The principle behind cloud computing says that when you buy an application from a service provider, that application becomes a utility. You don’t need to sweat the details any more than you need to worry about how your power company generates electricity.
But computing in the cloud is much more challenging than simply switching on the lamp you’ve plugged into the wall. The reality is that as with any other IT project, the CIO overseeing a migration to software as a service must keep both feet planted firmly on the ground.
That proved true for Randi Levin, CTO and general manager of the Los Angeles Information Technology Agency (ITA) as she took Los Angeles into cloud computing territory where no large government had gone before. In 2009, Los Angeles announced that it planned to move all of the city’s employees from Novell’s GroupWise e-mail platform to Google’s Gmail. As of last August, every city department except the Los Angeles Police Department (LAPD) had made the switch — about 17,000 users in all. Los Angeles eventually expects to bring the police onto the system, and it plans to implement other tools in the Google Apps productivity suite.
At the time the deal was announced, Los Angeles became the first major jurisdiction to migrate its entire enterprise to Gmail.
“Certainly going first was difficult, just because there were no real models to look at,” Levin said. Google and the city had to work out issues such as what data to move to the new platform and how to accomplish that transfer, she said.
Also important was figuring out how to ensure that the city’s data would stay private and secure. In fact, that’s the reason the LAPD has not yet migrated to Gmail.
Google’s e-mail product didn’t initially offer all the security safeguards the LAPD required, Levin said. “We’ve had to make some changes, and they’re for the benefit of all public agencies that have a law enforcement component.” The same would have been necessary if Los Angeles had chosen Microsoft’s cloud services, she added.
Google has resolved all of the technical security concerns, Levin said. Now, the company must complete background checks on employees who administer the city’s e-mail system. “That’s a requirement from the FBI,” she said. “Once they’re finished, then we will migrate the LAPD.”
Standardize, then Secure
Some government IT executives say cloud computing will offer greater security than their current internal applications. This is the case in Minnesota, which is implementing the dedicated version of the Microsoft Business Productivity Online Standard Suite (BPOS) for all executive branch communications and collaboration. The state also is making the service available to local governments.“The Minnesota Enterprise Security Office conducted a thorough review and found that dedicated BPOS service not only met our needs, but it also increases security several fold,” said Sara Schlauderaff, deputy commissioner of the Minnesota Office of Enterprise Technology (OET). “Microsoft was willing to work with us to tailor a plan to fit our unique needs. State data will be housed in a dedicated BPOS environment, separate from other Microsoft customers, and services will be delivered directly through our secure network.”
Minnesota expects to complete the migration to BPOS this fall, Schlauderaff said.
In Wyoming, security was a topic of concern when federal officials from the IRS and the Department of Health and Human Services (HHS) inquired about the state’s move to the Google Apps platform. “We demonstrated that the solution that we’re implementing is a much more secure and robust environment than we currently have,” said then-state CIO Bob von Wolffradt.
Wyoming is in the pilot phase of its project to move 10,000 civil servants to Google Apps for Government, primarily for e-mail and calendar functions.
Security questions have arisen from other quarters as well, and the topic has produced some healthy discussions, von Wolffradt said. “It gave us an opportunity to go through the detail of how we handle things. And then it generates other questions — where’s the data, where is it at rest, how is it protected, who owns it?”
While security is a crucial concern, the nuts and bolts of an enterprise cloud migration start with even more basic issues. The first order of business is to figure out which applications will be easiest to transfer to the cloud and then decide if it’s cost-effective to move them, said Shawn McCarthy, a research director with IDC government insights in Framingham, Mass.
The best candidate for a first migration might be the function that requires the fewest links to other applications, McCarthy said. “For that reason, a lot of people are starting with e-mail.”
After deciding which applications to move, IT officials face the challenge of creating unity from diversity. In a decentralized organization, each agency might be operating in its own IT silo, with different technology platforms and operating procedures. Eliminate much of that variety before preparing to move to the cloud.
“Start moving toward a standardized data architecture and a way of standardizing things like the data fields that you use,” McCarthy said. “The more standardized you are, the easier it is to plug into the type of service that can serve multiple agencies or multiple departments.” Those services might involve line-of-business functions, such as accounting or human resources, as well as general office applications.
In addition, make sure to put a service-oriented architecture in place, so that as new services become available, users can connect to them easily, McCarthy said. “If everybody has a similar browser, similar version of Java, similar way of reaching the Internet, similar backup systems, it’s a lot easier for you to plug into a cloud service provider.”
Standardization might also include replacing multiple legacy systems with a single application for the enterprise. Between January 2009 and December 2010, for example, Minnesota moved all of its executive branch agencies from four different e-mail platforms to a single implementation of Microsoft Exchange e-mail. “This will make it far easier to move to the cloud,” Schlauderaff said.
Ready, or Not?
Migrating to the cloud might be difficult, though, if the service provider isn’t ready to meet a government’s specific needs. That’s what happened in Arlington County, Va., which had planned to implement Microsoft’s BPOS for e-mail last March. The migration is now on hold until at least July, said county CIO Jack Belcher.Having been courted by both Microsoft and Google, Arlington County chose the Redmond, Wash., firm because the county was already a Microsoft shop and officials had confidence in the company’s customer support infrastructure. “But then the delays started occurring,” Belcher said.
