Feds: We Need Priority Access To Cloud Resources

New submitter BButlerNWW writes "Federal agencies must be assured priority and uninterrupted access to public cloud resources before fully embracing the technology for national security and emergency response IT functions, a recent report finds. It recommends creating a program to develop a system to ensure federal organizations receive 'first-in-line' access to cloud-based resources during emergency situations."

Comments

How about no?

[Anonymous Coward]

What about business continuity? What about friends, families and coworkers staying in touch? What about private companies that run CRITICAL infrastructure, like ISP data centers?

Fuck the feds. Just because it's government employees doesn't mean that it outstrips all other considerations, bar none. They act otherwise because if they can convince enough people, they get more money and power for themselves.

Re:How about no?

[INT_QRK]

The U.S. federal government mindset is shifting inexorably from its intended role of democratic representatives to that of rulers. So sad to see.

Re:How about no?

[chrb]

This article is just anti-government spin and alarmism. It is government policy to move as much computation as possible into the *public* cloud. This report just says that the public cloud, at the moment, is probably not ready for "national security and emergency preparedness" tasks. The report goes on to give examples of some of the service level agreement requirements that would be required ("continuous monitoring of the cloud infrastructure by the provider, third-party audits, data encryption and various certifications and accreditations, including continuously evolving accreditation requirements from the Federal Risk and Authorization Management Program").

Anyone arguing against this is going to have to produce a coherent rationale for using the public cloud for national security and emergency preparedness tasks, and show that public cloud providers like Amazon and Microsoft will continue to operate effectively in a national security / emergency situation. Of course, "national security" is an over-broad umbrella that is used to shield too many places from the public view, but that is a another argument...

Re:How about no?

[MickyTheIdiot]

Not only rulers, but corrupt, entitled rulers demanding huge amounts of money for political favors.

Re:How about no?

[eric_herm]

Because someone will tell them this is cheaper. Because they already use some non governement owned infrastructure do for various things ( ie, last time I looked, the phone line were not private one to be used only for governement, the cars, etc ). In fact, even the weapons are not made by the governement directly, but by private companies ( not that this is good, or desirable, and I know that's more complex that ust public/private )

I think they are just saying "if someone want to propose to put our infrastructure there because that's hype, here is what we ask and need". That's IMHO easier to do with a private offer ( especially since lots of things are coming in free software on that part ), but they cannot just say "we will not go there", without giving justification. ( especially since that's the same justification than the requirement for a internal private cloud/IaaS infrastructure )

Re:How about no?

[Coeurderoy]

You might want to stick your head out of your own.
ANY organisation wich manage critical infrastructure, and it does not matter if it's critical for "them" or for the "public" should really think of it's policies when it comes to the cloud.

The real issue is that some bunch of idiots said "hyeaa we are all going to the cloud because it is sooo cheeappp", and so "hype" and all this "doublgoodness"...
And someone surprisingly enought wrote: well if you want to put critical infrastructure in the "public cloud" you'd better think twice,and see how much it really cost when you start asking hard question, like: if suddently we need 10x the processing capacity because of a large scale disaster, how will you prioritize ?

And BTW: if any private organization runs a critical service (security, fire protection, health care, etc...) and is not asking for similar level of services for what ever they put in the cloud, then they are either incompetent or thieving scums who are privatizing public services for private gains and giving sloppy services.
A competent and honest private organization with this kind of public mandate would make sure that it complies with what the public expect (and with what should be written in its mandate)

Re:How about no?

[arth1]

Why the HELL would you want to risk matters of national security being sent over the public cloud!>?!?

You'd think that matters of high security would warrant their OWN PRIVATE Government run cloud servers...wouldn't you?

That's pretty much what they're saying, elaborating on the whys, in case some bean counter attacks the government for not doing it as cheap as possible.

Re:How about no?

[hoppo]

That's where "federal" has become quite a misnomer. This is becoming more and more a national government.

Re:How about no?

[hoppo]

Politicians are corrupt. This is not new. It is the reason this country was founded on the notion that government should be granted very limited power. Humans are imperfect. The original design of our system of government was based on accepting that imperfection, and limiting the power that anyone can wield.

Re:How about no?

[__aaltlg1547]

This view bleeds over from how the government uses the radio spectrum. On the channels they use, they have priority access and all other must wait for them because it's (theoretically) public safety. But the same doesn't hold true for any and all data storage. Cloud data storage is a convenience, not for critical data. They need to be reeducated if they think they can use the cloud for mission critical data they need immediate access to.

