Who owns data in the cloud? The answer could get tricky.

Feds, industry grapple with ways to protect government data in the cloud

When government moves data to the cloud, who owns it? And how can it be secured or, in extreme cases, decommissioned?

During a panel discussion on Security in Public/Private/Hybrid Clouds, part of the at the Government Technology Research Alliance meeting earlier this week, everyone involved acknowledged the need to raise the level of trust in the public cloud. Agencies and the public need to be confident that government data is properly secured within the U.S. and can be, if needed, properly destroyed.

Cloud computing refers to services, applications, and data storage delivered online through powerful file servers.

One attendee noted that his agency is working with a cloud provider, Hewlett Packard/EDS, which has its cloud computing resources in the U.S., but systems administrators in other countries such as Argentina, Brazil, Malaysia and Uruguay.

“How do we understand, other than getting a government-certified cloud, where this stuff might be run from and where assets reside?” he asked.

“Everybody I talk to in government requires data to stay within the United States," said Peter Mell, a member of the panel and a senior computer scientist in the Computer Security Division at the National Institute of Standards and Technology (NIST). He is also vice-chair of the Interagency Cloud Computing Advisory Council.

“What is implicit there is that the systems administrators will be in the U.S., which as you pointed out is not always the case,” Mell said.

Related coverage:

Continuous monitoring guidance under way at NIST


One of solutions to the problem – besides public cloud computing vendors providing that level of security – is to look beyond just thinking of the public cloud. Instead, agencies should think about how they are becoming more cloud-like in their information technology operations and then adopt their own private clouds.

“I believe in some ways that all of your agencies are adopting cloud computing and you don’t even know it,” Mell said.

As these agency data centers evolve and adopt virtualization, digitize applications and provide dynamic Web interfaces -- Web 2.0 stylings of data center applications – agencies are becoming more cloud-like. If agency managers then apply NIST guidelines for cloud computing to those information technology operations, they can evolve to the point where they can say they have a cloud environment.

At that stage, “You own it and control it and it will work well for you,” he said.

The federal government is vast, and vendors have been struggling with the question of who speaks for the federal government, said Phil Wenger, deputy policy lead for the Budget Formulation and Execution Line of Business for the Office of Management and Budget.

Wenger said the CIO Council’s efforts to provide assessment and authorization through the Federal Risk and Authorization Management Program (FedRAMP) should help provide cloud computing providers with a standard, governmentwide set of security requirements. However, he said the government can make it a requirement that systems administrators working with government data should be in the United States.

“Those are the things we can do,” Wenger said.

"The reality is when you put data in the cloud you should have your own copy” of the data, said Stan Wisseman, a senior associate with Booz Allen Hamilton.

As part of their relationship with contractors, agencies have to figure out their cloud provider's strategies up front. “I don’t have an obvious answer but to make sure you have the data protected elsewhere,” Wisseman said.

Part of answer to the question about getting out of the cloud is you can never get your data back, another attendee in the audience said. He asked if there are any plans for a template for service-level agreements like in commercial practices that people can follow.

“Why do we have our data in India or China or other places where they shouldn’t be?” he asked.

“I don’t’ see anything different in how you plan for enterprise computing and cloud computing,” said Alfred Rivera, director of the Computer Services Directorate of the Defense Information Systems Agency. DISA runs a private cloud known as The Rapid Access Computing Environment, which allows Defense Department users to quickly acquire computing power and build applications.

“The hard question from a public cloud perspective is, how do you ensure the data is now your property and not the property of the cloud vendor?” Rivera said. As for planning for security and the private cloud, DISA followed the constructs and guidelines that the agency and DOD would use for computing in general for data center operations. And these guidelines “are still compliant not only with the cloud but for all operations we do,” he said.

Service-level agreements aside, the data is still on de facto basis controlled by the cloud provider, another attendee said.

One possible way to maintain control is to encrypt the data before it leaves the organization’s boundary. It would only be decrypted when it gets back into the enterprise. The keys to encrypt that data would be owned by the agency or organization, he said.

