The Centre for Management and Organisation Development (CMOD) is a division of the Department of Public Expenditure and Reform (DPER), mandated to implement policies in the area of ICT and eGovernment. Its role is summarised as having ‘among other things, responsibility for monitoring and approving ICT spend in civil and public service bodies, telecommunications policy and infrastructures, eGovernment policy and infrastructures, technology research and policy, central ICT procurements and frameworks, and common IT systems including payroll and HR Management.’. [1] A broad ambit for what is a long established entity. The CMOD was moved from the Department of Finance (DOF) to the DPER when the current Government effectively split the DOF in two, retaining the existing DOF for finance matters and moving the public sector reform components of DOF’s remit into the DPER.
ICT and cloud computing has been highlighted as key target areas within the Programme for Government, set out by the current coalition Government – ‘We will make Ireland a leader in the emerging I.T. market of cloud computing by promoting greater use of cloud computing in the public sector, organising existing State supports for cloud computing into a package to promote Ireland as a progressive place for I.T. investment, establishing an expert group to address new security and privacy issues arising from the use of cloud computing and reviewing the adequacy of current legislation and identify what steps need to be taken to ensure a supportive regulatory environment’. [2] Against this backdrop, the CMOD has published a number of policy documents in the ICT area, which set out strategies to enable the delivery of improved public services. The second of these documents, entitled Supporting Public Sector Reform: Cloud Computing Strategy (the Strategy), locates cloud technology at the core of eGovernment.[3] This article discusses Government strategy in the cloud computing area. This article is the second in a three part series assessing aspects of public sector reform. The first discussed public sector outsourcing and the final article will discuss public sector shared services.[4]
Cloud Computing Strategy
The Strategy sets out the backdrop against which public sector reform is being driven and emphasises the widely accepted advantages of using the cloud. Key attractions stated include access to resources without capital expenditure, scalability and mobility of usage, together with as-used payment model. We are generally aware of the attractions of cloud computing. As with any new technology, however, certain challenges are posed by cloud computing which require consideration and, inevitably, regulation, before they can be overcome. In this regard, the EU has adopted its own Cloud Computing Strategy and an array of policy targets have been set out in the campaign for a ‘single digital market’, such as review of data protection law, copyright and licensing, e-commerce and consumer rights. Open issues with the cloud, in particular, relating to data protection, security, legal and jurisdictional issues, mean that adoption of the cloud in the public sector will be constrained unless supported by a clear policy structure. Within that structure, the public sector can procure required cloud infrastructure, platform and software as-a-service offerings. The Strategy commences the creation of that policy structure. The Strategy is a cautious document. Embracing cloud solutions will evolve over time. It is clearly stated that ‘as cloud computing is evolving, there are considerable challenges pertaining to, inter alia, security, legalities, jurisdiction, availability and reliability, pricing models that provide definitive and sustained value. Accordingly, the move to Cloud Computing will take time’.
Public, Private and Community Clouds
The strategic approach which the CMOD advocates in the Strategy involves the use of public, private and community cloud at varying levels tailored for particular purposes. While the public cloud can be used for public-facing, front-end services generally containing open and non-sensitive data, subject to application of decision making criteria, the ‘Public Service Community Cloud’ is proposed as a solution where the public cloud would be deemed unsuitable (the ‘Community Cloud’). The Community Cloud is essentially a form of hybrid-cloud, showing aspects of both public and private cloud.
Private cloud arrangements shall be limited to arrangements which ‘receive sanction based on a solid business case and specific, unique requirements’. This is a high threshold and the Community Cloud seems the preferred choice of the strategy. Accordingly, private cloud solutions will not be discussed further.
The public sector in Ireland currently maintains a largely proprietary ICT infrastructure. The benefits which can be reaped from outsourcing these functions to providers with significant economies of scale are too tempting for government to resist. Government policy is to cautiously embrace outsourcing. We are assuming here for convenience that cloud-computing falls within the genera ambit of outsourcing, an assumption which the industry would challenge. Supporting public sector reform in circumstances of economic difficulty, cloud computing is inevitably here to stay, as the Strategy advocates that over time cloud-based provision of ICT will become the default approach for the public service. To get the ball rolling, both the CMOD and HEAnet have been engaged in research and trial of services.
The Strategy essentially seeks to deal with two issues in tandem, namely data centre consolidation and cloud computing strategy. Both are real issues for the public sector. The Strategy’s attempt to locate components of its cloud programme in public sector data centres, which effectively merges the two strategies, may not be without its difficulties. From a cloud perspective, this potentially challenges essential components of the cloud model.
Public Cloud
Public Cloud consists of resources which are located at the service provider’s premises, made available by the service provider to the general public over the internet, accessed for free or by metered payment. According to the Strategy, the CMOD is exploring procurement of frameworks that would be available across the public service and, using ‘Criteria of Public Cloud Consideration’, is assessing the possibility of deployment of services which lend themselves to universal application onto a public cloud infrastructure.