Re:How about no?

[MickyTheIdiot]

Which means that you can't let corporate leaders have power to change the laws at will through political contributions, either.

The right is paying way too little attention to the amount of power corporations wield. It's not just about politicians anymore.

Re:How about no?

[Darkness404]

Except for the fact that corporations:

A) Only have voluntary power/wealth

B) Must use the government to abuse its power

If you reduce the power that the government has, you eliminate corporate abuses because all corporate abuses need the government.

The difference between a megacorporation and the government are huge. Walmart does not force you to purchase its products or face imprisonment, but thanks to the recent Supreme Court ruling the government can. You can choose never to support a megacorporation or any corporation if you so choose. For example, I don't buy Sony products because of their policies with DRM and rootkits and removing features (as in the PS3), that means Sony doesn't get a penny from me. On the other hand, there are numerous things that I don't agree with the US government with, yet they force me to pay taxes (essentially stealing) via the barrel of a gun.

Saying that corporations are dangerous is incorrect. Corporations are only dangerous with government power, reduce government power and you reduce any damage that corporations can do to nothing.

Re:How about no?

[hoppo]

It's more about us. We have consistently abdicated our powers for relatively small payouts. A little social safety net here, some security theater there. Every time we clamor for government to intrude into some new area, we empower politicians at our expense. If politicians hadn't been handed unheard-of power over the past 80 years, what exactly would corporations be buying with their campaign donations? We like to act as if we have been wronged, when in reality we have done it to ourselves.

Re:How about no?

[rickb928]

The single most important reason for our Federal government to advocate public cloud computing isnot about emergency resources or any such performance features.

It's about surveillance. In the cloud, they only need to deal with the provider, and have access to everything - warrants not necessary. My corporate server is behind a firewall that offers at least minimal resistance. My home server is even more difficult, not because it's any more well secured, but because the government can't so easily coerce the vendor to grant them a back door. No, my home server uses no Microsof or Cisco products at all.

We are not far from having the fight over real privacy and government intrusion. And this Administration, despite its initial promises to be transparent, open, and ethical, has continued the progress of other Administrations into our private information, in all forms.

This is more serious than most of us think. Corporations marshalling our data can lead us into choices we would not otherwise make, deny us opportunities we would otherwise have, and cost us more than we should otherwise have to pay. Government is trying to assert itself into our lives in extrordinary ways, and will use this data to deal with us to our detriment. Healthcare will become a more constrained resource with a single-government-payer system, and the more data they have on us, the better they can make decisions to manage that resource. And that will NOT improve our health. It will only reduce costs.

Where I come from, reducing the cost of something is easily achieved by reducing the quantity or quality of it.

Denying the government private data it shoudl not have is a two-edged sword. First, deny them the need - keep them out of your life as much as possible and practical. Second, challenge their collection of the data at every turn.

The public cloud is very attractive to those who want to see everything. It makes it easier. The debate about emergency services and whether they should be provisioned as dedicated resources is another issue entirely.

Re:How about no?

[Darkness404]

So explain to me the harm that a corporation has in a free market.

What is the primary motivation for a corporation? To make money for their shareholders.

In a free market, how do corporations get money? From providing services and products.

Are you going to pay for services/products that do not improve your quality of life? No.

Therefore, if a corporation wants to make money (which is the entire point of a corporation) it must produce products/services that improve people's quality of life, otherwise it goes bankrupt. If you don't want to support a corporation, you don't have to. You can live your entire life without buying a Sony product, without buying anything from Wal-Mart, etc. If you live in the US though, you can't not fund the various wars and drone strikes without going to jail.

Corporations therefore must produce products that the public likes at a low enough cost to remain profitable.

Re:How about no?

[moeinvt]

". A corporation can screw you over without involving the government at all."

Sure, they can dump toxic waste in your back yard, but only government can absolve the corporation, its owners and its employees of liability (a tort) for doing so.

"Are you next going to state that without the government, the mortgage crisis would not have happened?"

Without the Federal Reserve, Fannie Mae and Freddie Mac (creatures of government) the mortgage crisis would not have happened. Without TARP, HAMP, HAMA, AIG bailout, and trillions in secret Federal Reserve life support, the banks would have been forced to accept the consequences of their own actions, and the damage could have been repaired.

"people involved would likely now still be homeless."

Without the government there would be no more underwater borrowers (certainly not 11 million) and fewer foreclosures. Bankruptcy = sell your assets to pay your creditors. This cleanses that "bad debt" from the system because assets reset to market value (i.e. nobody buys an underwater mortgage asset at full value.)

