Business in the Cloud

The Authority on the Future of Technology October 2011 BUSINESS www.technologyreview.com

IMPACTPublished by MIT

OCTOBER 2011 Business in the Cloud

www.technologyreview.com Corporate Energy Strategy 1 Executive Summary

CONTENTS The Meaning of the Cloud The Big Question The cloud isn’t just a convenience. It’s a new way of doing business. 2 The Cloud Imperative But as with any new opportunity, there are risks. 3 Cloud Computing Defined By ANTONIO REGALADO Emerged Technologies 4 Facebook Shares Its Designs 5 How to Bid on Computing Power loud computing is an idea whose ernments (see “Transcending Borders, but 6 The Social-Network Chip time has come. As Simson L. Gar- Not Laws,” page 15) or by hackers. While 7 New Directions: TR’s Picks Cfinkel explains in his opening essay, most experts say the cloud is as safe as, if not 9 4 Ideas for Using Server Heat “The Cloud Imperative,” on page 2, the safer than, most company IT departments 11 Google’s Chromebook Experiment notion of purchasing computing power as if (see “Being Smart about Cloud Security,” it were a utility—such as electricity—dates page 20), other researchers are discovering Case Studies 12 The Battle for the Government to the 1960s. What has changed is that this major vulnerabilities (see “Researchers Rain idea has become technically and economi- on Amazon’s Cloud,” page 19). It turns out 13 Hollywood’s Cloud cally feasible. Whether using Gmail, shar- the power of the cloud is nearly as helpful 14 File Sharing Is Serious Business ing files online, or trying out new business to criminal enterprises as it is to legitimate 15 Transcending Borders, but Not Laws software, we now increasingly rely on com- ones (see “The Criminal Cloud,” page 22). 16 Service Blackouts Threaten the Cloud puters located at remote data centers, and The technology that runs the cloud is 17 The Virtual HR Department less and less on desktops or company serv- also evolving. In effect, the operating envi- ers we can actually see, touch, and boot up. ronment for software is no longer our desk- 18 Chasing the African Cloud The consequences are profound. For tops or the corporate server. Instead, it has 19 Raining on Amazon’s Cloud companies, especially small ventures, the become a feature of the Internet itself. One Leaders cloud is democratizing computer power in consequence is that we can use dumber, 20 Being Smart about Cloud Security ways that make them more competitive. cheaper devices, and get our brains from the 21 Can an Open Cloud Compete? In this issue, we show how easy access to cloud (see “Google’s Business Experiment: 22 The Criminal Cloud affordable, unlimited, computer power is Nothing but Web,” page 11). But there is also 24 The Man Behind Cloud Valley affecting industries like computer anima- a growing debate over who will control the tion (see “Hollywood’s Cloud,” page 13) and cloud, pitting proprietary models against 26 The King of Cloud why it now allows startups to quickly launch a burgeoning open-source movement (see Who Coined ‘Cloud Computing’? 27 mass-market software (see “Why Simple File “Facebook Shares Its Cloud Designs,” page 4). Infographics Sharing Is Serious Business,” page 14) that This issue of Business Impact also uncov- 29 Business Gets Remote can challenge even giants like Microsoft. ers the pioneers of cloud computing in the Nowhere is the change as fast as in enter- developing world (see “Chasing the African BUSINESS IMPACT prise software. The shift is toward Web-based Cloud,” page 18). Countries with limited IT is published monthly by Technology Review programs with consumer-friendly design, infrastructures now find they can bypass Senior Editor, Business values, and prices. “In the future, all software decades of legacy hardware and software, Antonio Regalado will be delivered in the cloud,” predicts Sales- just as consumers in those places moved Deputy Editor force.com CEO Marc Benioff, who a decade directly to cellular phones without ever own- Brian Bergstein ago was among the first to predict the rise ing a land-line telephone. Assistant Managing Editor of online business software (see “The King In China, entrepreneur Edward Tian Timothy Maher of Cloud,” page 26). Naturally, established is leading a Beijing technology incubator Art Director software vendors are racing to keep up (see called Cloud Valley (see “The Man Behind Lee Caulfield “The Virtual HR Department,” page 17) and Cloud Valley,” page 24). Tian has a slogan Design Director Conrad Warre move their applications to the cloud as well. that aptly describes the economic proposition The cloud brings difficult legal and secu- that cloud-computing technology offers the Staff Editors Tom Simonite, David Talbot, Mike Orcutt, Erica rity challenges. Many worry that data stored world. “The price of a book,” he says. “The Naone, Emily Singer, Linda Lowenthal online could be subject to snooping by gov- power of a supercomputer.”

