European Internet Will Not Stop Eavesdropping

I was interviewed on ABC News Radio Monday morning, about reports of the German Chancellor's proposal for a European Internet to stop US eavesdropping

I said a European Internet would be more expensive and ineffective. Those who traditionally spy on the Germans are the French. ;-)

More seriously, I pointed out that Europe tended to have higher data charges, so US services are used by Europeans. I suggested that individuals could help by encrypting their own data (which will slow down, but not stop eavesdropping) and check where the organisations they do business with store their data.
Some relevant documents:

1. Australian Government Cloud Computing Policy: Maximising the Value of Cloud, version 2.1, AGIMO, July 2013
2. Outsourcing and offshoring - Specific considerations when using cloud computing services", Australian Prudential Regulation Authority (APRA), 15 November 2010
3. Advice on managing the recordkeeping risks associated with cloud computing, Cassie Findlay, Australasian Digital Recordkeeping Initiative, Council of Australasian Archives and Records Authorities, 29 July 2010

 

Cloud Computing Consultations with Australian Government

Greetings from the CSIRO Labs at Black Mountain in Canberra, where the Australian Government is consulting members of the computing profession on a cloud computing protocol. Previously this was to be called a "code" but that has a specific meaning under the Telecommunications Act. The idea is to provide a set of requirements which cloud computing providers would adhere to, to make consumers more confident as to what service they were going to get. Obvious issues include the privacy of the consumer's data and the reliability of the service. There is a National Cloud Computing Strategy from government and media release on the Australian Computer Society's involvement. Roland Padilla is researching this topic for his PHD at University of Melbourne and is sharing some preliminary results with us.

The Institute of IT Professionals NZ is ahead of Australia, having issued a "New Zealand Cloud Computing Code of Practice" (June 2012). This is a voluntary code and is mostly about disclosure to the client of the cloud provider's service delivery standards.

Also a draft "Australian Government Cloud Computing Strategic Direction Paper" was released for comment (deadline 31 January 2011). Glenn Archer, Acting Australian Government Chief Information Officer, has released a "Draft Report on Cloud Service Provider Certification Requirements for the Australian Government" for comment. The report recommends expanding the Data Centre as a Service (DCaaS) Multi Use List (MUL) to include cloud services and "cloud like" services. In the longer term the draft Australian Government Commercial Service Provider Assurance Framework would be extended to encompass cloud services.  Also the report recommends looking at the "National Standing Committee on Cloud Computing" (NSCCC) an industry body and the New Zealand Cloud Computing Code of Practice and the CSA Security, Trust and Assurance Registry (STAR) Program.

The period for comments on the ACS Cloud Computing Consumer Protocol - Discussion Paper have been extended to Monday 9 September 2013. Comments can be sent by email.

The Australian Computer Society (of which I am a member)  is making a considerable contribution of resources to helping the Australian Government. Hopefully the Australian Government will similarly put in resources to see something of value to the community. Previously the ACS assisted PM&C with consultations, including arranging a meeting in Canberra, 18 October 2011, which I attended. However, the Australian Government later abandoned work on this, without any public explanation, thus wasting the time of the many ACS members, including myself, who contributed and failing to adequately protect national security (I proposed a Australian CyberWarfare Battalion to address this).

Cloud Computing Security

Professor John Grundy, Swinburne University, will speak on "Model-driven software security engineering for the cloud" at the Australian National University in Canberra, 12 Noon, 31 July 2013.

Also, as noted by Senator Kate Lundy, Minister Assisting for the Digital Economy, the Federal Government released a National Cloud Computing strategy. The Australian Computer Society has released a Cloud Computing Consumer Protocol Discussion Paper and is inviting input for the consumer code. In the ACS Cloud Discussion Paper, cloud computing is defined as:

"... a general term for the delivery of hosted services over the internet, enabling users to remotely store, process and share digital information and data."

From: Cloud Computing Consumer Protocol, July 2013: http://www.acs.org.au/__data/assets/pdf_file/0011/19928/ACS-Cloud-Discussion-Paper.pdf

That would not seem to make it any different to a 1960s Time-sharing business.

Model-driven software security engineering for the cloud

Professor John Grundy (Swinburne University)

GENERAL Software Engineering

DATE: 2013-07-31
TIME: 12:00:00 - 13:30:00
LOCATION: CSIT Seminar Room, N101
CONTACT: lani.smales@anu.edu.au

ABSTRACT:
Software security engineering is a challenging problem. The emergence of cloud computing platforms as a "new" way to deliver software services in many ways compounds the problem: multiple tenants have differing security requirements; service and cloud providers have differing (sometimes conflicting) security requirements and platforms; and many security issues are emergent at run-time as tenants, service providers, cloud providers and deployment environments all evolve. We describe our recent research into securing cloud-hosted software applications from cloud provider, service provider, and cloud consumer (tenant) perspectives. This includes a new infrastructure-as-a-service security monitoring appliance, a new platform-as-a-service security analysis, design and management framework, and a novel tenant security requirements capture and management console. We describe several evaluations of these approaches identifying key strengths and weaknesses and some of our on-going research in this area.
BIO:
John Grundy is Professor of Software Engineering and Deputy Dean of the Faculty of ICT at Swinburne University of Technology. Previously he was Head of Computer Science and Software Engineering at Swinburne, Head of Department for Electrical and Computer Engineering at the University of Auckland, New Zealand, and Director of Software Engineering, University of Auckland. He has published widely in the areas of automated software engineering, model-driven engineering, visual languages, software architecture and software methods and tools. He is an Associate Editor for IEEE Transactions on Software Engineering, IEEE Software and Automated Software Engineering. He is currently the CORE Australia President, was on the ERA 2012 MIC Panel, and is on the Steering Committee for the IEEE/ACM International Conference on Automated Software Engineering. He is a Fellow of Automated Software Engineering and Fellow of Engineers Australia.

ABC Four Corners on Cyber-attacks in Australia

ABC Four Corners report "Hacked!" (27th May at 8.30pm on ABC1), alleged that Chinese military hackers were targeting Australian Government departments and corporations to steal secrets and business information. The program contained little hard evidence or new information. One allegation, that the plans to the new ASIO headquarters had been stolen to assist penetration of the building was new, but not particularly significant. However, the program will be useful if it prompts the Australian Government to restart its dormant work on public cyber security policy.

One curious segment of the program had a private security consultant asked if the Australia was preparing for offensive cyber-warfare, that is preparing to attack,. not just defence. The consultant hedged around the question, hinting but not answering clearly.

