Posts tagged computing service

In August of 2008, I wrote a blog post that generated quite a bit of discussion among the cloud-computing and Internet communities of the time. The post described what I felt was a simple “bill of rights” of sorts for the consumers and vendors of cloud-computing services.

The Cloud Computing Bill of Rights, 2010 edition

In the course of technical history, there exist few critical innovations that forever change the way technical economies operate; forever changing the expectations that customers and vendors have of each other, and the architectures on which both rely for commerce. We, the parties entering into a new era driven by one such innovation–that of network based services, platforms, and applications, known at the writing of this document as “cloud computing”–do hereby avow the following (mostly) inalienable rights:

Article I: Customers Own Their Data

1. No vendor (or supplier of service to a vendor) shall, in the course of its relationship with any customer, claim ownership of any data uploaded, created, generated, modified, hosted, or in any other way associated with the customer’s intellectual property, engineering effort or media creativity. This also includes account-configuration data, customer-generated tags and categories, usage and traffic metrics, and any other form of analytics or metadata collection.

   Customer data is understood to include all data directly maintained by the customer, as well as that of the customer’s own customers. It is also understood to include all code and data related to configuring and operating software directly developed by the customer, except for data expressly owned by the underlying infrastructure or platform provided by the vendor.

2. Vendors shall always provide, at a minimum, API level access to all customer data as described above. This API level access will allow the customer to write software which, when executed against the API, allows access to any customer-maintained data, either in bulk or record-by-record as needed. As standards and protocols are defined that allow for bulk or real-time movement of data between cloud vendors, each vendor will endeavor to implement such technologies, and will not attempt to stall such implementation in an attempt to lock in its customers.
3. Customers own their data, which in turn means they own responsibility for the data’s security and adherence to privacy laws and agreements. As with monitoring and data access APIs, vendors will endeavor to provide customers with the tools and services they need to meet their own customers’ expectations. However, customers are responsible for determining a vendor’s relevancy to specific requirements, and to provide backstops, auditing, and even indemnification as required by agreements with their own customers.

   Ultimately, however, governments are responsible for the regulatory environments that define the limits of security and privacy laws. As governments can choose any legal requirement that works within the constraints of their own constitutions or doctrines, customers must be aware of what may or may not happen to their data in the jurisdictions in which data resides, is processed or is referenced. As constitutions vary from country to country, it may not even be required for governments to inform customers what specific actions are taken with or against their data. That laws exist that could put their data in jeopardy, however, is the minimum that governments convey to the market.

   Customers (and their customers) must leverage the legislative mechanisms of any jurisdiction of concern to change those parameters.

   In order for enough trust to be built into the online cloud economy, however, governments should endeavor to build a legal framework that respects corporate and individual privacy, and overall data security. While national security is important, governments must be careful not to create an atmosphere in which the customers and vendors of the cloud distrust their ability to securely conduct business within the jurisdiction, either directly or indirectly.

4. Because regulatory effects weigh so heavily on data usage, security and privacy, and location is key to determining which regulations and laws are in effect, vendors shall, at a minimum, inform customers specifically where their data is housed. A better option would be to provide mechanisms by which users can choose where their data will be stored. Either way, vendors should also endeavor to work with customers to assure that their systems designs do not conflict with known legal or regulatory obstacles. As noted earlier, however, ultimate responsibility for data security and legality remains the responsibility of the customer.

   These rights are assumed to apply to primary, backup, and archived data instances.

Continue reading…Full Source: CNet.com

Related posts

• Cloud Computing Technology – A Checklist for Cloud Computing Deals (13)
• Mini-glossary: Cloud computing terms you should know (14)
• Understanding cloud and devops–part 1 – The Cloud (3)
• Ingram Micro Announces New Cloud Conduit Initiative to Accelerate Adoption of Cloud Computing (3)
• VMware to Collaborate with Google on Cloud Computing (5)