Re:How about no?

[moeinvt]

I don't understand how Blackwater(whatever) and Pinkerton refute any arguments made by the parent. They can cause harm, as can any business or individual, but only government can grant them free license to break the law and commit atrocities with full legal immunity. Not to mention the fact that these companies largely exist by fulfilling government contracts.

"without regulation, you have circa-1900 America - 16 hour workdays, minimal pay, zero safety controls and child labor."

Plus a thriving industrial economy, massive growth in both productivity and real wages and a blossoming organized labor movement dealing with the abuses you describe. Not to mention the fact that millions of migrants were coming into the country to take advantage of the opportunities in the industrial economy.

No age was a Utopia, we need a radical shift of resources away from government to achieve the balance you describe. It shouldn't cost $3.8T to enforce labor, safety and environmental laws.

Re:How about no?

[TubeSteak]

Saying that corporations are dangerous is incorrect. Corporations are only dangerous with government power, reduce government power and you reduce any damage that corporations can do to nothing.

I'm sorry Darkness404, but you hold an extremely flawed view of the world.

So explain to me the harm that a corporation has in a free market.

That's easy, just look at a time in history when the USA had a truly free market, with barely any government interference.
Corporations were polluting, abusing their employees, hiring children to work 12 hour shifts, not providing a safe working environment, etc etc etc.
None of this should be news to you. Hell, black lung disease is making a comeback in coal mining country.
Why? Because there's no enforcement of regulation and it's cheaper for the mining corp to not fix their safety equipment.

I suspect the problem with your worldview is that it conflates free markets with competitive markets.
History shows us that these are not the same thing.

Re:How about no?

[KhabaLox]

In a free market government isn't involved in private dealings, it is not involved in business it is not involved in money, it is not involved in labour, it is not involved in interest rates and it is not involved in trade and it does not have to be involved in contract or civil law either, I would prefer that it wasn't involved in that at all, because if gov't is involved in this, eventually it will become corrupt.

The argument about corruption is an interesting one and a valid topic, but a bit outside the scope of this discussion. You say that you "prefer that [government] wasn't involved in [contract or civil law] at all." Yet you said before that "Should a factory be throwing their pollution my way, I immediately have a claim against that company in the free market." If not for the government instituting the tort framework, you wouldn't have a claim against the company.

If a free market is one with NO government involvement, then by definition you will not have any legal recourse against another party imposing externalities on you.

What I am saying is that gov't shouldn't be limiting liability, it shouldn't be offering protections to some people against other people in business, in money, in trade in any commercial interests.

The question of limiting liability is ancillary. I agree that to accurately cost externalities you can't limit liability on (for example) BP in the case of the Deepwater spill. In order for the true cost of the externality to be borne by the agent causing those costs (i.e. BP, Halliburton, etc.) you can't cap damages at some arbitrary number. But what you're not understanding is that under a "free" market, there would be no liability damages AT ALL. Without the government dictating that a company is liable for damages if they spill oil into the Gulf of Mexico, you can't sue for those damages.

Of-course gov't shouldn't be creating a welfare state either, a welfare state is destruction of free market in itself.

Well, inasmuch as a free market as you describe it is desirable, then you shouldn't have a social safety net (or "welfare state" as you call it). But it's pretty clear, even objectively speaking, that the free market you describe is not desirable. The free market you describe is one in which there is no government intervention, and therefore parties have no recourse (other than brute force or silver tongues) against other parties that injure them.

Protection of private property rights means protection of private property against government abuse, against government theft, confiscation, ceasing and taxation of private property.

I'm not sure what point you are trying to make, maybe it's the grammar. Can you rephrase that so it's more clear? "Protection of property rights" as ensconced in western law, does not mean protection only from the government. I would say it is primarily protection from others individuals (thus: tort law). The post you linked to even makes the point that a "right against being murdered" is meaningless to the state because the state can execute you per it's rules, whereas a private citizen can never (legally) execute you. Likewise, the government can deny you property "rights" through vehicles like eminent domain, but another individual can't force you to give up your property, even if they are compensating you at market value.

Anyways, we are far afield. The original point is that externalities exist, both in completely free markets (which pretty much don't and never existed), nor in quasi-free markets (such as we have in the US*). Government intervention in the market is necessary to account for these externalities and assign the costs as best it can. It's never going to be perfectly efficient, but it is better than the alternative, which is to ignore the externality altogether.