Booz Allen Hamilton has worked with an agency to encrypt data in the cloud, Wisseman said, adding that encryption offers its own set of challenges. However, “I think some type of stealth protecting model is a good way of working at it,” he said.


The 2014 Federal 100

FCW is very pleased to profile the women and men who make up this year's Fed 100. 

Reader comments

Thu, Jun 10, 2010 Dr Bob Hacker Texas

Your money may be in the bank, but the surprise to you may be the fact that your paper receipts may be required to prove your deposits when the bank hardware fails. This has happened to mey twice: Once in New Jersey and once in Texas. The state of affairs here reminds me of a favorite quote from my grandmother: "A fool and his money are soon parted!" Some folks at the CIA and elsewhere also say: "Trust is a form of mental illness!"

Thu, Jun 10, 2010 Scott Texas

“What is implicit there is that the systems administrators will be in the U.S., which as you pointed out is not always the case,” Mell said. What should be added is that not all system administrators manage the application or data residing on their systems. Those belong to the application owners. If data moves to the cloud and the cloud is managed by a third party (not internally controlled) you have no way of knowing who exactly has access to the data at that point. How many US companies subcontract to foreign companies within IT? One just has to look at the data breaches that have already occurred across numerous companies, companies selling data without users knowledge (Facebook), or companies collecting data without consent (Google). I would be very careful in what time of applications or services I would move into the cloud.

Thu, Jun 10, 2010 david DC

Poorly written article with no new information and confusing definitions. It makes us Federal IT folks sound like complete buffoons. FCW should really get off the cloud bandwagon it is passé and irrelevant. I suppose it gives marketing folks something new in the vocab. Plus, most of us who run IT shops are still trying to reach industry service levels with the mess that grew from the other silver bullets you promoted.

Thu, Jun 10, 2010 Harvey Lee Hayes

This was a very interesting article discussing Pro’s & Con’s of Cloud computing. I am currently employed with the Federal Government as a Systems Engineer. In my opinion there are still too many unanswered questions in regards to Cloud Computing. With Cyber Terrorism at an all time high and after 911 we have a diligent responsibility to the American people to insure that all government computer and data systems are protected beyond a shadow of a doubt. The science of Risk Assessment will drive the decision making component of Cloud Computing. In the end the question will remain the same. “How much are we willing to risk, before we store data/information in the Cloud and at what cost”.

Thu, Jun 10, 2010 RayW

Talking with some young folks (less than about 25 years old) who think nothing of storing stuff on the 'cloud', I get the feeling that most people do not realize that once you use the internet, no matter what type of Microsoft "feel good" security you are using, your information is out there for picking up.

Then you have the 'social' networks where I have heard many times, "I have my permissions set", but when I ask how they know that, they say they trust the 'social' site.

The original design of the internet as we know it was to allow multiple paths of redundancy to alleviate service interruption in the event of a major nuclear attack. The commercialization of the internet has reduced that a lot, but we still do not know what paths our data takes. Sure, TRACERT will tell you one path, but how do you know that it did not also go another route that was not noted for the test? And every time a packet goes through another system, there is a storage point that can collect it.

Once your data gets on the net, you have lost control of it, no matter how tightly you think it is controlled. You might know the end points, but the paths in-between are unknown, and if known, subject to change without notice. Encryption is a nice idea, but as we have found out over the years , the only really secure encryption is one that keeps changing on a very regular basis, not an easy task on the internet unless you have just a few points of failure to do the insertion into the 'cloud'. Plus it is another slow down on the already slow government systems.

The only really secure (well....) system is to keep everything you need to keep secure inside a private network/'cloud', and only go outside when you need resources out there or a path to another secure cloud, then for the secure paths do the encryption as needed. In this era of globalization, you do not know if the known and unknown services you are using are not tied back to the entity that is trying to overthrow what you stand for unless you control it directly. Only problem is, who pays for it?

My uneducated opinion and not that of my boss, the base, the Air force, Congress, or the pres.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above