets; supply through a one to many secure delivery model; and - 2 -

5 an incremental pay per use basis. Table 1: Four Stages of Service-Based Computing 1. ASP (Application Service Provision) 2. SaaS (Software as a Service) 3. Cloud computing 4. utility computing The first stage of service-based computing, enabled from the mid-1990s onwards by the advent of faster modems and routers. ASP substituted software on servers at the customer s computer room with software on servers at the ASP supplier s centrally managed ( one to many ) data centre, plus Internet access and an HTML web interface at the client PC. Properly viewed as Hosted Application Management, ASP has benefited from bigger bandwidth but still relies (at the start of the relationship) on significant configuration/installation services and (throughout) on support services, typically supplied separately. The second stage of service-based computing. SaaS is an Internet-based, built for the web, web ready, one to many model for secure, centralised software delivery. SaaS benefits from faster and more extensive development and feature updating. It is typically priced on a periodical, per-seat/user basis, scaled according to service features, resilience levels and storage space. The generic nature of the SaaS model makes it inherently scalable and adaptable to different lines of business (like CRM (Customer Relationship Management) HR/payroll and Accounts) and market segments (consumer and small/medium business, in addition to larger organisations). In accessing software in this way, a customer does not need to buy/license, install or run the software on its own computers and so eliminates the need to maintain or update the software. Example: Salesforce.com with its market leading SaaS/cloud computing CRM service. The third stage of service-based computing. The Cloud is the traditional metaphor for the Internet, and Cloud computing is the mass market availability through the Internet of the whole range of scalable computer technology-enabled resources provided as a service. Example: searching for flights online. In addition to SaaS, Cloud computing facilitates IaaS (Infrastructure as a Service) and PaaS (Platform as a Service). In the public cloud, Cloud computing services are made available commercially by a third party service provider. A private cloud is a Cloud implementation inside the organisation s firewall and under the control of the organisation s IT group using virtualised servers to provide similar features and benefits to the public cloud. G-Cloud is HMG s private Government Cloud Computing Infrastructure including SaaS, IaaS and PaaS offerings. The fourth stage of service-based computing. Utility computing is the aggregation and packaging up of different computing resources (input, processing, storage, programming, output, communications, etc.) for supply on a metered basis, like electricity or any other utility. 6. Cloud computing characteristics. The evolution from SaaS to cloud computing is marked by the massive scalability of computing services provided through the cloud, the traditional metaphor for the Internet as the communications network between the customer and the computer resources it is accessing. In practical terms, the massive scalability of cloud computing means moving to bigger and bigger data centres think of TV images of futuristic, low, windowless warehouses the size of five football fields on the banks of the Columbia River in Oregon, USA. Line of business based services proving fertile ground for the uptake of cloud computing include, in addition to CRM, HR and accounts, web-conferencing and collaboration; supply chain; budget/expenses management; web content management; e-commerce; and and marketing

6 7. X aas IaaS and PaaS. In addition to SaaS, the Cloud also facilitates the supply of each of infrastructure, platform and network as a service, the real reason why the development of the Cloud is spoken of as the rise of service-based computing. IaaS (infrastructure as a service) offers computers as physical or more frequently virtual machines run by hypervisors within the Cloud operational system (see Table 3 below). Under the PaaS (platform as a service) model, the whole computing platform environment is supplied, consisting of operating system, programming language, execution environment, database and webserver. Other embryonic services include NaaS (network as a service) and CaaS (communications as a service). 8. Utility computing characteristics. In utility computing, all the computing resources needed for performing particular tasks data input, processing, programming, storage, output and communications - will be able to be assembled and packaged into the required customer service for supply on a metered basis like electricity. 9. Cloud and utility vs grid and on demand. Table 2 below aims to clarify some confusion around taxonomy on service-based computing by distinguishing cloud computing and utility computing (on the one hand) from grid computing a form of distributed computing and on demand computing - a portmanteau term that can be used to cover any computing not based on locally resident and used software on the other. 