*There are a million things that make our current economy not very free, such as inequality of information, inequality of power to shape the rules, government intervention, fiat currency, etc. but for the sake of discussion let's not quibble over the degree of "quasi"-ness of market freedom. We'd type ourselves to death. ;)

They have cash?

[tqft]

They can pay for first priority

Re:They have cash?

[JanneM]

They can pay for first priority.

They can, and should. I can see how access is critical, especially during events that may knock out parts of the infrastructure. Paying for the access is both fair and in spirit with the economic system they are working within.

Of course, if they do so, some people will immediately point to their cost structure, compare it to the price paid by a novelty item manufacturer for hte same resources (minus any guarantees) and promptly declare that govermnent is inept, corrupt and wasting money.

Re:They have cash?

[tqft]

Of course the government can either do it itself and be accused of being behind the time, wasting money on a depreciating asset and having over the top security requirements or;
has lost control of its IT infrastructure and is paying too much for the cloud services.

They aren't going to win.

don't see why not.

[Nyder]

After all, the government and corporations are fuck buddies, giving them better access would be part of the deal.

How about this, the government makes a fucking cloud server, make sure it's up to the security they want, and open it up for the public to use, instead of relying on a corporation who only cares about making as much money as possible for the 1%ers.

Why do they even need the cloud?

[ZorinLynx]

Why do they need the cloud? How is the cloud better than your OWN well connected servers?

Re:Why do they even need the cloud?

[Dyinobal]

This is just another case of some government guy who doesn't really understanding tech and that cloud is just a marketting word thinking that it is some great new technology.

Re:Why do they even need the cloud?

[sycodon]

Exactly. Any moron who puts critical government functions in "the cloud" ( a stupid marketing term for someone else's servers) should be fired.

Re:Why do they even need the cloud?

[gtall]

Bingo! I see no reason to use the public clouds for federal work. The U.S. government is big enough to run their own clouds where they can set the priorities. In fact, it would probably be cheaper and more secure in the long run. Who among us would turn government security over to Microsoft, Amazon, Google, or any of the other commercial entities? Just the privacy issues alone are a full-employment program for lawyers.

Personally...

[JasoninKS]

Personally, I'd want to see their definition of "emergency" first. Other than that, I'd be fine with them getting priority access in an emergency situation. If an emergency hits, the NS/EP teams need that infrastructure to take care of the situation more than (for example) Amazon needing to get packages out the door.

Re:Personally...

[Magtheridon]

Really depends on the agency to and the emergency at hand. For example, you may want the CDC to have priority access to resources during the zombie apocalypse, so that you can get recommendations on whether you have to kill the guy that got bitten, or if its only a problem if he dies of other causes.

Re:Personally...

[mcgrew]

They do need to be first in line. About fifteen years ago I took a class at a local college, and the instructor was in charge of the Illinois Secretary of State's mainframe. We all got a tour of the inside of the impressive thing. That state trooper pulling over that car needs computer access a hell of a lot more than you do, and my instructor proudly stated that they had zero downtime for five years. They have two natural gas generators in case of power outage (redundancies everywhere), that sort of thing.

If your town gets hit by a tsunami or tornado or earthquake, FEMA and your state emergency agency is going to need those computers. You probably won't.

Re:Personally...

[Americano]

There are limitless applications of the internet which may deserve higher priority.

Let's consider a natural disaster - say, a massive earthquake and tsunami hits just off the coast of San Francisco - not inconceivable, and we saw the devastation wrought by just such an event in Japan just a little over a year ago.

So, you've got entire towns wiped out, roads impassable, electricity, phone, water service completely offline, but let's imagine cell service is still largely intact in the area. Now, think back to the last time you were anywhere like a sports event or other place where thousands of people congregated all at once, and think about how shitty or non-existent cell phone service was because the service was simply overloaded.

So... who should have higher priority for access to that limited bandwidth in an emergency situation? You, to make dick jokes on Twitter, or a group of rescue and emergency management personnel trying to save lives and establish control in the affected area?

I'm pretty sure you can make a GREAT case for government agencies getting priority access during emergencies. Your twitter one-liners do not take precedence over someone else's life.

reporting of the situation to keep the populace informed

This is far better accomplished by press releases and news conferences delivered BY the people directing relief efforts than it is to look for #ZOMGEarthquake hashtags on twitter. Local reports can be *compelling* but they do little to help people understand the scope or scale of the event, they do little to help emergency responders understand what's happening, and frankly, "the populace's" understanding of the event - at least that portion of the populace not directly endangered by the event - is less urgent than finding and rescuing survivors. That's a great reason to give the responders priority access.

routing food and water to those in need

And who do you think is going to be doing this? Right, FEMA, and your state EMA. Not random people via twitter. So you just argued a second time that government should get priority access in emergency situations.

just getting on with things if you're on the same cloud and not in the emergency area.

