The “cloud computing” trend of replacing software traditionally installed on campus computers (and the computers themselves) with applications delivered via the internet is driven by aims of reducing universities’ IT complexity and cost. While today’s “cloud powered” higher education institutions can gain significant flexibility and agility, the corresponding migration of their sensitive data into remote, worldwide data centers--the “cloud” itself--introduce profound legal, compliance, and political issues. This is particularly true in the university community, which, given the data members handle, can be subject to everything from financial regulations and insurance laws to export controls.
To safely assess cloud computing options, evaluate vendors, and implement service agreements, colleges and universities should define their requirements and pay close attention to critical privacy and security issues. They should also look carefully at critical contract terms and conditions in this emerging and fast-moving field. As enterprise IT decisions go, cloud computing brings a host of legal issues to the table.
First, Know Your Clouds
While there is a lot of discussion about what “cloud computing” really means, at its most basic sense, it is one party such as a university customer obtaining IT services from a provider. The National Institute of Standards and Technology has a more detailed definition of what cloud computing “is” at http://csrc.nist.gov/groups/SNS/cloud-computing/.
There are several “layers” of cloud-based services:
--Infrastructure as a Service (“IaaS”) - some service providers offer cloud-based storage, much the same as a campus storage area network (or SAN);
--Computing as a Service (“CaaS”) – sometimes included in IaaS, CaaS service providers offer access to raw computing power on virtual servers, such as Amazon’s EC2 service;
--Platform as a Service (“PaaS”) - certain providers are opening up application platforms (as opposed to the applications themselves) to permit customers to build their own applications using that platform’s underlying operating system(s), data models and databases, pre-built application components and interfaces;
--Software as a Service (“SaaS”) – application service providers have been hosting applications for quite some time, but the difference with SaaS in the cloud is that the servers hosting the applications are also virtualized.
Promises of higher accessibility, availability, and efficiency are prompting universities, government agencies, and businesses to consider cloud-based services. Today’s cloud computing providers are offering higher education the opportunity to substitute a presence in “the cloud” for universities’ existing data centers, servers, and applications, replacing these machines’ traditional “physical” presence on campus. For academia, cloud computing lets students, faculty, staff, administrators, and other campus users access file storage, e-mail, databases, and other university applications anywhere, on-demand. This expanded, device-neutral access theoretically lets everyone use information more effectively. Centralizing applications and data in a cloud provider’s data centers is also promoted as affording a high degree of data recovery, particularly for smaller educational institutions, as large service providers can theoretically invest in high-capacity infrastructures and hosting to keep software available in the event of technical glitches or heavy traffic. It is easy to see how university IT staffs’ traditional missions, from supporting mobile and remote users to enabling more “self-service” type systems for employees’ benefit, seemingly mesh well with cloud computing from a high level perspective.
On the financial end of things, the efficiency argument likely resonates even more with universities in a down economy. Amazon’s E2C IaaS product lets users “order” as many virtual servers as they need and pay for them by the hour. Once they are done, the virtual servers “disappear” and the user doesn’t pay anything else. Some of Amazon’s customers “turn on” their servers first thing in the morning, use them during the business day, and turn them “off,” again, at the end of the day. In this new environment, a researcher’s grant application might request 100 hours of virtual server time, rather than requesting the funding for a new server.