This reluctance to answer the question is at odds with a media release from Northrop Grumman in 2012 which announced it was building a cyber test range at the Australian Defence Force Academy (ADFA) in Canberra, to train defence force personnel. A cyber range is analogous to a test range for conventional weapons: the cyber range is used to test cyber warfare techniques, which can be both defensive and offensive. I attended a presentation to the Australian Computer Society, 13 March 2013, where one of the staff from Northrop Grumman gave a presentation on the cyber range.

Cyber Range for Teaching Cyber-Warfare in Canberra

Greetings from the CSIRO Discovery Centre in Canberra, where Rich Richmond from Northrop Grumman is speaking on "USA view on Cloud computing technologies - A Private Cloud for Environment Testing" to Australian Computer Society members. Rich has been building a specialized cloud service for UNSW Canberra. He described the use of a "Cyber Range" which is a network test environment for cyber security (the virtual equivalent of a weapons test range). There is already a "Michigan Cyber Range" for teaching cyber security in the USA and DARPA had a "National Cyber Range Project" to build a simulation of the Internet for cyber war games. The DoD Cyber Range was reported open in mid 2012, as part of the US DoD Strategy for Operating in Cyberspace (2011):

The development of the National Cyber Range will enable the success of these and other efforts, allowing DoD, other U.S. government entities, and potentially non-U.S. government partners to test and evaluate new cyberspace concepts, policies, and technologies. Although the U.S. military routinely exercises units on target ranges and in a variety of simulations, DoD has had limited capability to simulate cyberspace operations. The National Cyber Range, which allows the rapid creation of numerous models of networks, is intended to enable the military and others to address this need by simulating and testing new technologies and capabilities. ...

While not explicitly stated, it would appear the Canberra Cyber Range will be used for teaching cyber-warfare to military personnel at the Australian Defence Force Academy (ADFA), which is the military partner of UNSW Canberra. This is hinted at in the media release from Northrop Grumman (2012): ".... build a cyber test range for the University of New South Wales (UNSW), Canberra campus at the Australian Defence Force Academy (ADFA) ... training and educating the future leaders of the Royal Australian Navy, Army and Air Force... including the burgeoning area of cyber research."

Cloud on a Chip

Greetings from the famous room N101 at the Research School of Computer Science at the Australian National University, where summer students are reporting on their projects. One project is "Porting the Xen Hypervisor to Intel's Single-Chip Cloud Computer".  The SCC an experimental chip with 48 cores, each equivalent to an Intel P45C processor. One feature is that cores can be switched off to save power when not needed. The problem is to get this to work in practice.

Australian Government Cloud Service Provider Certification

Glenn Archer, Acting Australian Government Chief Information Officer, has released a "Draft Report on Cloud Service Provider Certification Requirements for the Australian Government" for comment. The report recommends expanding the Data Centre as a Service (DCaaS) Multi Use List (MUL) to include cloud services and "cloud like" services. In the longer term the draft Australian Government Commercial Service Provider Assurance Framework would be extended to encompass cloud services.  Also the report recommends looking at the "National Standing Committee on Cloud Computing" (NSCCC) an industry body and the New Zealand Cloud Computing Code of Practice and the CSA Security, Trust and Assurance Registry (STAR) Program.

Hacking of medical records

ABC Radio South East is going to interview me at 8:46am Wednesday, about the hacking of medical records. According to the report "hackers" have demanded $4,000 to restore the records of a medical centre. I did not pay much attention when I first heard the story as it sounded like the usual scare story issued by anti-virus software companies to promote their products. The ransom amount sounds too low to be credible. Also even if the medical practice paid the ransom, there is no way they could rely on the records being intact and unaltered.

The obvious reaction to such a story would be to call for medical records to be stored offline, on a server not connected to the Internet. But Australian state and federal governments are spending billions of dollars on ehealth to put records online. These online systems are intended to no only reduce costs, but impressive health, by providing a consolidated and more accurate medical record to all of a patients heath care providers. Speaking from experience, when you are lying semi-conscious in an intensive care ward of a hospital being asked about your medical history you would welcome an online record the doctor could access, so they could get on with treating you urgently.

Some guides and standards for cloud use, such as AGIOM's "Privacy and Cloud Computing for Australian Government Agencies Better Practice Guide" and  IITP's "Cloud Computing Code of Practice" are discussed in my presentation "Records in the Cloud?" for the For Transitioning to Digital Recordkeeping, conference this year.

Medical centres should have good internal security procedures (attack by an employee still remains the biggest threat to an organisation, rather than attack from outside), as well as backing up their data,  securing their computer systems, using anti-virus software and having a firewall separating the internal system from the Internet. Small medical practices might be better off with cloud based outsourced services run by companies with the required expertise, rather than relying on locally run and maintained systems.

The Australian Computer Society was assisting the Australian Government to prepare a Cyber Security White Paper, which was to be released in early 2012. I helped prepare the ACS Submission for the Australian Cyber Policy White Paper.Unfortunately the Department of Prime Minister and Cabinet then canceled the white paper. Perhaps this needs to be renewed.

Energy Saving for Mobile Computing Using the Cloud

Qiufen Xia will speak on "Offloading Algorithms for Mobile Computing" at the Australian National University in Canberra,11:30am, 30 November 2012.

Offloading Algorithms for Mobile Computing

Qiufen Xia

 (ANU, Research School of Computer Science)

CS HDR MONITORING

DATE: 2012-11-30
TIME: 11:30:00 - 12:00:00
LOCATION: CSIT Seminar Room, N101

ABSTRACT:
Mobile devices such as netbooks and smart phones,have made computing ubiquitous. However such battery powered devices often have limited computing power for the benefit of an extended runtime. Offloading is an effective method for extending the lifetime of mobile devices by executing some partitioned components of applications remotely(eg.,on the server in a data center or in a cloud). To achieve energy saving while satisfying the given constraints, such as execution time, many partitioning and offloading algorithms have been presented. In this presentation, I will briefly talk about some of these algorithms.

Amazon Cloud Server in Sydney

Amazon have announced a centre in Sydney, Australia for their Amazon Web Services "cloud" server. This answers the concerns I had about Australian organisations having to move their data to other countries for processing.

By specifying the Australian server, the data can remain in Australia, under Australia law. This is particularly useful for organisations handling personal data which is subject to the Privacy Act. Moving data offshore to a jurisdiction which does not have the same privacy protections as Australia is unlawful. Organisations such as government departments and agencies, banks, telecommunications companies and universities risk prosecution if they place client data in "the cloud" outside Australia.