www.technologyreview.com Business in the Cloud 1 The Big Question

run the machine, a second hard drive for The Cloud Imperative redundancy, Microsoft’s Exchange Server Treating computing as a utility, like electricity, is an old idea. But now it 2010 to let an administrator manage the makes financial sense—a historic shift that’s reshaping the IT industry. e-mail, and employee licenses of $35, you’re up to at least $3,250 for a department with By SIMSON L. GARFINKEL 50 employees. Alternatively, you can have your employees use Microsoft’s cloud-based service, Exchange Online, for $10 per user efore Facebook and Google—even What has changed since McCarthy’s time per month, with unlimited storage. On the before the Internet—scientists at is the advent of advanced “virtualization” sys- surface, a $6,000 annual cloud bill might BMIT had a radical vision they called tems that can generate just the computing not seem like the better deal, but doing it the computer utility. resources needed at any time. This means yourself carries high hidden costs, from hir- “Computing may someday be organized as that service providers such as Amazon can ing someone to manage e-mail servers to a public utility just as the telephone system offer a pay-as-you-go utility billing model to keeping up with security updates to pay- is a public utility,” Professor John McCarthy customers on a very large scale. The conse- ing air-conditioning bills for your IT room. said at MIT’s centennial celebration in 1961. quences of this shift are far reaching: today Despite its advantages, many businesses “Each subscriber needs to pay only for the there’s very little need for businesses to pur- aren’t confident about the cloud’s security capacity he actually uses, but he has access chase a computer system other than PCs and and reliability. Yes, Google has had a few to all programming languages characteristic laptops for employees. Whether they need Google Docs outages, and Amazon had an of a very large system.” a mail server or a rack of computers for a embarrassing situation in April 2011, when Those words presciently describe a phe- high-performance computing cluster, com- some customers lost service and data. But nomenon sweeping the Internet today: panies can almost always save money and companies that manage their own data cloud computing. Instead of buying their get better performance by hiring a service have downtime, too—typically more than own computer systems, companies, indi- in the cloud instead of buying their own. a few hours each year. What’s more, Google viduals, and even governments can share Consider the economics of handling and Amazon responded to these outages as time on a common computing infrastruc- e-mail. Today, the cost of an entry-level only publicly traded companies would: they ture. This vast system is cheaper to operate Dell server to receive, store, and route the issued detailed reports on what happened, than many individual computers scattered messages is less than $300. But by the how big the problem was, and what they were among different businesses and agencies. time you add Windows Server software to doing to prevent it from happening again. One of the few areas where cloud-based offerings are not vastly superior to the systems that they replace is desktop produc- tivity apps—word processing, spreadsheets, presentation software, and calendars. Yes, Google and Microsoft both offer cloud-based office applications. But the desktop versions still are faster, more flexible, and easier to use. What’s more, you can put 10 years’ worth of documents on your laptop and edit them anywhere. But be sure to encrypt the files on that laptop—and back them up to the cloud. Although every organization on the Inter- net essentially is using some cloud-based service, they should use more. The economies of scale are mind-blowing. Someone who wants to go buy a rack of servers prob- J ably hasn’t done the math. MADARA ASON

SIMSON L. GARFINKEL IS BASED IN ARLINGTON, VIRGINIA. HE FO- SEEDING THE CLOUDS Facebook’s data center in Prineville, Oregon. CUSES ON SUCH TOPICS AS COMPUTER FORENSICS AND PRIVACY. HE IS A CONTRIBUTING EDITOR AT TECHNOLOGY REVIEW.

www.technologyreview.com Business in the Cloud 2

The Big Question

Daily search requests for “cloud computing” divided by the 2004–2011 average provide scalable databases, message queues,