10. User benefits of service-based computing. Service-based computing, particularly the stages after ASP, offers a number of benefits for the customer. First, it can substitute upfront capital expenditure system costs with regularly recurring operating costs: in the Cloud a user tends not to have to make the significant investments in its own infrastructure and resources servers, space, security, staff, etc. that it does when implementing a particular software developer s licensed-in solution. Second, supplier dependence is reduced, and switching to an alternative service provider becomes a practical possibility. Avoiding the need for high sunk costs and the ability to switch suppliers are direct consequences of the rise of service-based computing. They represent far-reaching changes to the software business model and will lead to more choice, greater competition, faster innovation and lower prices. Table 2: Cloud and Utility vs Grid and On-Demand Computing cloud computing grid computing on demand computing utility computing The cloud is the traditional metaphor for the Internet, and cloud computing is the mass market availability through the Internet of the whole range of software (SaaS), infrastructure, (IaaS), platform (PaaS), and more generally computer and communications technology-enabled resources, provided as a service. Example: searching for flights online. Effectively a form of distributed computing that constitutes a virtual (i.e. temporary) computer capability from separate computers, grid computing is a type of platform virtualisation involving the harnessing of a number (which may be very many) of different computers by means of software that allocates the work and tasks to be carried out. A generic name for computing that is service-based including ASP, SaaS, cloud computing and utility computing. Example: ERP software provider Oracle offers its software as a licence, or on demand as a managed subscription service. Utility computing is the aggregation and packaging up of different computing resources (input, processing, storage, programming, output, communications, etc.) for supply on a metered basis, like electricity or another utility

7 B. SOFTWARE DEPLOYMENT TECHNIQUES FOR THE CLOUD: VIRTUALISATION, OSS, SOA AND APPS 11. Software development techniques as Cloud accelerators. The rise of cloud computing is accelerated by a number of rapidly evolving software development, assembly and integration techniques that all themselves benefit from and rely on the Internet. These techniques are virtualisation, OSS (open source software), SOA (service oriented architecture) and Apps and they are described in table 3 below. 12. Virtualisation. Essentially, virtualisation s software hypervisor enables different computers to be yoked together, and individual servers can be used more efficiently by replicating separate instances of the server s operating system to reach the parts ordinary software cannot reach and use otherwise unutilised resources of the server, raising sometimes tricky licensing issues for software licensed on a per server basis. Table 3: Virtualisation, OSS, SOA and Apps - Software Development Techniques Accelerating the Rise of Service-Based Computing App A small (in terms of code size) piece of application software that resides on the device (a smartphone or a tablet is envisaged) as a front end that generally enables the device user to access a corporate customer s service. Examples: Google Apps Marketplace, Apple App Store, Microsoft Marketplace. Hypervisor OSS (Open Source Software) Metadata SOA (Service Oriented Architecture) For virtualisation, the hypervisor is the software that allows the creation or supervision of multiple virtual operating systems running simultaneously on the same computer effectively creating multiple virtual platforms on the same hardware. Example: VMware s ESX Server 3i hypervisor. Software provided under a licence that meets the three key requirements of the Open Source Definition (OSD see 1. the software must be available for redistribution without payment; 2. the software must be distributed either with the source code or well publicised access to the source code; and 3. software modification and distribution of derived works must be permitted. Data about data : digitised classification data which describes the context, content and structure of other digitised data including business and personal data, music, films, video, etc. (see SOA). SOA is built (architected) around associating (orienting) the business processes (services) in the customer s requirement with the particular services and processes performed by the supplier s software. SOA has three essential elements: 1. orchestration software: effectively a Metadata list of available application software to choose from, orchestration' is the software representation of the process of selecting, linking and sequencing the services to be performed by the application software to meet the customer s business process requirement; 2. the ESB (Enterprise Service Bus): middleware software that sits below the orchestration software and above the application software. The ESB is a messaging framework that enables the available software applications and languages (e.g. XML, FTP, JMS, Web Services, JDBC, HTTP) to be connected and data exchanged between them. More technically, the ESB provides the abstraction and messaging system layers that enable integration; and 3. application software: the software that sits under the ESB & selected through the orchestration software and integrated through the ESB to perform the functions required by the customer. Example: Starwood Hotels and Resorts Worldwide s new SOA room-reservation - 5 -