The criteria for consideration include architecture, disaster recovery, pricing models, privacy, security and legal and regulatory considerations. Due to the lack of control that the public body would be able to exert over the public cloud provider, it is clear that this model could only be considered as a ‘front-end’ solution which is not integrated with sensitive data. These restrictions limit the potential application of the public cloud.
Public Service Community Cloud
A Community Cloud has both public and private cloud characteristics. Access to infrastructure will be through Government Networks (a managed, private wide area network connecting public service agencies) and the services will gradually be developed by transitioning from infrastructure-as-a-service (IaaS), to platform-as-a-service (PaaS) and onto software-as-a-service (SaaS) offerings. The Strategy sets out five phases during which the strategy is proposed to be rolled out.
- Phase I involves evaluation of IaaS solutions and a public procurement of various IaaS offerings on a multi-member framework basis, allowing allocation of work orders to framework members. It is stated that the IaaS solution procurement shall dovetail with the public sector data centre rationalization programme – ‘In this context it is anticipated that this IaaS will be provided from computer/data centres owned and managed by public bodies’. However, this anticipated position is not absolute and the use of ‘commercial data centres may be considered subject to a satisfactory evaluation of risk. Adequate protections and remedies being provided for contractually and demonstrable value for money’. Payment is envisaged to be on a metered basis; This proposed location of private infrastructure in public sector data centres is noteworthy;
- Phase II involves deploying infrastructural solutions, such as firewalls, in the Community Cloud environment;
- Phase III initiates pilots and implementations, such as virtual desktop infrastructure and email using Paas;
- Phase IV expands the public body’s activity by implementing SaaS; and
- Phase V involves the migration of existing systems to the cloud. This last phase is contingent on the success of the first four phases and the interoperability of the solutions.
The above five phases, map out a transition from IaaS, through PaaS to IaaS solutions. The projected period for the entire phasing in of the cloud strategy is up to ten years, a lengthy period, given economic challenges and the pace of cloud evolution. The Strategy is overall quite a cautious document. Coupled with the cloud initiative, the document highlights, will be the continued drive to merge data centres, so that the government would ultimately manage approximately ten facilities, rather than its current portfolio of ‘potentially hundreds’. Consolidation of government back-end infrastructure has begun.
Conclusion
The Strategy acknowledges that the Community Cloud model does not allow for full adoption of the economies of scale of cloud service providers’ facilities. In fact, in some regards the Strategy bears more of a resemblance to traditional ICT managed services than to pure cloud solution models. However, technical, commercial and legal concerns, largely relating to data security and data protection legislation compliance, mean that not all government functions can be completely transposed into the cloud. The Community Cloud represents a compromise between transfer of data and cost saving measures.
Conventional licensing, support and maintenance arrangements will need to be carefully tailored to the requirements of government as it maintains its own data centres with the cloud provider’s infrastructure on site. The document highlights that specific expertise will be required in ‘negotiating and managing various legal and technical matters relating to provisioning, service levels and qualities and particular security, territoriality and jurisdictional matters‘.
Significant bargaining power will need to be leveraged by public authorities who will be weighing in as landlord, with the cloud providers in the role of tenant, as the phases of the Community Cloud are rolled out. The CMOD believes that IaaS providers are already segmenting their data centres to allow for government use specific segmentation and that a move to government-owned centres would not be overly inconvenient. It remains to be seen whether the prospective living arrangement between the state and cloud providers will make for a happy landlord and tenant relationship or indeed whether the cloud providers, or at least the larger providers, will seek the role of tenant. In addition, a tenant is typically dependent on its landlord for certain amenities, which are essential ingredients of and thus dependencies on the supposedly onerous service-levels which will be required of cloud providers. Dependent service levels are typically problematical in outsourcing and IT transactions.
While the Strategy does acknowledge the potential role of the cloud in delivery of public services, which is to be welcomed, it can be questioned whether the proposed roll-out period is too long and the role of public sector infrastructure in service delivery a complication that may challenge elements of developed supplier solutions, including economies of scale. It would seem likely that the Strategy will be subject to much scrutiny over the next year or so as public sector developments in the cloud, outsourcing and shared service areas take shape. Developments in these areas may accelerate the implementation of certain components of the Strategy, as well as review and possible revision of other components. The Strategy envisaged the journey to the cloud as largely unmapped and attempted to map a route. It remains to be seen whether the route travelled will be as originally mapped or, indeed, anywhere close to the route mapped.
Pearse Ryan is a partner in the Technology & Life Sciences Group at Arthur Cox, Dublin, specialising in IT, outsourcing, strategic sourcing, cloud computing & data/cyber risk. Claire O’Brien is a trainee solicitor in the Technology & Life Sciences Group at Arthur Cox, Dublin.
[1] See: http://ictprocurement.gov.ie/
[2] Government took office in March 2011 & document available at: http://www.taoiseach.gov.ie/eng/Publications/Publications_Archive/Publications_2011/Programme_for_Government_2011.pdf
[3] Publication date June 2012 & available at http://per.gov.ie/wp-content/uploads/Cloud-Computing-Strategy.pdf
[4] See ‘Outsourcing in the Public Sector in Ireland’ published by The Society for Computers & Law, available at: http://www.scl.org/site.aspx?i=ed25519
