IEEE Technology and Society Magazine - Spring 2013 - 70

Table II
Cloud Models Pros and Cons
Model

Pros

Cons

Managed by

Public

Elasticity & absorb demand
Geographical distribution
Large pool Low control

External
provider

Community

Medium to full control
Common requirements
Less expensive than private
Governance
Monitoring
Full control of solution
Less prone to attacks
Integration with existing systems

Medium to full control
Common requirements
Prone to attacks
Less control
Trust on other members of
community.
Smaller pool than public
Small pool
Elasticity & absorb demand
Lack of geo-redundancy

Private

to Active Directory or Blackberry
ID management, but these are currently immature.
Once the method for identity
management has been decided
upon, the interfaces between internal and external systems need to be
addressed. Governments that are
already using Service Oriented
Architecture (SOA) will experience
easy integration. It is important to
carefully manage the interfaces
between the implementations and
any changes made to the services.
This can be a huge challenge if it
is not controlled properly through
change and configuration management [3].

Legal and Regulatory Issues
Legal Regulations
Legal requirements, especially
those relating to data protection,
are probably the most important
consideration when public organizations plan to use cloud services.
There are different legal regulations
that can affect the use of external
cloud services. Most of them relate
to the protection of individuals
when processing personal data and
to the free movement of such data
[7]. As an example, EU legislation had an effect around the world
because of its provisions allowing
"transfers of personal data... only
to non-EU countries that provide an
70

"adequate. level of privacy protection". For this reason, before starting to plan any technical details of
the system, it is important to have
understood all possible legal implications and how these will be met
in the cloud implementation. EU
privacy regulations are stricter than
many others and companies and
public organizations in the EU may
not send or store personal data outside the EU.
This is the geopolitics of cloud
computing. An example of this
is the negative opinion in early
2011 of the Danish Data protection Authority on a notification
from the Odense Municipality on
the use of Google Apps for processing data related to educational
activities because Odense would
be unable to prove where the data
were [8].
Another example is the U.S.
patriot Act, where data that is in
the U.S. can be seized if required
by the U.S. government, even if the
data is from another country and
classified as confidential. Different governments around the world,
such as the Canadian, have forbidden the storage or processing of
government data by U.S. firms due
to this act.
Safe Harbor
To keep information flowing
between the European Union

Organization/
External
Public
Organization

and the United States, the U.S.
Department of Commerce negotiated Safe Harbor [9] provisions to
allow certain companies to transfer information if certain requirements are met. Basically, this is a
process that allows U.S. companies to comply with the EU data
protection directive.
In order to do this the company
must adhere to seven principles
described in Table III.
There should be an annual
re-certification. It can perform
a self-assessment to verify that
complies (for this reason is subject
of criticism) or get a third party
to verify it. Some cloud providers offer geographic limits, so the
data are only stored or processed
in the countries requested by
the customer.
FISMA/Apps.gov
The Federal Information Security
Management Act of 2002 FISMA
recognizes the importance of
information security and requires
the head of each U.S. agency to
implement policies and procedures
to cost-effectively reduce information technology security risks to an
acceptable level.
It also requires sensitive data
to stay within the U.S. Most of
the cloud vendors are becoming certified against FISMA in
order to be able to operate US

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

SprING 2013

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Spring 2013