8 virtualisation service The technique of using software to run one or more operating systems on a host computer, including operating systems not written specifically for that hardware (platform virtualisation) or to reach the computing resources that ordinary software cannot reach by aggregating individual computing resources into a smaller number of more powerful resources (resource virtualisation). 13. OSS. OSS 5 is a software licensing technique which can come with a sting in the tail, enabling IT departments to download free of charge from Internet sites like software that performs basic tasks so that their expensive in-house programming resource can work on higher value projects: free availability makes OSS the CIO s boon, the licensing sting in the tail makes it the GC s burden. 14. SOA. SOA (service orientated architecture) consists of three key elements - orchestration (the menu), the Enterprise Service Bus (ESB - the message centre) and application software - which together enable users to map their required business processes to software able to perform those processes and to associate the processes and software by selecting, linking and sequencing them in the right way. The way SOA works is ideal for the remote and distributed processing central to service-based computing and SOA is currently undergoing significant increase in take up. Figure 2 Mobile Apps: Actors and Contract Componentry Mobile Apps: (1) Actors Software Supplier Corporate Customer large or small company Using app as web subchannel to: fulfil sales (e.g. music, film/tv, news, software or other digital content) take orders (e.g. online retailing) Appstore Provider e.g.: Google Apps Marketplace Apple App Store, Microsoft Markteplace Nokia App Store Payment Services Provider Provided in house by the Appstore Provider (e.g. Microsoft) or via a third party (e.g. Paypal) End User/Customer three types of app: Self-contained on device (e.g. clock) front end to back end service (non-paying) front end to back end service (paying) Mobile Apps: (2) Contract Componentry CC/SS Mobile App Development Agreement Agreement between Appstore provider and: software supplier/developer distribution agreement Or corporate or other customer (typically standard form agreement offered by Appstore Provider) Part of Appstore provider agreement (where in house); separate agreement required in other cases Minimum End ) user customer ) terms typically ) mandated in ) Appstore ) Provider ) Agreement 5 For further information see our white paper Open Source Software: Freedoms, Responsibilities and Governance f - 6 -

9 15. Apps. Apps are small software applications that reside on a smartphone or tablet. Generally, they operate as a front end to enable the user of the device to access a service provided by the app developer or a third party. The App ecosystem can be complex, but typically centres on the provider of the App store with the user downloading the app (which may be free or charged for) from the store in order to access the service the App connects with (which again may be with or without charge). Figure 2 describes the actors in the mobile App world and the contract componentry involved. C. THE MOVE TO THE CLOUD: ADDRESSING THE ORGANISATIONAL ISSUES 16. Introductory. The move to the Cloud is initiating a number of strategic changes as organisations grapple with what service based computing means for them. These changes confront organisations with important choices to be addressed, particularly around the economic implications of the Cloud (investing in long term cost saving); the timing of what processes, data and applications migrate to the Cloud and when; policy and regulatory considerations around data protection, sector specific regulation, law enforcement and Cloud standards; and organisational change, particularly within the IT department. 17. The compelling supply-side economics of the Cloud. The transition to the Cloud is driven by the compelling supply-side economics of the evolution of large data centres (DCs). With around 3,000 DCs, the USA is fast moving towards DCs with more than 100,000 servers located within a mile of a hydroelectricity (HEP) source, driven by the competitive need to reduce the two largest components of DC costs - processing and power. Figure 3 - The Cost Benefit of the Public Cloud 6 This DC evolution represents a significant cost savings opportunity to larger organisations as it will enable significant parts of their IT spend to be reduced. A Microsoft November 2010 paper Economics of the Cloud 7 articulated these changing economics: 6 Figure 22 page 15, The Economics of the Cloud, Microsoft Nov %20the%20cloud&cp=50&gs_id=73&xhr=t&q=the%20economics%20of%20the%20cloud%20Microsoft%20November%202010&pf=p&t bo=d&sclient=psy

10 Cloud technology standardizes and pools IT resources and automates many of the maintenance tasks done manually today. Cloud architectures facilitate elastic consumption, self-service, and pay-as-you-go pricing. Cloud also allows core IT infrastructure to be brought into large data centers that take advantage of significant economies of scale in three areas: supply-side savings: large-scale data centers lower costs per server. demand-side aggregation: aggregating demand for computing smooths overall variability, allowing server utilization rates to increase. multi-tenancy efficiency: when changing to a multi-tenant application model, increasing the number of tenants (i.e., customers or users) lowers the application management and server cost per tenant. At present, IT department spend breaks down between new application development, existing application maintenance and infrastructure very roughly in the proportions 1 : 4 : 5. The Cloud will help facilitate the reduction of spend on steady state maintenance and infrastructure whilst allowing a proportionate increase in new application development spend. The illustration from the Microsoft paper at Figure 3 above shows the cost benefit in migrating from a 1,000 server DC private Cloud to a 100,000 server DC public Cloud as a factor of 10. Lower processing, storage and energy costs combine with demand-side aggregation and multitenancy efficiency to reduce server TCO (total cost of ownership) from $3,500 to $350 in Figure 3. Whilst the Cloud will not reduce infrastructure spending from 50% to 5% of total spend, nevertheless it is the compelling supply-side economics and particularly the opportunity to increase significantly spending on new development as a proportion of the whole that fuels the migration to the Cloud. 