TECHNOLOGY SPECTATOR: Fairfax's dark cloud

Technology Spectator

Last month Google scored a big win in the office software battle with Microsoft when Fairfax Media announced the company would move to the Google Apps suite.
In many respects this choice made sense, with an increasingly decentralised workforce and a business that's under pressure to reduce costs, moving to a cloud based solution offered Fairfax many benefits over Microsoft's expensive server based products.

At the time of the announcement Andrew Lam-Po-Tang, Fairfax's chief information and technology officer, claimed moving the company's 10,000 workers over to Google Apps would save the company around 40 per cent of its IT costs.

Unfortunately those kind of savings always prove elusive in the IT world and shortly after the announcement Fairfax scaled back their ambitions of moving all their staff to Google Apps. In an interview two weeks later with New Zealand's National Business Review, Lam-Po-Tang conceded some employees would stay on the Microsoft services as they needed the MS Office functions that Google Apps currently lack.

Word counts or Australian spell checkers are actually pretty minor problems, what Fairfax's journalists are really worried about is that saving confidential data on outsourced services may risk the confidentiality and even safety of their sources.

Courts, governments and plaintiffs around the world have been pushing for stronger powers over cloud computing and social media services. In the UK this manifested itself in the "superinjunction" where aggrieved soccer players, celebrities and even local councils obtain court orders that forbid anyone on the planet from mentioning their legal disputes.

In the United State the movement was a lot more sinister. An Icelandic MP found her Twitter account had been accessed by US authorities to discover information about WikiLeaks.

Australians have been caught up in this, Melbourne online activist Asher Wolf found her Twitter account had been subpoenaed by the Boston District Attorney over comments she'd made about the Occupy Boston demonstrations.

In both cases, Twitter was the only service prepared to fight the requests and divulge to their users that their services had been subpoenaed. The suspicion is that most other popular online services were also targeted.

The worrying thing with these requests is they are served in secret and, apart from the service that the order has been served upon, no one – least of all the person whose account has been accessed – knows their data is being read by government agencies.

Sources on the cloud

For journalists, storing information about sources on cloud services presents problems. The WikiLeaks example is telling, as a government agency can use their powers to force online file storage, email or social media services to hand over information without the sources or reporters knowing their details have been compromised.

As one Fairfax journalist said, "If the data is stored on our servers at least we know if a warrant has been executed even if we aren't allowed to divulge the fact. With a cloud service, we may never know the authorities have been reading our emails”.

This isn't just an issue for cloud computing services, any organisation that outsources data storage and processing could be caught by this legal trap where their information is seized from a third party.

A stark illustration of this was the closing down of the Megaupload service where NZ and US law enforcement agencies confiscated the company's servers and took thousands of customers' legitimate and legal data with them.

Google is aware of the problems and in 2006 went to court to fight the US Attorney General's attempt to access their users' search queries. The company also publishes a Transparency Report detailing government requests for data.

In response to this story, Google's Australian office stated: "When possible and legal to do so, we notify affected users about requests for user data that may affect them. And if we believe a request is overly broad, we will seek to narrow it.”

The worrying point for journalists from the Google Transparency Report is that more than 28,000 government requests for data were made last year and while 65 per cent of the 444 Australian orders were complied with, only 7 per cent out of over 12,000 were refused in the US.

Many people cite the US Patriot Act as being a barrier to using American based or owned cloud computing services, what they overlook is government agencies in every country have extensive powers to seize data regardless of whether it's stored on a laptop in your dining room, a server in your office or split between anonymous data centres in South Dakota, Singapore and Belgium.

Google's Transparency Report is only part of a much bigger trend of government agencies seeking to access private and business data.

Fairfax's staff and management are currently working through the issues of security and are confident they can work through their problems. In response to the concerns raised in this article Lam-Po-Tan says "we are very sensitive of these issues and are looking at protocols to protect confidential information".

The imaginary magic pudding

Slashing IT costs is the magic pudding of struggling boards and managements around the world. All too often we've heard ministers and chief executives proudly announcing big savings by adopting the latest technology trend.

As Fairfax have found, the magic pudding often turns out to be imaginary. A recent paper by ISACA – the Information Systems Audit and Control Association – identified five risks of moving into the cloud.

One of those five risks is the "cost of implementing and operating countermeasures to mitigate risk” and for Fairfax that aspect turns out to have a high price. Most businesses won't have the confidentiality risks that a media company has, but it may have its own unique circumstances.

Every new business technology comes with benefits and risks and for Fairfax there are real benefits in embracing various cloud services. What Fairfax's experience illustrates is every business has to understand its own circumstances and the risks in adopting the latest cost saving innovation.