By Frank Jennings

“Cloud computing” is an umbrella term to define many things but in essence it involves computing delivered as a service on demand to a customer via the internet, or the “cloud”. By outsourcing computing in this manner to cloud suppliers a business is able to benefit from cost reductions through the sharing of computing resources, software and data. Consumers will be familiar with cloud computing in the form of a webmail account, such as Hotmail, or a document processing suite such as Google Docs. The consumer does not install and maintain the software locally. This is done in the cloud. The consumer accesses it via the internet as and when they need it.

Cloud Computing as a concept is not new and dates back to 1960s, when there were predictions that “computation may someday be organized as a public utility”. It gathered pace when Amazon modernised its data centres following the dotcom crash of the early Noughties and then offered Amazon Web Service on a utility computing basis in 2006. Now the cloud community is widespread with Oracle, IBM, Amazon, Google, Apple and Rackspace all involved. Even Microsoft, whose traditional stronghold in businesses is operating systems on desktops – where it is estimated to have a 90% market share – recognises that cloud computing is causing a wave of innovation in the IT industry.

Reduce Costs and Capital

One immediate advantage of cloud computing is that it can offer a business significant savings in IT costs by switching from large upfront capital expenditure to smaller on going operational expenditure. Instead of investing in a large server infrastructure with lots of spare capacity for those rare occasions that the business needs full capacity, it effectively outsources this to the cloud supplier and implements lower cost “thin client” hardware on its premises.

Provided the business has sufficient bandwidth on its internet connection, the cloud supplier will undertake the bulk of the hosting and processing on its own hardware and feed the data to the customer through its internet connection. By buying in a service rather than having to own and manage the capital assets of that service, companies can benefit from the latest technologies without making upfront capital investments in hardware and software. And because the cloud supplier can offer this type of service to many customers, it can keep its servers running at greater capacity with better utilisation of spare storage leading to economies of scale.

The business can make additional savings if it is able to adopt standard software solutions rather than paying extra for bespoke solutions. Also, it might be able to save further by reducing headcount as there would be a reduced need to run and maintain the servers. In fact, Microsoft is more bullish estimating that cloud computing could lead to the automation of 10-15% of worldwide IT jobs.

Flexibility

Another advantage is that, because cloud computing offers the flexibility to pay-as-you-use, a business is able to manage its resources better. If the business grows and with it its computing requirements or there is a seasonal usage spike, a business can buy in additional facilities from the cloud on demand. Likewise, if the company experiences a slowdown, it can reduce resources, meaning that the company will not pay for resources it does not need. The cloud also offers additional flexibility as it is accessible from any web-enabled device.

Security and Risk

Inevitably, there are downsides of cloud computing but if carefully managed the risks of these can be reduced. By moving into the cloud, a business can lose control over where its data is held. Unless the cloud provider guarantees it will process and store information in a local data centre, a business might find its data being transferred outside Europe. The EU has a high level of protection of personal data and privacy with legislation generally prohibiting the transfer of personal data outside of the European Economic Area – which is the 27 EU member states plus Iceland, Liechtenstein and Norway – unless the European Commission considers that data protection laws of the recipient country provide adequate protection.

If a data centre is located offshore, such as in the USA or India, this can create complications for a business, particularly, for example, with the US Patriot Act which grants the US government and other agencies very wide powers to access information. The USA operates a Safe Harbor arrangement under which members voluntarily agree to protect data. Otherwise it is up to the business to require that cloud providers do not transfer the data offshore or to ensure it obtains the necessary contents for the transfer. A failure to comply with data protection obligations will not just attract the attention of the Information Commissioner – who enforces data protection legislation in the UK and now has the ability to issue fines up to £500,000 – but, where it is in the financial sector, might also see scrutiny by the Financial Services Authority, which has the ability to levy much higher fines.

Liability

Regardless of which cloud supplier a business chooses, a supplier will not guarantee that the service will be immune to outages. Instead, the focus must be on a practical solution to any outage and the remedies available to the business against the supplier. All suppliers will limit their liability for disruption to business caused by service outages, but the extent of their liability is likely to differ. Furthermore, businesses must check whether suppliers will warrant providing the service to a particular level. Again, before appointing a cloud supplier, a business should check whether it has a good track record and a reputation to uphold and whether it complies with any relevant standards.

Analyst firm Gartner, advises that when entering into a cloud computing contract, businesses should ensure that they know what will happen in a worst case scenario. In particular, “any offering that does not replicate the data and application infrastructure across multiple sites is vulnerable to a total failure.” Businesses may want to consider using two suppliers to overcome the situation where a cloud provider’s data centre suffers an outage. At least the business will have a further resource, albeit at an additional cost.

Note This post has been extracted from a white paper. The full white paper is available on the link: http://www.tomilaw.com/2010/11/cloud-white-paper-available.html.

About the author

Frank Jennings is a Partner in DMH Stallard’s Commercial Law team, regularly advising suppliers and customers in the cloud. Frank has extensive experience in technology law, public sector issues, intellectual property and commercial contracts and he regularly speaks at conferences on these topics for CLT and others. If you have any questions arising from this paper please contact Frank at frank.jennings@dmhstallard.com.