18. A structured approach to Cloud migration. , messaging, office productivity and internal social networking Cloud solutions are already going into the Cloud, if they are not there already. Other low hanging fruit for Cloud services are customer services management/crm and support/trouble ticket management. HMG estimates that 50% of government IT will have moved to the Cloud by At the other end of the spectrum, a private sector organisation s crown jewels are unlikely to move into the Cloud, and a government s national security data is unlikely to leave the building. Transitioning data, processes and workloads to the Cloud means understanding where on this spectrum a particular application lies and establishing a taxonomy for workloads and in particular the datasets that underlie them: how do we get to a comprehensive, internationally-recognised taxonomy and set of standards to ease this transition as more and more complex private and public sector work gets moved out to the Cloud? The first thing organisations need to understand is the sensitivity of their data, and this in turn depends on establishing classification systems based on the separation of content from these criteria. Organisations should be developing structure, longer range plans mapping out all the relevant steps for Cloud migration. 19. Policy considerations (1): the EU Commission Communication on Unleashing the Cloud 8. In September 2012, the EU Commission published a Communication and accompanying Staff Working Paper 9 entitled Unleashing the Potential of Cloud Computing in Europe in which it sought to identify what needed to be done to enable and facilitate faster adoption of Cloud computing throughout the economy and to set out the most important and urgent additional actions. The Commission identified three key action areas: fragmentation of the digital single market arising from different national frameworks, in particular: ab&oq=the+economics+of+the+cloud+microsoft+november+2010&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&bvm=bv ,d. d2k&fp=62de6c98bf44ccb6&biw=1280&bih=861, page 2. 8 Commission Communication, Unleashing the Potential of Cloud Computing in Europe, COM(2012) 529 final of

11 related to the complexities of managing services and usage patterns that span multiple jurisdictions and in relation to trust and security in fields such as data protection, contracts and consumer protection or criminal law ; problems with contracts concerning: worries over data access and portability, change control and ownership of data ; and a jungle of standards generating confusion: by, on one hand, a proliferation of standards and on the other hand a lack of certainty as to which standards provide adequate levels of interoperability of data formats to permit portability; the extent to which safeguards are in place for the protection of personal data; or the problem of data breaches and protection against cyberattacks. The Commission concluded by noting that Cloud computing touched a wide range of policy initiatives, including addressing data protection, action on standardisation and certification for Cloud computing and the development of safe and fair contracts. 20. Policy considerations (2): data protection. Trust and security ( security by obscurity ) tend to be the main perceptions inhibiting Cloud take-up. Data protection in the EU is still rising rapidly up the corporate agenda (in anticipation of the EU s adoption of a new directly applicable Data Protection Regulation) but there remains a mismatch between the current rules, which take as their start point the 1980 Council of Europe Data Protection Convention before the PC revolution, and the direction of travel towards the Cloud. This is particularly the case in relation to international data flows, where viewed from the perspective of the Cloud, the framework built around model clauses (in the EU), safe harbour (in the USA) and Binding Corporate Rules appears disjointed. In this respect, the recent ICO Guidance on the Use of Cloud Computing 10 is to be welcomed but further regulatory compliance for Cloud based services is likely when the new Data Protection Regulation applies. Data subjects rights to be forgotten 11 and to data portability 12 ; requirements for prior authorisation and consultation with data subjects on international transfers 13 and the introduction of liability for data processors as well as data controllers 14 will have both suppliers and customers of such services facing new challenges as they seek to enjoy the benefits that the Cloud provides. 