Australian provider Ninefold seem happy with the Amazon announcement as it legitimises them as an alternative.

A Life in Technology

Greetings from the Australian National University in Canberra, where computer industry pioneer, Peter James, is speaking at Innovation ACT on "Managing Growth & Exit Strategies". Peter is Chairman and Co-Founder of Ninefold, a Director of Macquarie Telecom and a Director of iiNet. I know Peter from the days when he worked for Computer Power in Canberra, decades ago.

Peter made the point that a start-up company has to be about business, not just a hobby. The company has to have a a global outlook, even if it is initially aiming for a local market. Also there needs to be a clear and simple message about what the company does and how it can grow. He reminded the audience  that they need to ask their customer what they need, rather than telling them.

Peter gave the example of his cloud computing company Ninefold, which offers an Australian hosted service. They have no sales people making cold calls on businesses, instead attracting business on-line. When I went to their website I noticed a box pop up offering a real time conversation with the sales or support staff.

Peter argues that a start-up should not have an "exit" strategy, as the focus should be on building the business and wait for someone to approach who has an interest in investing and in what the business does.

Peter was disparaging about the adulation of Silicon Valley USA and gave the example of "Startup Saturday India". He mentioned Startup Saturday Bangalore , but I see there is also a Startup Saturday Goa the same day (if you go also visit the Kala Academy).

Digital Recordkeeping in the Cloud

The conference Transitioning to Digital Recordkeeping, opens in Canberra on 18 September 2012. I will be chairing the opening day with Cathy Meynell-James from the Victorian Government VERS Project. The next day I will be speaking on "Records in the Cloud?", discussing how cloud computing impacts digital records management.

Agenda

18 September 2012

8:30 Registration, coffee & networking

9:00 Welcome remarks from the Chair

LEAD AGENCY PROGRESS

9:10 Becoming the New Zealand Government’s Digital Archive

• How Archives New Zealand is transforming the whole business and bringing paper records along for the ride
• How becoming part of the ICT landscape, working closely with others and being open to a range of options is crucial for successful digital archiving

Greg Goulding, Chief Archivist & General Manager, Archives New Zealand

9:50 The VERS journey & managing challenges around Cloud Computing, mobile technology & social media

• About VERS (Victorian Electronic Record Strategy) and the journey from the early years to the present day
• How current challenges (Cloud Computing, mobile technology, social media) are being managed, from a State Archives perspective

Cathy Meynell-James, Senior Manager, VERS Project, Public Records Office Victoria

PREPARING FOR DIGITISATION

10:30 The development of the Australian commercial records management industry

• Records management principles vs. practices
• Is hardcopy document management a thing of the past?
• Property is still king
• From storage to service

Derryk Guyer, Sales Director, Grace Records Management

11:00 Morning tea & networking

11:30 Getting over the physical hurdles

• Simplifying electronic signatures/authorisation of documents
• Effectively scanning documents and legally disposing of the originals
• Transitioning from shared network drives to EDRMS

Shane Martin, Assistant Director, Information Management, Therapeutic Goods Administration

12:10 Implementing an EDRMS & preparing for digitisation

• How to manage an implementation
• Lessons learned from EDRMS implementations
• The role of governance in embracing digitisation

Sheryl Mapp, Manager, Information Management Division, Reserve Bank of Australia

12:50 Networking lunch

1:50 Improving presentation to the user & business context in EDRMS version control

• How to overcome the weaknesses of traditional ERMS version control – presentation to the user and lack of business context – for more effective digital recordkeeping

Stephen Bedford, Information Management Special Projects, Department of Finance & Services, NSW

2:30 Is a paperless government really achievable?

• Can we achieve a paperless government in the context of the many critical and competing demands facing government organisations?
• How securely automating the capture, processing and archiving of documents can increase efficiency, reduce costs and paper, improve services and see organisations become leaner and greener

Mike Waring, Vice President, Software & Solutions Sales, Australia and New Zealand, Kofax

2:50 Roundtable Discussions

3:30 Afternoon tea & networking

CHANGE MANAGEMENT

4:00 Transitioning in the geographically diverse Department of Foreign Affairs & Trade

• The journey so far and the change management processes required to be effective
• The elements of DFAT’s success – from business drivers to an effective communications strategy, tailored training and the approach taken to the roll out and document migrations

Kathy Nelson, Director Corporate Records Section, Department of Foreign Affairs & Trade

4:40 Engaging users to ensure success

• About the department’s Records Management Strategy
• The important role a renewed focus on governance, systems, training and compliance has on success
• How the department is engaging with stakeholders to ensure improvements

Kye O’Donnell, Records Manager, Department of Justice, VIC

5:20 Closing remarks from the Chair & close of day one

19th September, 2012

8:30 Registration, coffee & networking

9:00 Welcome remarks from the Chair and recap of day one

MAKING THE TRANSITION

9:10 Making the transition in the Defence environment

• Defence’s journey so far
• How the department is managing the people/culture side of the transition

Andrew Garland, Director Records Management Policy, Department of Defence

9:50 Records in the Cloud?

• Open access
• Finding Information
• Web friendly document formats
• Enabling Government 2.0

Day 1 Agenda Tuesday 18th September, 2012

8:30 Registration, coffee & networking

9:00 Welcome remarks from the Chair

LEAD AGENCY PROGRESS

9:10 Becoming the New Zealand Government’s Digital Archive

• How Archives New Zealand is transforming the whole business and bringing paper records along for the ride
• How becoming part of the ICT landscape, working closely with others and being open to a range of options is crucial for successful digital archiving

Greg Goulding, Chief Archivist & General Manager, Archives New Zealand

9:50 The VERS journey & managing challenges around Cloud Computing, mobile technology & social media

• About VERS (Victorian Electronic Record Strategy) and the journey from the early years to the present day
• How current challenges (Cloud Computing, mobile technology, social media) are being managed, from a State Archives perspective

Cathy Meynell-James, Senior Manager, VERS Project, Public Records Office Victoria

PREPARING FOR DIGITISATION

10:30 The development of the Australian commercial records management industry

• Records management principles vs. practices
• Is hardcopy document management a thing of the past?
• Property is still king
• From storage to service

Derryk Guyer, Sales Director, Grace Records Management

11:00 Morning tea & networking

11:30 Getting over the physical hurdles

• Simplifying electronic signatures/authorisation of documents
• Effectively scanning documents and legally disposing of the originals
• Transitioning from shared network drives to EDRMS

Shane Martin, Assistant Director, Information Management, Therapeutic Goods Administration

12:10 Implementing an EDRMS & preparing for digitisation

• How to manage an implementation
• Lessons learned from EDRMS implementations
• The role of governance in embracing digitisation

Sheryl Mapp, Manager, Information Management Division, Reserve Bank of Australia

12:50 Networking lunch

1:50 Improving presentation to the user & business context in EDRMS version control

• How to overcome the weaknesses of traditional ERMS version control – presentation to the user and lack of business context – for more effective digital recordkeeping

Stephen Bedford, Information Management Special Projects, Department of Finance & Services, NSW

2:30 Is a paperless government really achievable?

