Louise looks harmless enough. Pretty, even. But she represents a major challenge that must be overcome by the IT industry as a whole and IT departments in particular.
I had an opportunity yesterday to moderate a panel discussion at an event hosted by the federal Office of the Privacy Commissioner of Canada (OPC) focused on privacy and cloud computing. Although the sessions covered a range of sub-themes, the OPC decided it would be easier to tie things together by creating a fictional character that represented the concerns of an ordinary Canadian. This was how, though a background scenario I was provided as we planned the panel discussion, I met Louise:
Louise is a stylish 21-year college student who likes to meet people and try new things. She is active online and does everything from buying trendy clothing and concert tickets to keeping in touch with friends through posting updates and photos to her Facebook page. She is putting herself through school by making jewellery and selling it online.
Louise’s jewellery business has been doing well and she has expanded her client list and her product line. As her small business grows, Louise realizes that she needs to start handling her electronic documents more professionally. However, she is not a computer expert, and has limited time to spend on technical details. Louise thinks she needs some help to manage her data effectively. She has been hearing a lot about the advantages of cloud computing, and wonders if this might provide her with some useful business tools.
Louise already uses a Gmail account for her business communications, and she uses Flickr to store photos of her jewellery creations. She accesses her business bank account over the web through online banking. She is considering using a cloud address book application to keep track of her growing list of clients and suppliers. She is also looking at FreshBooks for online expense tracking and invoicing.
Although Louise is interested in using these cloud services, she has some concerns about taking the leap into this new model. Louise is not entirely sure about the technology underlying cloud computing, and how the business models work. There are also a lot of unfamiliar terms, like “virtualization,” which can be hard for a non-expert to understand. She also wonders how service providers will manage, use, and protect her information. She worries whether she will be able to get access to her data whenever she needs it, and if it will be safe from hackers and bad software. Louise is concerned about where her information will be stored: she has heard that it might be in another country, and wonders what legal implications that might have for both her business and personal data.
The OPC didn’t force us to use Louise in our discussions, but many of us found her a valuable point of reference as we discussed data loss, identity theft, jurisdictional boundaries and many other issues. My response was as follows:
What Louise may not understand is that data and information is not the only thing cloud computing can handle. As an enabling set of technologies and techniques, it can also allow her to better allocate the compute resources she needs to meet peak demands – for instance, the Christmas rush for jewellery buyers. There may not be a lot of privacy issues around on-demand infrastructure, but it’s a benefit of cloud computing that can’t, and shouldn’t, be ignored.
I also said that Louise may one day become the kind of executive who doesn’t understand why large organizations require a substantial IT department. If she becomes well-versed in using cloud-based services for her small business in college, she might be tempted to explore similar relationships with service providers in a corporate setting once she has the authority to do so. There’s a lot more to IT than this, of course, but helping her understand not only privacy but the other areas in which a dedicated executive can manage all areas of technology deployment will be a critical challenge.
And of course, before all that happens, Louise may be one of those young workers entering the enterprise who simply cannot stand the limitations placed around many cloud computing services today. IT departments may not want (or have been ordered to prohibit) corporate data going to her Gmail account, but good luck monitoring, managing or enforcing such behaviour.
Whether we’re talking about cloud computing or anything else, privacy and IT usage often boils down to a matter of control. The future of IT management will be shaped by the degree to which technology executives limit or share it.