BPOS couldn’t perform certain functions in the ways Arlington County was used to performing them.
Vendors providing software as a service can’t expect to take a one-size-fits-all approach, Belcher said. “Your e-mail, which you’ve had for years, has been customized and managed. It has all kinds of mail lists and does certain things; it integrates with certain applications.” For example, Arlington County’s e-mail system receives data that citizens enter into online forms for reporting problems, such as potholes and graffiti. The information is then routed to the correct recipient.
Vendors don’t always understand that users need customized solutions, Belcher said. “I think there’s a tendency to say, ‘Why don’t you use what we have now, and you can live with it?’” Microsoft’s developers are now modifying the software to provide the functions that the county needs, he said. Hence the delay.
“We are committed to bringing the most advanced business-class capabilities to the cloud,” said a Microsoft spokesperson. “Today thousands of customers are successfully using Microsoft Online Services in a variety of different scenarios, and we’re working closely with customers like Arlington County to implement solutions that fit their specific needs.”
The key to matching a vendor’s offerings to your needs is to negotiate the right service level agreement, said McCarthy. “Cloud providers will offer agencies turnkey solutions at certain prices, but chances are most agencies are going to need that, plus,” he said. The “plus” might include higher performance levels, compliance with Federal Information Processing Standards (FIPS) or any number of other items. “The turnkey price is the starting point, as far as I’m concerned.”
Staff Discomfort
Moving an application to the cloud also can cause roadblocks of a less technical nature. For example, members of the IT department might resist the move because they feel uncomfortable handing their responsibilities to a third party.“People start to internalize that very quickly and ask, ‘What am I going to do? How is this going to relate to my job, my future and my career?’” said von Wolffradt. To offset this anxiety, state officials in Wyoming made it clear that although the cloud computing project aimed to make state government more efficient, there was no plan to reduce head count.
“We’ve reiterated that every single time we could,” von Wolffradt said. “So there is no expectation that people are going to lose their jobs.”
Levin, too, faced concerns among IT professionals whose jobs would change as Los Angeles adopted Gmail. But with so much technology to manage, compared to the number of employees, there’s no lack of work for city employees, she said. “We’ve been spending more time now on introducing [smartphones] and other types of devices to the organization. They see a life beyond just running e-mail.”
Along with managing worried IT professionals, a CIO conducting a cloud migration needs to manage end-users who don’t like the prospect of change. For a worker who has been using the same e-mail, document editor or other essential office tool for years, switching to a different platform might feel as awkward as shifting to an unfamiliar desk and chair.
In Wyoming, where each agency traditionally has chosen and managed its own e-mail interface, von Wolffradt and his team enlisted agencies to help solicit and evaluate bids for the new service.
“We’ve kept that agency team intact,” von Wolffradt said. “They’re actually the ones overseeing the implementation.” Anyone who wanted to make a statement or voice a concern about the transition has been able to do so. “We just required them to be part of the solution as well,” he said.
Another concern is whether moving data to facilities operated by a third party violates any local, state or federal regulations. For example, some government agencies aren’t permitted to store data off their own premises.
This wasn’t an issue for Los Angeles. “No city, I believe, is going to allow data to be stored outside the continental United States,” Levin said. Off-premises storage within the U.S. is not a problem.
Like security issues, questions about proper handling of government data in the cloud have prompted some long-overdue discussions, said von Wolffradt. “We in IT have struggled with the legal ramifications of e-mail, storage, public records, discovery and all that for many years,” he said.
Von Wolffradt and his team are working with each Wyoming state agency to understand its rules on records retention and make sure Google’s service is configured to comply with those rules. “It forces the issue to the top of the list,” he said. “That’s what hasn’t happened in the past.”
Regulations that bear upon a government’s use of software as a service may vary greatly by state, McCarthy said. Joining a professional organization is the best way to stay aware of all the relevant requirements., he said. “Your state or region likely has a group focusing on cloud, deciding what the best practices are for everything from writing contracts to the technologies themselves.”
Devil in the Details
Thoroughly understanding your needs and ensuring your vendor can meet them is key to a successful cloud migration.“It’s the right road to go down, but I think you have to validate and verify that they can deliver on what you want. The devil’s in the details,” Belcher said. If the offering doesn’t already satisfy those needs, how much will the vendor do to accommodate them? “And when you call, will someone pick up the phone and take it as a priority?”
Good governance and good communication are critical, as with any IT project. “Over-communicate. Assume nothing. Even be redundant in your communications to make sure that you’re reaching everyone,” said von Wolffradt. Numerous IT officials from other jurisdictions warned Wyoming of the importance of communication before the state embarked on its Google Apps project, and it has proven to be valuable advice, he said.
“Keep the lines of communication open with agencies throughout the decision-making process,” said Schlauderaff. “Give technology leaders across the enterprise the opportunity to provide input and feedback and work toward an agreement that benefits all parties.” Most importantly, she said, articulate the business benefits clearly, so everyone will understand and embrace the opportunity.
“Do a lot of detailed planning,” Levin said. “Know what your business case is. And then, I’d say, definitely do it.” In Los Angeles, she said, the benefits are very clear. “For us, who are under such severe economic constraints, not having to run the e-mail every day is a breath of fresh air.” ¨
Contributing Writer Merrill Douglas is based in upstate New York.