• Can we achieve a paperless government in the context of the many critical and competing demands facing government organisations?
• How securely automating the capture, processing and archiving of documents can increase efficiency, reduce costs and paper, improve services and see organisations become leaner and greener

Mike Waring, Vice President, Software & Solutions Sales, Australia and New Zealand, Kofax

2:50 Roundtable Discussions

3:30 Afternoon tea & networking

CHANGE MANAGEMENT

4:00 Transitioning in the geographically diverse Department of Foreign Affairs & Trade

• The journey so far and the change management processes required to be effective
• The elements of DFAT’s success – from business drivers to an effective communications strategy, tailored training and the approach taken to the roll out and document migrations

Kathy Nelson, Director Corporate Records Section, Department of Foreign Affairs & Trade

4:40 Engaging users to ensure success

• About the department’s Records Management Strategy
• The important role a renewed focus on governance, systems, training and compliance has on success
• How the department is engaging with stakeholders to ensure improvements

Kye O’Donnell, Records Manager, Department of Justice, VIC

5:20 Closing remarks from the Chair & close of day one

Day 2 Agenda Wednesday 19th September, 2012

8:30 Registration, coffee & networking

9:00 Welcome remarks from the Chair and recap of day one

MAKING THE TRANSITION

9:10 Making the transition in the Defence environment

• Defence’s journey so far
• How the department is managing the people/culture side of the transition

Andrew Garland, Director Records Management Policy, Department of Defence

9:50 Records in the Cloud?

• Open access
• Finding Information
• Web friendly document formats
• Enabling Government 2.0

Tom Worthington, Adjunct Lecturer, Research School of Computer Science, Australian National University

10:30 Panel – Digital Recordkeeping in the Cloud

Leon O’Reilly, National Innovation Manager, Integrated Sales and Marketing Division, Fuji Xerox Australia Tom Worthington, Adjunct Lecturer, Research School of Computer Science, Australian National University

11:00 Morning tea & networking

11:30 Laying the groundwork, dealing with challenges & making it happen

• How DEEWR converted a major business area to digital recordkeeping and made savings of $150,000 a year
• How to respond when the business group isn’t ‘ready to go’ – mobilising change management and additional support

Amanda Harris, Director Records & Information Management, Department of Education, Employment & Workplace Relations

12:10 Improving business performance through document automation

• How the digitisation of paper-based processes can increase efficiency and effectiveness across your organisation
• The business areas where digital solutions can be implemented to maintain digital continuity, such as: Accounts Payable, HR, Applications Processing and other transactional based systems

Ken Macdonald, Sales Manager, Converga

MANAGING RISKS & CHALLENGES

12:30 Managing access to digital records

• Ensuring your EDMS doesn’t lock up information unnecessarily in personal or micro silos
• Putting in place business rules, advice and practices that balance need to know with need to share
• Helping EDMS users to manage risk

Guy Allen, Records Manager & Agency Security Advisor, Murray-Darling Basin Authority

1:10 Networking Lunch

2:00 The critical role of user adoption in the transition to digital record keeping

• Discover the key barriers to achieving the transition to digital records
• Understand key strategies to increase user adoption of EDRMS Systems

Adrian Rudman, General Manager, Asia Pacific, Objective

MAKING IT HAPPEN

2:40 What we know now that we wish we knew then – reflections on DPS’ journey

• When, why and how the DPS implemented its EDRMS
• Key lessons learned – what we wish we knew then
• The current state of play and what the future holds

Paul Oglethorpe, Director Knowledge Management, Department of Parliamentary Services

3:20 Afternoon tea & networking

3:40 Digital recordkeeping & disaster recovery

• Lessons Victorian Councils learnt about Records Management during the 2009 Bushfires
• What Yarra Ranges Council are working on to improve their response and recovery in a future emergency eve

Debbie Maggs, Information Management Archives Project Officer, Yarra Ranges Council

4:20 Victorian Local Government’s ‘Information Trek’

• Journey to meet the overwhelming challenge of past, present and future information demands
• ECM Step Program
• Records Storage and Digitisation Project

Ruth Edge, Information Management Coordinator, Yarra Ranges Council

5:00 Closing remarks from the Chair & close of conference

Shared Services and Cloud Computing

Greetings from the CSIRO Discovery Centre, where I am attending an Australian Computer Society presentation on "Shared Services and Cloud Computing". This is a popular topic, which has drawn a larger than usual audience. As a designer of multi-user applications running on shared large scale leased bureau computing services several decades ago, I have difficulty seeing what is new about "cloud computing".

Issues of elastic scalable and secure applications running on a shared computer system existed long before cloud computing. The Wikipedia's definition is:

Cloud computing is the use of computing resources (hardware and software) that are delivered as a service over a network (typically the Internet).

About all that seems to be new is the use of the Internet as the network, the large scale of the servers used and the number of different servers involved.

The Wikipedia points out that:

The underlying concept of cloud computing dates back to the 1950s; when large-scale mainframe became available in academia and corporations, accessible via thin clients / terminal computers. ...

Cloud Computing Code of Practice

The Institute of IT Professionals NZ has issued a "New Zealand Cloud Computing Code of Practice" (June 2012). This is a voluntary code and is mostly about disclosure to the client of the cloud provider's service delivery standards.

Table of contents

1. Introduction
   1. Core Principles of the Code
   2. Aims of the Code
2. Defining Cloud
   1. What is Cloud computing?
3. Application
   1. Who does this Code of Practice apply to?
4. Approach
   1. Cloud Code of Practice to relate to Provider’s Products or Services
   2. Compliance with the Code of Practice
   3. Fees
   4. Withdrawal from this Code of Practice
5. Code of Practice Disclosure
   1. Disclosure
   2. Corporate Identity
   3. Ownership of Data
   4. Security
   5. Data Location
   6. Data Access and Use
   7. Back up and maintenance
   8. Geographic Diversity
   9. SLA and Support
   10. Data Breach Notification
   11. Data Transportability
   12. Business Continuity
   13. Data Formats
   14. Ownership of Application
6. Customer Engagement
   
7. Assessment
   
8. Recognition of Compliance to this code
   
9. Maintenance of this code
   

• Schedules:

1. Fair trading compliance policy
2. Cloud Security Alliance STAR Registry Information
3. Security Standards List

...