21. Policy considerations: (3): sector specific regulation. Just as the Cloud unlocks the potential for a radical move forwards in IT innovation, regulation in the post-2008 world is biting more closely on what organisations must do in their IT operations, policies and procedures. In the financial services area for example, the Cloud will facilitate significant cost reduction in an increasingly challenged business environment but particular requirements around record retention, access and audit in many instances still look backwards to a pre-cloud world of IT. 22. Policy considerations (4): law enforcement. U.S. Patriot Act and other law enforcement access will always involve government unilateral activity. This always has been and always will be the same in every country. However, government s need for trust in the Cloud is also increasingly critical and greater transparency from government about its unilateral activity should be recognised as a basic legitimate objective in a civilised society: it is realistic for example to expect a written policy about responses to Article 17 draft Data Protection Regulation 12 Article 18, ibid 13 Article 34, ibid 14 Article 77, ibid - 9 -

12 unilateral requests, information about the number of unilateral requests per year and expectations about what level of response is provided from service providers. 23. Policy considerations (5): the Cloud and standards. The Cloud is ushering in an era characterised by scale and nexus or interconnectedness where standardisation is central. Network, compatibility or interface standards - sets of technical specifications that provide common designs for products and processes and control interoperability in networked markets like the Cloud will become increasingly fought over. This is the background to the current Cloud standards battles: around the ISO family of ISMS (information security and management systems) standards and in particular ISO (code of practice for data protection controls for public Cloud computing services) where the debate centres around client visibility of client data; and around the initiative launched in August 2012 by OASIS (Organisation for the Advancement of Structured Information Standards) for an OData data interoperability standard, in particular Open XML. These issues will become important not just for IT companies but for major IT users as well. Standard setting organisations (SSOs) and their members gain significantly in market influence where a standard they have adopted gains acceptability; and correspondingly, users who have invested in or made longer term plans around standards that fall by the wayside risk losing money or costly adjustments to planning. The process of standard setting can put IP right holders into conflict with third party products and processes that comply with a standard whose subject matter is covered by their IP rights. This is especially the case for IP rich companies in Cloud markets. The conflict is very often intermediated through an SSO s IPR policy and the IP licensing requirements - FRAND (fair, reasonable and non-discriminatory) or royalty-free for example that the policy mandates. The changes in scale and nexus that the Cloud is bringing about mean that we ll be hearing a lot more about standards law in 2013, and the complex contractual, IP and competition law issues they raise. 24. The BSA s Global Cloud Computing Scorecard. In view of the proliferation, complexity and interdependency of the policy, regulatory and legal issues that arise in relation to the Cloud, a number of organisations have issued scorecards for Cloud readiness, aiming to measure the preparedeness of individual countries to support the development of Cloud computing in their jurisdictions. These include the BSA s 15 Global Cloud Computing Scorecard 16 published in February 2012 which ranks 24 countries accounting for 80% of the global ICT market based on seven policy categories (data protection, security, cybercrime, IP rights, standards, free trade and broadband access). 25. Cognitively addressing organisational change. Finally, the move to the Cloud over the next few years will involve significant change and transformation in organisational structures, particularly around the IT department. Legal issues arising include: looking at the people resources of the organisation itself, whether that be re-skilling staff or revising team structures (which may lead to redundancies); reviewing employment contracts, policies and working practices (WFH working from home and ByoD bring your own device, for example); and considering the implications of the outsourcing of IT, including arguments about whether the Transfer of Undertakings (Protection of Employment) Regulations 2006 ( TUPE ) apply in the context of outsourcing IT services to a cloud-based supplier or whether there is a change in the nature of the activities in question, meaning that TUPE may not apply