Anybody who can say the following with a straight face and mean it is a sociopath: "I know that those people are dying over there, but I *really* need to get to youtube to watch a dancing cat video." If saving people's lives in the aftermath of a disaster requires them to knock youtube offline for a while, then tough shit, disconnect and go get some fresh air.

Here's an idea...

[SQL Error]

Don't use the cloud for national security and emergency response functions.

Problem solved.

Re:Here's an idea...

[MickyTheIdiot]

We are living in a culture where the entire political "debate" is revolving around the fallacy of false choices. If we were having a healthy debate both sides would be admitting that there are at least some areas where it is appropriate for government to be a healthy size and spend resources. Emergency management, in my humble opinion and setting all theories about FEMA set aside, is one of those areas.

It shouldn't be outsourced because you can't truly rely on a profit-based agency in a true emergency. The goal of the modern corporation is selfish and doesn't care if anyone else survives the emergency or not.

cloud in the government

[sageres]

I work for a government agency (not going to name the name), but there has been push for the last few years to put much of our processing and data storage in the public cloud.
How stupid. This type of stuff normally comes from the upper management whom the vendors happen to entertain on golf courses and parties every now and then (just like the vendors push any product there.) But the cloud is different. Somehow the jackets from MS, Google, IBM, HP and Oracle have execs everywhere up to the upper echelons convinced that it will save money on IT budget. By tying ourselves up into the cloud, we are allowing for 1. potential leak of information through public storage and 2. potential denial of availability to the information when such storage and/or processing center(s) become unavailable due to network outage, disasters, national emergency, etc.

Security

[sociocapitalist]

Why doesn't our wonderful government just outsource everything IT to India and all weapons manufacturing to China while they're at it?

I mean really...what are they thinking?

Re:Security

[MickyTheIdiot]

They aren't. We've managed to elect the biggest group of idiots to power in world history.

And it isn't just the Republicans either... so don't go there. The only people that can get on the ballot for any race are inept empty suits.

Me too.

[rodrigoandrade]

And I'm sure most people who are considering using the cloud for serious business will expect 99.999% uptime.

Granted, I don't get it right now from my ISP or my web hosting service, but they also don't try to sell me the world when they know they can't possibly deliver.

The article is 100% reasonable

[laird]

As is often the case, the headline is completely misleading. The federal government isn't demanding first priority to cloud resources.

They are saying that they can't move national security and emergency services into public clouds until the cloud providers can give them the guaranteed uptime that they have now with dedicated servers, so they're going to keep running those services on dedicated servers. This is worth talking about in that it's an exception to the general rule that the federal government is trying to move everything to cloud providers.

The article even notes that there are some specialized cloud providers (e.g. Terramark's Federal group) that offer a higher level SLA than the public cloud providers, specifically aimed at providing the kind of SLA required for national security and emergency services.

Please RTFA before flaming.

Banks vs. Under Mattress

[retroworks]

GOV: "Ok, I can see the advantages of putting my savings in this "bank". But I want to have just as rapid and priority access to it as I do when I put it under my mattress, I shouldn't have to wait in line if there is a run on the bank." BANK: "Excuse me sir, I was trying to help this lady in front of you."

Solution

[digitalsolo]

I have a great idea for a solution.

What they could do is take the cloud resources and "bottle them up" if you will, inside of some boxes that they own and manage. We'll call them "servers". Then, they could put these boxes in some secure facility that holds the data for them. We'll it a "data center".

Nah, that'd never work.

NOT AGAIN

[the eric conspiracy]

The is just another is a long series of recent articles that have totally distorted the original news.

First it was EPICs reaction to Obama's executive order.

Then it was the Nature article on tree rings.

Now it's a complete distortion of an government study on use of distributed IT resources.

Slashdot has turned into the Fox equivalent of nerd news.

They need priority access?

[cvtan]

Then I want a pony.

Re:government dictates the terms via Fannie Mae et

[Hatta]

In fact, the entire snafu can be said to be due to the government's failure to require proper mortgage paperwork in the first place.

Exactly, the entire thing was due to bad regulation. The solution isn't no regulation, but good regulation.