Introduction

The purpose of the New Zealand Cloud Computing Code of Practice (“The Code”) is to enable professional cloud service providers to benchmark and demonstrate their practices, processes and ethics via a recognised third party to build trust with prospective customers. This can be achieved by service providers or suppliers meeting the requirements of The Code, and receiving recognition via use of a distinguished mark and entry into a register of cloud providers compliant with this Code of Practice.

The Code assists end users by allowing them to make informed decisions based on the disclosure of practices of the service provider enabling end users to be confident with the service provider’s ability to meet end users requirements.

The Code also builds trust within the Cloud Service Industry by providing a trusted format which both suppliers and customers can depend on. The Code recognises the valuable financial support that the following organisations have made in order to have the Code of Practice developed, along with the participation of over 250 individuals from both around New Zealand and off-shore. ...

From: New Zealand Cloud Computing Code of Practice, Institute of IT Professionals NZ, June 2012

The code is issued under a Creative Commons Attribution-No Derivative Works 3.0 New Zealand license.

Internet for the Rest of the World: The Mobile Phone

Greetings from the first Mobile Monday Sydney for 2012. I gave the first talk on "New Ways of Learning to Work: With E-books and E-Learning", this was followed by "VoIP via Mobile Phone: by Dan from VTalk. The last talk now underway is by Mark from Binu on "How to Make a Feature Phone Smarter using the Cloud". Binu uses the Amazon compute cloud to provide a virtual smart-phone server. They host "apps" in the cloud, to overcome the limited processing and storage capacity of non-smart phones. The interesting part of this is that Binu argue they have found a profitable business in providing a service to African customers. What I find interesting is that this same service could be used to provide education, via mobile phones.

Dan argues that these low cost phones, which are popular in developing nations are capable of providing the type of services currently though of as requiring a smart phone. This makes sense as most low cost phones thought of as "dumb" actually have a web browser built in, this is a WAP browser, which was intended to provide simple information services, but was overtaken by smart phones.

Binu's approach is similar to that used by Amazon for their Kindle Fire Tablet Computer. Knidle carry out processing of web content on their cloud computer server and then use the tablet computer essentially as a graphics terminal. This allows a lower cost lower power device to be sued and also reduces the amount of data being communicated (if the application is well designed). It happens I wrote a multi-part article about this for the Australian Computer Society Canberra Branch newsletter in 1991, which then lead to a Defense Department sponsored project. With the passage of time some of this has become easier, but other parts have become harder.

At question time the issue of security came up. As with Amazon's service, Binu's by its nature has access to more information that where a conventional web browser is used. Because the apps run on the server, the company could, if they wished to, have access to the internal information. Obviously, like any company, Binu is required to provide information demanded by national security authorities, under national laws.

Australian Cloud Computing Report

The Australian Department of Innovation has released the report "Cloud Computing: Opportunities and Challenges" from the IT Industry Innovation Council (11 October 2011). The report suggests there is a "... window of opportunity for Australia to be a global leader in the creation and adoption of Cloud computing innovation, both in the sense of being a leading ICT cloud computing solutions provider and in the more general sense of being a leading Cloud computing adopter...". The report recommends Australian governments and industry "... react promptly ..." to use cloud computing for productivity and high‐value ICT jobs creation. However, the report does not detail how to do this. One useful area of the report are proposals for data protection (I run a course at the ANU on "COMP7420: Electronic Document and Records Management").

Executive Summary

Cloud computing has emerged as the decade’s biggest shift in the way organisations use Information Technology (IT). The following outlines a summary of advice to the Hon Kim Carr Minister for Innovation, Industry, Science and Research from the Information Technology Industry Innovation Council regarding the industry development opportunites and challenges presented by the growth of Cloud computing.

The ‘Cloud’ provides a new paradigm for delivering computing resources (for example, infrastructure, platform, software, etc.) to customers on demand, in a similar fashion as that provided by utilities (such as water, electricity, gas, etc.). Authoritative international market research from a number of different sources predicts that the global market for Cloud prodcts and services will grow rapidly in the next few years. The global research firm IDC predicts a compound annual growth rate (CAGR) of 27.4 percent in public cloud services (including software as a service) up to 2014, rising to a total global market value of over US$55 billion1. The US‐based research firm 451 Group predicts that core cloud platform and infrastructure services outside of software‐as‐a‐service will grow at a CAGR of higher than 60 percent in the same period2. All major IT research and advisory firms predict that Cloud related products and services will grow much faster than traditionl IT services – typically at around four to five times a greater rate. This rapid growth dynamic provides a great opportunity for innovative Australian IT firms with leading‐edge Cloud technologies to achieve increased revenues and also for related improvements in local IT employment.

It is worth noting that with the local Australian ICT (Information & Communication Technologies) marketplace having a reported value of over $75 billion, and with the same fundamental dynamics regarding Cloud growth applying here to those playing out globally, there is also significant market revenue potential opening up specifically within Australia for Cloud providers. The following chart from IDC reflects that a projected 7.1 percent of total ICT spending in Australia in 2015 will be directl Cloud related, up from 2.8 percent in 2011. This will be a net increase in value of around $4.3 billion. However with many Cloud services being able to be provided from any geographic location, it is important from a local industry development perspective to focus on maximising the related opportunities arising for locl Australian ICT providers.

1http://www.techrepublic.com/blog/networking/cloud‐computing‐to‐grow‐at‐5‐times‐rate‐of‐traditional‐it‐says‐idc/3133
2 http://www.prweb.com/releases/cloud/computing/prweb4771704.htm

The key to maximising these relative opportunities lies in fuelling the level of demand for Cloud computing services and minimiing current barriers to take‐up. There needs to be a strong pull from the non‐ICT sector in terms of understanding the fundamental business benefits of Cloud adoption, including operational efficiencies, greater reach into markets, cost reduction, reduced risk of IT investment with pay‐as‐you‐go pricing, and greater flexibility to handle changes in business conditions.