13 D. SERVICE-BASED COMPUTING: LEGAL ISSUES AND CHECKLIST 26. Contracting in the Cloud. Just as software customers have got used to the ins and outs of software licensing and all the contractual points arising, along comes the new service-based computing technique. But although they come in a software or computing wrapper, most of the contractual points customers and suppliers will need to think about will be familiar from other grown up services contracts think buying dial tone and services rather than licensing software. By way of checklist, they can conveniently be grouped under four heads: supplier stability issues (what if the supplier goes bust?); customer service/dependence issues (what s the worst that can happen?); lifetime contract issues (redressing the balance); and regulatory issues (data protection, data security, audit, sector-specific and general regulation). 27. Key issues. In essence, four key legal issues have emerged for the services contracts that underpin the cloud and web based services world: performance: service levels; availability: now mission critical services are starting to be entrusted to the cloud; data: how/when can I have it back, etc; and exit: think about it before you sign the contract. 28. Supplier stability what if the supplier goes bust? From the customer s perspective, things that the customer will need to think about in current economic conditions include: supplier financial stability: do your credit searches (bearing in mind that information more than 3 months old is likely to be too out of date to be of much help) and customer and supplier references; supplier dependence: check whether the supplier itself depends on particular resources and the financial stability of the providers of those resources to the Supplier; and what are the supplier s own disaster recovery/business continuity arrangements? 29. Customer service/dependence what s the worst that can happen? Review, assess and if necessary remediate: customer s dependence on supplier: what will be the impact on the customer of a small, moderate or severe service outage; and what happens if the services are not performed at all or up to scratch? customer s ability, time required, etc. to switch to an alternative source of supply; ensure the customer can effectively monitor and operate any supplier contract requirements on security, passwords, etc.: it is embarrassing if staff are swapping passwords to access the service where this is not permitted under the contract; as ever, think through the exit/disengagement strategy before contracting, and make sure the customer puts in place an effective, workable exit plan. Key questions include: o what are the supplier s commitments on return of customer data both during and after the contract? o in what form will the data be returned? o how long is it from customer request to data return? o will the customer be able to use the data easily in the form in which it is returned? o if not, what extra needs to be done to make sure the customer can effectively use that data? o will the supplier play nice whatever the reason for the return of the data and deal with the customer s replacement provider as supplier s successor if the customer requests?

14 make sure the customer has full, unrestricted right and title to intellectual property in the customer data and that the supplier is appropriately bound by confidentiality and non-disclosure obligations. 30. Lifecycle contract issues. SaaS and cloud computing providers standard form contracts are generally long on supplier rights and customer obligation and short on supplier obligations and customer rights. That is because they have many contracts in the field, so the agreements become a sort of probability theory with the accent on generics. The customer of course wants a deal that meets its requirements with the accent on specifics. Against this background consider to what extent the customer can realistically negotiate a better deal (which in the service-based computing world is likely to involve higher fees) on: performance: service levels and service credits for service delivery below the contracted standard; availability: when is the service contracted to be made available? What are the customer s responsibilities? On communications, remember the service is being delivered over the Internet and can be subject to its vagaries. Are you buying VPN or other Internet access services from the supplier or is the supplier saying this is down to the customer? If the supplier is providing them, check they re adequate (and try and get the benefit of market pricing pressures, especially in long term deals, as bandwidth prices decline). If not, make sure your communications requirements are adequate for and ideally back to-back with the services supply arrangements. pricing and price benchmarking, etc. during the term of the agreement; changes: the customer may want to make changes at any time or times during contract lifecycle; and business continuity/disaster recovery: the customer may get an enhanced back up service if it is prepared to pay higher fees. Don t forget to test at least annually (and more frequently in appropriate cases) the resilience of the back up and data return arrangements put in place under the agreement. 31. Regulatory issues to be addressed in contract negotiations. Regulatory issues are taking up more paper in service-based computing deals. Consider: treatment of personal data and compliance with applicable data protection laws. Does the agreement cover personal data? If so, will it be processed outside the EEA e.g in the USA or India? If so, who is the data controller and who is the data processor and how are the transborder data issues dealt with? what are the protections for and controls on data security? in what circumstances can third parties obtain contract data? if the customer is operating in a particular sector (for example, financial, professional or healthcare services) make sure the supplier is required contractually to comply with the regulations that apply by operation of law to the customer and endeavour to ensure back-to-back compliance; and ensure adequate audit rights and that these enable the customer to comply with any audit carried out by the customer s regulator. For further information, please contact Richard Kemp, Senior Partner,