Internet Governance Forum-USA, 2011 Workshop: Can the Clouds Prevail?

Brief description:

Data Retention; privacy; security; geo-location; mobility; government/law enforcement cooperation; transnational location issues: these are among the emerging cloud computing challenges in Internet Governance. Promoted by industry and government alike, “the cloud” seems to be the answer in providing emerging online services – addressing costs; access; diversity of infrastructure; reliability; and security. Yet its extremely distributed nature raises Internet governance questions. This workshop addressed the Internet governance questions facing cloud computing, including the emergence of the mobile cloud.

Details of the session:

JULY 18, 2011 - Amie Stepanovich participated in the "Can the Clouds Prevail?" workshop at the Internet Governance Forum USA 2011.

Where the cloud’s data is located, who has access to it and what happens if it’s breached took center stage during the cloud computing workshop at the IGF-USA conference July 18 in Washington, D.C.

The moderator for the session was Mike Nelson, a professor at Georgetown University and research associate at CSC Leading Edge Forum.

Panelists included a range of industry, governmental and civil organization representatives:

• Jeff Brueggeman, vice president of public policy for AT&T
• Danny McPherson, chief security officer for Verisign
• Amie Stepanovich, Electronic Privacy Information Center
• Marc Crandall, product counsel for Google
• John Morris, general counsel and director of Internet standards, Center for Democracy & Technology (CDT)
• Fred Whiteside, director of cybersecurity operations for the U.S. Department of Commerce, and National Institute of Standards and Technology Target Business Use Case Manager
• Jonathan Zuck, president of the Association for Competitive Technology (ACT)

Georgetown University professor Mike Nelson said governments are happy to use the cloud for cross-border control because it would enable government applications to work better, and it would save money. But the data have to stay within a host country.

“Tension between government controls on cross-border data flows are often caused by the desire for more privacy for citizens in their country versus the global cloud,” he said.  “How do we get to a global cloud that is actually globalized, where data is allowed to move wherever it wants to and yet have the private assurances we’ve had in the past?”

There are many who believe location equals control, said Marc Crandall of Google.  But that is not always the case when entering various servers and using a resource like the cloud.

“So location may not necessarily equal control,” Crandall said.  “The thing about the cloud is I tend to feel that location does not necessarily equal secure. Where something is located doesn’t make it any more or less secure.”

Having governments worry about security standardization and privacy would be a better focus, he said.

Jonathan Zuck, president of the Association for Competitive Technology, said people need to begin to focus on international citizenry in regards to the cloud. It’s not about where the cloud is located or whose cloud the consumers are using, but looking at a larger more competitive group of providers.

JULY 18, 2011 - Fred Whiteside shares with a group of individuals during the "Can the Clouds Prevail?" workshop during the Internet Governance Forum USA 2011.

And where data are located comes can raise concerns about who has access to that information.  If the data are located in a country with little judicial review or fewer privacy regulations, will users’ information be at risk?

“There should be an emerging global standard,” said Jeff Brueggeman, vice president of public policy for AT&T.  “As to privacy, the more we improve international cooperation on cybersecurity and law enforcement so that there is more comfort over legitimate concerns that if the data is not stored can they go after a bad guy.  But again we have to deal with real issues as well as setting up the right policies to help distinguish between legitimate concern and government overreaching.”

If there is a breach and private information has been hacked, as has been seen in recent attacks against Google and Sony, what should the companies do to be transparent but also uphold their legal obligations?

If an organization is hacked and information is stolen, but that’s not made known publicly, it could be a violation of fair disclosure, said Danny McPherson, chief security officer of Verisign.

“Lots of folks don’t share that type of information,” he said. “Every state or region or nation or union has different native laws and that is extremely problematic in that perspective.”

There are many times that information may not be classified but is of a private nature, such as trade agreements that would need to stay confidential, said Fred Whiteside, director of cybersecurity operations for the U.S. Department of Commerce.  It is complex, he said, and as someone who hears many classified discussions on security breaches, he added that it would trouble him for sensitive information to be made public.

Amie Stepanovich, of Electronic Privacy Information Center, said businesses and industries should start worrying about encrypting the information before it is hacked and instead of worrying about the cost-benefit analysis.

“I think the benefit of data encryption is really worth it,” she said. “Its been proven again and again. Companies feel somehow they have to touch that burner to see if it’s hot before they move to that.”

Regardless, while the focus has been on the concerns and security issues surrounding the cloud, there are many benefits that should receive their due credit.

“I think the fact we are all here is a testament to the cloud,” she said. “Or else we wouldn’t be so concerned with what the problems are if we didn’t recognize there are so many benefits of the cloud.”

– Anna Johnson