A September 2011 IDC survey of enterprises in Australia found that 20.6 per cent of the respondents are already using Cloud comuting, while 38.2 per cent are actively testing or planning to deploy Cloud services in the next six to 12 months. A further 41.2 per cent of companies are planning to implement Cloud services by 2013. These are positive indications that demand is growing rapidly.


We can conclude from the various expert insights that the local Australian Cloud market growth opportunities are real and provie a clearly addressable potential for local ICT providers. The extent of the Cloud market potential touches all of the segments of the broad ICT industry – including Software, Services, Hardware, Communications and Research.

Furthermore, we believe that there is an additional local industry development growth potential inherent in the proposition that Australia ould be considered as a regional hub for the hosted provision and development of cloud computing services. This issue was canvassed by the recent Lateral Economics report, “The potential for cloud computing services in Australia.” The report was prepared on behalf of Macquarie Telecom, who are represented on the ITIIC, and also sit on the working group behind this report.

The Lateral Economics report notes that Australia’s geographic isolation provides a natural protection for Australian suppliersof cloud services to the domestic market and they argue that the Australian ICT sector should capitalise on this situation and uild a strong domestic footprint, while along the way, positioning itself as a preferred supplier to nearby markets.

Importantly the report also highlights Australia’s low sovereign risk and stable political environment as providing an attractie basis for foreign investment. Furthermore it emphasises the benefits to consumers of existing laws such as the Privacy Act and the National Privacy Principls – benefits that would be further enhanced if the Exposure Draft on Australia’s Privacy Principles issued in June 2011 is enacted

A further significant competitive advantage that Australia has over many other geographic locations in the Asia/Pacific region for the provision of hosted Cloud services relates to the wide potential availability of low‐carbon energy resources to support a desirable “Green IT footprint” for data centres. With growing global awareness of Corporate Social Responsibility needs in the economic requirements of fast‐growth companies this is important to note.

The ITIIC believe that taking positive steps to create new levels of consumer and business confidence in use of Cloud Computingsolutions will have the additional benefit of helping position Australia as a national and regional Cloud leader – increasing the related industry development in software solutions and hosting centres, thereby boosting jobs and productivity whilst attracting global investment. Australia has strong fundamentals that are needed to make this a global reality; the leading‐edge ICT skills, the legal, political and geographical certainties, as well as the assurance that data hosted here is secure. Powered and supported by transformative national initiatives such as the NBN, Australia increasingly has the infrastructure capacity and expert capability to plug into the world and reap the associated adantages.

Our overall assessment for the broad sector is that the Cloud computing market shift will impact parts of the existing Australin ICT industry in different ways,

Those elements of the ICT industry which focus on developing software solutions and software services will most likely need to apidly transition their go‐to‐market models to take advantage of Cloud‐based infrastructure and start providing their software solutions as a service from the Cloud. This may open up new markets for them and provide a springboard for growth, but given the increasing global competition dynamics in a Cloud world it is likely that the most innovative and nimble companis will prosper.

As covered by the Lateral Economics report, the provision of hosted Cloud solutions has significant potential both within Australia and in nearby markets.

While industry analysts are forecasting continued growth in ‘core IT on‐premise services and related computing infrastructure’, those segments of the local ICT industry that currently focus on this area could find growth potentially more challenging overtime. This segment will probably either have to enhance their offerings to become part of a cloud provider marketplace or face the pssibility of gradually being forced to exit this market. Those that do stay in the market will over time have to compete more directly with the global cloud computing market providers where to survive they will need to lower costs and find new local or operational efficiencies and increased productivity. In light of this, ITIIC believe there is a role for both industry associations and government in providing education and awareness for existing ustralian ICT service provider organisations of the benefits and opportunities of Cloud, particularly in the areas of productivity and efficiency improvements, and how to make the transition to providing cloud based solutions.

We further note however, as with any new paradigm shift in market usage conditions, and thereby also change in related industry innovation, that there will be significant new opportunities for Australian ICT industry providers to develop leading solutions and servics for Cloud usage globally. These opportunities will be best prosecuted if industry development of the ICT sector is seen as a key priority by the Australan Government.

The IT Industry Innovation Council recognises that Cloud computing in Australia has incredible growth potential, but is still in its infancy and the maturing of the market has a long way to go. As such it believes that a light touch in relation to government regulation of the market is the most appropriate approach. Outside of market regulation however, we believe that Government has a very key role to play in supporting the sector through some of its policy and procurement actons, and these dimensions are discussed directly in our Recommendations.

In terms of aligning the work of this paper with other key Government activities, the Council is aware that work is being done by the government on security and privacy issues, and on standards, and that there has been a significant body of work undertaken in the past 2 years looking at Cloud computing from a variety ofaspects, not the least of which is the work of the GAP Taskforce on Cloud Computing whose report was released on 25 May 2011. The recommendations of that report represent a balanced approach to the issues, and we would encourage Senator Carr’s consideration of these recommendations (included in Attachment A of this report).

Key recommendations

Recommendations Introduction

The IT IIC Working Group on Cloud Computing has met a number of times to review the nature of advice to the Minister regarding is questions raised. There are some overarching points to be made which “set the scene” for that advice, and these are:

• That the Council believes there is a current window of opportunity for Australia to be a global leader in the creation and adopion of Cloud computing innovation, both in the sense of being a leading ICT cloud computing solutions provider and in the more general sense of being a leading Coud computing adopter. However Australian governments, Industry and the local ICT sector in particular must react promptly to this possibility with supportive actions (including the prioritising of the following recommendations) to support the achievement of wealth and prosperity arising from that opportunity;
• That Australian industry and government should focus their energies on the potential for the use of Cloud computing techniques o drive much‐needed improvements in overall national productivity ‐ noting that actions supporting this goal need to be accelerated faster than our international competitors;
• That there is a significant developing opportunity for local high‐value ICT jobs creation by the development and use of smart Cloud computing applications to improve our global competitiveness nd expand our export potential. The Australian Government should seek wherever practically possible to provide the right kind of stimulus actions in its approch to Cloud computing to encourage the development of a vibrant local ecosystem;
• The Council notes that there is a need to engender a sense of urgency and clear political leadership in this debate. Governments in other jurisdictions around the world are beginning to consider and take specific actions to encourage and promte their country as a leader in Cloud computing. One example of this in the procurement context is United States Government’s “Cloud First” policy which requires federal government agencies to first consider cloud as a mechanism to deliver any new IT initiatives. Another example from a consumer protection perspective is the discussion paper recently released by the Singapore Government’ Ministry of Information, Communications and the Arts for a Proposed Consumer Data Protection Regime for Singapore. The paper expressly notes: “A general DP [data protection] law will also strengthen Singapore’s position as a trusted hub and create a conducive environment for the fast‐growing global data management and data processing industries, such as cloud computing, to thrive in Singapore. Singapore has many competitive advantages as a data hosting location, such as its telecommunications infrastructure, geographical location, safety from natural disasters and power reliability. However the lack of a general DP law in Singapore may increasingly be seen as a significant disadvantage that could deter somecompanies from choosing to host their data here. The development of DP legislation would thus support Singapore’s future development as a global hub for data.”