4.5 Web-accessible storage, and the “Mechanical Turk” system for organizing human com- 4 putation. The Google App Engine, a system for high-performance computing, is another 3.5 example. Microsoft is also a supplier: its 3 Azure service provides preconfigured computers running Windows and SQL Server. All 2.5 of these are elastic pay-as-you-go services. For example, you can tell Microsoft you want 2 a “small” computer (one-gigahertz CPU, 1.5 1.75 gigabytes of RAM) and a 10-gigabyte SQL database. Your cost is $190 per month. 1 Software as a Service (SaaS) is at the top of the cloud computing stack. Here the cloud 0.5 providers have created applications running 0 on server farms that may themselves be geo- 2008 2009 2010 2011 graphically distributed. Although Salesforce. Source: Google Trends com has long been held up as the premier SaaS provider, Facebook, Flickr, eBay, Yahoo Stores, Amazon Marketplace, the backup- Cloud Computing Defined storage provider Carbonite, and the finan- A primer on key terms in Business Impact this month. cial assistant Mint.com offer SaaS as well. Cloud computing does not require mak- By SIMSONDaily L. search GARFINKEL requests for “cloud computing” divided by the 2004–2011 average 4.5 ing your data available on the public Inter- net. If your data is too sensitive for that, 4 your organization might be a good candi- 3.5 date for what NIST calls the private cloud o bring some order to the fuzzy service; accessibility from desktops, lap- deployment model, in which an organiza- 3 world of cloud computing, the U.S. tops, and mobile phones; resources that are tion operates a cloud strictly for its own use. government’s National Institute of pooled among multiple users and applica- The community cloud is a private cloud T2.5 Standards and Technology has created a tions; elastic resources that can be rapidly that’s shared by several organizations and standard2 definition and a Cloud Comput- reapportioned as needed; and measured typically supports a specific requirement. ing Reference Architecture. Both are in the service. These characteristics make cloud For example, a group of health-care orga- form1.5 of “Special Publications,” which are computing a kind of infrastructure or utility. nizations might create a community cloud not official government standards but are NIST defines three “service models,” or to hold patient medical and billing records. 1 designed to provide guidance. types of service, that a cloud provider might A public cloud is a system that’s owned 0.5The NIST Definition of Cloud Comput- sell. Infrastructure as a Service (IaaS) is the by the cloud provider and made available ing is based on NIST-sponsored workshops most basic. Customers can buy processing, to the general public. Facebook and Google and0 public comments. It defines cloud com- storage, and network services and then build fall into this category. 2008 2009 2010 2011 puting as “a model for enabling ubiquitous, their own systems on top of this infrastruc- Last is NIST’s hybrid cloud model, in Source: Google Trends convenient, on-demand network access to ture. Two of the best known IaaS providers which multiple cloud systems are connected a shared pool of configurable computing are Amazon and Rackspace. in a way that allows data to be moved eas- resources that can be rapidly provisioned Platform as a Service (PaaS) is one step ily from one to another. A company might and released with minimal management up: vendors provide preconfigured comput- develop its system on Amazon’s IaaS but effort or service provider interaction.” ers running operating systems and applica- then run one version on Amazon for pub- The definition specifies five “essential” tions. Amazon is a player here too, with a lic data and a second on a private cloud for characteristics of cloud computing: self- variety of highly specialized offerings that sensitive information.

www.technologyreview.com Business in the Cloud 3 Emerged Technologies

THE MACHINERY A Facebook employee shows one of the servers that the company’s engineers designed from scratch for its massive data center in Oregon.

Among the partners: chip makers Intel and AMD, which helped Facebook’s engineers tweak the design of the custom motherboards in its servers to get the best computing performance for the least electrical power use. Chinese Web giants Tencent and Baidu are also involved; after touring Facebook’s Oregon facility, Tencent’s engineers shared ideas about how to distribute power inside a data center more efficiently. Even Apple, which recently launched its iCloud service, is testing servers based on Facebook’s designs. Eventually the Open Compute Project could exist independently Facebook Shares Its of the company that started it, as a shared resource for the industry. Cloud Designs Not everyone wants servers to run just Cloud hardware could get cheaper because of the social network’s like Facebook’s. That’s why Nebula, which self-interested altruism. offers a cloud computing platform derived from one originally developed at NASA, By TOM SIMONITE is tweaking Facebook’s designs and contributing them back to the Open Compute project. Nebula CEO Chris Kemp says this work will help companies that need greater f you invented something cheaper, its designs widely, which could in turn drive memory and computing resources, such as more efficient, and more powerful down the cost of the sever computers that biotech companies running simulations of Ithan what came before, you might deal with the growing mountain of pho- drug mechanisms. want to keep the recipe a closely guarded tos and messages posted by its 750 million Larry Augustin, CEO of SugarCRM, secret. Yet Facebook took the opposite users. Just six months after the project’s which sells open-source cloud software to approach after opening a 147,000-square- debut, there are signs that the strategy is help businesses manage customer relations, foot computing center in rural Oregon this working and that it will lower the costs of sees challenges for Facebook’s project. “There April. It published blueprints for everything building—and hence using—cloud comput- have always been efforts on open hardware, from the power supplies of its computers ing infrastructure for other businesses, too. but it is much harder to collaborate and share to the super-efficient cooling system of the Facebook’s peers, such as Google and ideas than with open software,” he says. But building. Other companies are now cherry- Amazon, maintain a tight silence about Augustin expects the era of super-secret picking ideas from those designs to cut the how they built the cloud infrastructure that data center technology to eventually fade, costs of building similar facilities. underpins their businesses. But that stifles simply because the secrecy is a distraction The Open Compute Project, as the effort the flow of ideas needed to make cloud tech- for businesses. “Many Internet companies to open-source the technology in Facebook’s nology better, says Frank Frankovsky, Face- today think that the way they run a data vast data center is known, may sound altru- book’s director of technical operations and center is what differentiates them, but it is istic. But it is an attempt to manipulate the one of the founding members of the Open not,” he says. “Facebook has realized that J market for large-scale computing infrastruc- Compute Project. He’s working to encour- opening up will drive down data centers’ MADARA ASON ture in Facebook’s favor. The company hopes age other companies to contribute improve- costs so they can focus on their product, to encourage hardware suppliers to adopt ments to Facebook’s designs. which is what really sets them apart.”