Recommendations Summary

The ITIIC Working Group on Cloud Computing makes the following recommendations to Minister Carr:

1. The ITIIC recognises the valued work of the recent GAP Cloud Computing taskforce (coordinated by Department of Broadband, Communications & Digital Economy), and commends the GAP recommendations to the Minister.

The report’s recommendations focus on maximising the benefits of Cloud computing and minimising its risk. It calls for government to issue a statement of support for Cloud computing. Other recommendations advocate government adopting a position of leadership and vision, the establishment of a standing public/private Cloud Committee, domestic and international engagement, assessing Australia’s Cloud readiness, education and awareness, and co‐regulation, including the possible development by industry of cloud computing trust‐marks and a possible
industry self‐regulatory code of conduct. The recommendations are included in full in Attachment A.

2. The ITIIC recognises the significant work undertaken also by the Australian Government in producing the Cloud Computing Strategc Directions Paper and the importance of the ongoing work being done to implement it. It is supportive of further accelerating many aspects of this work, as per Recommendation 5 below.

3. The ITIIC recommend that the following actions be undertaken to address industry development issues within the sector.

a) That the Australian Government should strongly support the development of an enhanced local Cloud computing industry, building on the inherent strengths that the stable Australian financial, policy and regulatory environment provides. This environment will be further strengthened by developing guidelines for Cloud Service Providers to publically demonstrate cber‐security, provable maintenance of privacy of customer data, and guaranteed unencumbered (trusted) operation (Security/Privacy/Trust).

This recommendation is proposed based on the fact that the IT Industry Innovation Council considers that Australia has a natural dvantage in being a safe, secure destination for hosting of Cloud data and applications, particularly so given the regulatory environment of neighbouring countries and the geological stability of neighbouring countres in the Asia/pacific region. The recommendation is also based on the expectation that more and more users will move to a Cloud environment once Cloud servces are considered to be trustworthy. The recommendation is further based on the natural advantage Australia has with abundant renewable energy sources, including solar and geothermal, which would offer Cloud Service Providers the opportunity to reduce operational costs and support ecological “green” objectives.

Specific proposed activities to be led by the Australian government under this recommendation include:

i. Raise Australia's reputation as a safe and secure location for hosting cloud services with the goal of developing a compelling lobal brand that characterises Australia as the "Safe, Secure, Green Cloud" destination.

ii. Work closely with government, commercial and research organisations to establish a set of well‐informed and consistently applied accreditation guidelines for Cloud Service Providers to demonstrate Security/Privacy/Trust. The IT Industry Innovation Council would be pleased to be involved in this work and believe it would require:

a. A review and formulation a set of measures for Security/Privacy/Trust for Cloud Service Providers. It is extremely important that this be done in close co‐operation with Australian Government bodies such as AGIMO and the Office of the Australian Information Commissioner. It is also important to obtain input from Cloud Service Providers in the formulation process.

b. Working with major Cloud Service Providers to establish an agreed common set of validation tests (standards) against which they can state that they meet appropriate measures.

c. Engagement with a standards bodies, such as W3C (World Wide Web Consortium ‐ hosted by CSIRO in Australia), and the ACS (Australian Computer Society) to promote acceptance of such measures.

d. Establishment of a mechanism by which the measures and validation suite may be reviewed and refined/updated.

e. Establishment of a mechanism by which these measurements may be independently assessed.

f. Work closely with government, commercial and research organisations to establish a publically recognised set of marks which demonstrate levels of Security/Privacy/Trust, similar to the energy and water "Star‐Ratings" for household goods.

g. Development of associated and relevant underpinning themes, such as local clean energy capability and deep skills in the local industry to support the proposition.

h. Detailed consideration should be given to the value of making the ICT Industry (and its inherent linkage with both Cloud Computing and the Digital Economy) a key industry development priority area for the Australian Government, thereby raising its status in relation to the activities of associated agencies such as Austrade.

b) Through engagement with the relevant industry association’s focus on developing a plan to provide expertise and advice that wil enable the local ICT industry to transition to the Cloud.

c) That the Minister use the Enterprise Connect program to educate Australian Business on the business agility, transformational opportunities, and efficiencies offered in a Cloud based environment, and investigate opportunities through other existing government programs (digitalbusiness.gov.au, the Digital enterprises initiative, Supplier Advocate programme, etc.) to improve awareness and drive faster take‐up.

d) That Government, industry, CSIRO and NICTA collaborate and develop and execute a joint cloud computing research agenda. This agenda could include researching value and opportunities provided specifically for enhancing Australia’s reputation and cpability in a Cloud Computing global market including potential areas such as linkages of Cloud technologies with the NBN, leadership in applied usage of Cloud applications and innovative new Cloud software solutions for complex economic and communiy challenges.

4. The Department of IISR be included in the establishment of an ongoing Cloud Consultative Committee as proposed by the GAP Taskfrce (see Attachment A), and that it use its involvement to address issues such as alignment between the Cloud computing agenda and its association wit the NBN, the eight goals of the National Digital ...

From: Cloud Computing: Opportunities and Challenges, IT Industry Innovation Council, Australian Department of Innovation, 11 October 2011

A4 Size Netbook for Queensland Schools

Media reports indicate that the Queensland Department of Education and Training has ordered 65,000 Acer Aspire TimelineX AS1830T laptops for students. These have a 11.6 inch screen and an A4 form factor (A4FF). The Acer laptop is 11.2 x 8 inches, smaller than an A4 sheet of paper at 11.66 x 8.27 inches. It has a larger screen and keyboard than the 10 inch net-books the NSW Education Department purchased, but will still fit in a schoolbag designed for A4 paper. This is the same form factor as the Kogan Agora Laptop I have been using for the last six months and the size I have suggested for students.

While tablet computers have been receiving considerable press for education, laptops still have advantages. The real keyboard is much more convenient for typing on and the later screen makes for easier viewing. In practice many tablet computer users buy an add-on keyboard and case which allows the screen to be propped up making it a laptop. The laptops are cheaper than netbooks, due to the omission of the touch screen and the use of less miniaturized components. But laptops do have disadvantages, being larger, less easy to operate standing up and having less battery life.

The Acer runs the Windows 7 operating system and conventional desktop applications. This is an advantage for running a wide range of software. However, it creates a maintenance and security burden and requires a conventional hard disk. An alternative is to use a lightweight operating system and "Apps". Kogan offered a version of their laptop with a small solid state disk running Google's Chromium OS, with web based applications and data stored in "The Cloud". This would work well where schools provided educational materials on-line, but has its own security and maintenance problems. A midway point would be to use a version of the Linux operating system and some conventional and some web-based applications.

Privacy and Cloud Databases

Greetings from the Australian National University, where Professor Chris Clifton, from Purdue University, is speaking on "Freeing Cloud Databases from Privacy Constraints". This is topical as Microsoft recently criticized the Australian Government as the Australian Government Cloud Computing Guidelines effectively require storing Australian citizen's records records in Australia. Also I raised concerns about storing student data in the cloud.

Professor Clifton is working with Qatar University on techniques of atomization (or fragmentation) to separate the person identifiers from the data about them (see papers). He claimed that this way the bulk of the data can be stored in the cloud and processed, without revealing private information. To further protect the information, the list of personal identifiers can be encrypted. Some shortcuts can be used, such as using hashing to check if records match, without having to use actual encryption.

Professor Brad Malin, Vanderbilt University, talked on Risk-based Privacy: What are we Afraid Of?, at ANU, 14 November 2011. He pointed out that matching with other information navigable on-line it is possible to re-identify the records.

Professor Clifton admitted there was a risk of re-identification. But one issue I see is the risk of what will happen in the future. While the data may be anonymous now, new data on-line or more capable computers may make it possible to identify individuals later. Professor Clifton mentioned there are techniques to address this but they also reduce the value of the data, as they deliberately introduce some errors into the data.

The techniques discussed by Professor Clifton involve a compromise between privacy and efficient processing. The data can be placed on a public server and partly encrypted. The difficulty is to decide when the data is sufficiently private. The technical terms are k-anonymity, l-diversity and t-closeness. Some data has to be suppressed completely to protect privacy, but Professor Clifton has found that this will typically be a small amount. These techniques will be added to the UT Dallas Data Security and Privacy Lab Anonymization ToolBox. Recent work has been on the Hive open source data warehouse system. Another option is to use a secure coprocessor.

Apart from risks in the data, Professor Clifton pointed out there may also be risky queries, where the aim is to confirm a suspicion about the data, rather than just a random query. This may require some queries to be rejected. Which queries would have to be rejected is a topic for future research. Also it occurs to me that the fact a query was rejected may in itself reveal information.

Apart from the risk of a change in the future, there is the more practical consideration of basic security rules not being followed for protecting data. There is no point in creating a sophisticated system, if the operating system of the server has not and the latest security patches applied, or strong passwords used, of if the staff are bribed to supply copies of the data. In may be that in practice a well run cloud server is more secure than the average small server at a company or government agency, simply because more care can be given to run a large server properly.

Professor Clifton is speaking on Privacy-Preserving Data Mining at 10: What's Next? at Ninth Australasian Data Mining Conference: AusDM 2011, 1 to 2 December 2011 at University of Ballarat, Mt. Helen Campus, Ballarat.

Freeing Cloud Databases from Privacy Constraints

Professor Chris Clifton, Purdue University, will speak on "Freeing Cloud Databases from Privacy Constraints" at the Australian National University, in Canberra, 4pm 28 November 2011.

Freeing Cloud Databases from Privacy Constraints

Assoc Prof Chris Clifton (Purdue University )

COMPUTER SCIENCE SEMINAR

DATE: 2011-11-28
TIME: 16:00:00 - 17:00:00
LOCATION: CSIT Seminar Room, N101
CONTACT: peter.christen@anu.edu.au

ABSTRACT:
Privacy regulations can constrain how data is managed, particularly trans-border sharing and storage of data. This has significant implications for the use of cloud databases to manage private data. While management of encrypted data has received some research attention, this limits the services that can be provided by a cloud database. We propose to instead encrypt only the link between identifying data and sensitive information, thus eliminating the "individually identifiable" aspect of data that triggers most privacy regulations. This frees the cloud database to provide value-added services such as data cleansing and data analysis without constraint of privacy regulations.

This talk will discuss our early results in this area, including schema development (how do we ensure that sensitive information cannot be identified?) and query processing (how do we handle the fact that part of the data needed to process the query is encrypted, and only the client has the key?) In addition to our existing results, we will discuss ongoing work, including the challenges posed by database systems designed specifically for cloud computing.
BIO:
Dr. Clifton works on data privacy, particularly with respect to analysis of private data. This includes privacy-preserving data mining, data de-identification and anonymization, and limits on identifying individuals from data mining models. He also works more broadly in data mining, including data mining of text and data mining techniques applied to interoperation of heterogeneous information sources. Fundamental data mining challenges posed by these applications include extracting knowledge from noisy data, identifying knowledge in highly skewed data (few examples of "interesting" behavior), and limits on learning. He also works on database support for widely distributed and autonomously controlled information, particularly issues related to data privacy.

Prior to joining Purdue in 2001, Dr. Clifton was a principal scientist in the Information Technology Division at the MITRE Corporation. Before joining MITRE in 1995, he was an assistant professor of computer science at Northwestern University. He has a Ph.D. (1991) and M.A. (1988) from Princeton University, and Bachelor's and Master's degrees (1986) from the Massachusetts Institute of Technology.

URL: http://www.cs.purdue.edu/people/faculty/clifton/

Australian Government Cloud Computing Guidelines

The Australian Government Information Management Office (AGIMO) and National Archives of Australia has released a series of cloud computing guides for comment. But there are so few suitable government applications for cloud computing, that perhaps the guides should concentrate on those. The cloud technology could be applied within computer systems under government control, but generally government data (and the data the government holds about its citizens) is not suitable for placing on a distributed, shared, global computer system.

1. Privacy and Cloud Computing for Australian Government Agencies PDF 255KB
2. Negotiating the Cloud – Legal Issues in Cloud Computing Agreements PDF 395KB
3. Financial Considerations for Government use of Cloud Computing PDF 236KB
4. Records Management and the Cloud, National Archives of Australia website.