4 Business in the Cloud business impact October 2011 Emerged Technologies

Currently, Cohen says, 1,300 companies have registered to sell computing power on SpotCloud (another 2,100 people have registered as buyers). At any given time those sellers are offering the computing-power equivalent of 100,000 servers with 400,000 gigabytes of computer memory. To put that in perspective, AT&T owns only slightly more than 20,000 servers. Sellers currently offering computer capacity on SpotCloud include Domicilium, a Web hosting company that built a 20,000-square- foot data center on the Isle of Man, a tax haven off the Irish coast. Cohen says he recently got a call from a data center that streams weekend games for a major sports league in the United States. The problem: “Most of the time the provider’s servers sit idle,” he says. “We’re talking tens of thousands of servers that do nothing between How to Bid on Monday and Friday.” Exchanges such as SpotCloud aren’t yet Computing Power attracting huge e-commerce companies New online exchanges aim to turn computer time into a globally looking to run critical software or websites. traded commodity. Instead, buyers are on the lower end of the By CINDY WAXER market—companies looking for overseas data centers to test location-specific applications, or to run so-called batch computing operations on the cheap. magine buying time on a computer in ity. “The more utilized you are as a [cloud Another challenge facing exchanges is Ireland or Indiana the same way you’d services] provider ... the faster return on that different cloud services purchased on Ibid for an antique on eBay. That’s how investment you’ll realize on your hardware,” an exchange won’t necessarily work together. a new crop of startup companies called says Reuven Cohen, founder of Enomaly, Kaplan says trying to build a computing “cloud brokerages” plan to change the way a Toronto-based firm that last February environment from a hodgepodge of remote companies buy and sell computing capacity. launched SpotCloud, cloud computing’s computers presents a “challenge [to] man- Cloud computing has already made first online spot market. ageability” that would require businesses to accessing computer power more efficient. On SpotCloud, computing power can be invest heavily in software to monitor and Instead of buying computers, companies bought and sold like any commodity. But manage those resources. can now run websites or software by leas- unlike purchasing computer time with Several companies are now seeking to ing time at data centers run by vendors like Microsoft, buying on SpotCloud doesn’t build exchanges that would both allow bid- Amazon or Microsoft. The idea behind cloud offer many contractual guarantees. ding and guarantee interoperability of com- brokerages is to take the efficiency of cloud “It’s appealing for a lot of folks to get puters from different vendors. ComputeNext, computing a step further by creating a global [cloud capacity] for a penny on the dol- a Seattle-based startup, says it is developing marketplace where computing capacity can lar, get it immediately, and turn it off just software that will let cloud clusters com- be bought and sold at auction. as quickly,” says Jeffrey Kaplan, managing municate. Similarly, Germany’s ScaleUp Such markets offer steeply discounted director at the consultancy ThinkStrategies. Technologies is working on software called rates, and they may also offer financial bene- “But the scariness thereafter is the burden “Federated Cloud” that would let users sell fits to companies running cloud data centers, it places on the customer to ensure its suc- capacity from different data centers in dif- ECHNOLOGY REVIEW ECHNOLOGY T some of which are flush with excess capac- cess, security, and manageability.” ferent regions through a single interface.

www.technologyreview.com Business in the Cloud 5 Emerged Technologies

2010 GLOBAL ELECTRICITY USE The Social-Network Chip (18 Trillion kWh) The growth of social media, search, and shopping could help chip startups get a foot in the data-center door. By KATE GREENE

ooking at friends’ pictures on server market with its family of Xeon micro- Facebook or searching résumés processors. Xeon chips have up to 10 pro- Lon LinkedIn are relatively simple cessing centers, known as cores, that work computing tasks in which information is in parallel to do hefty computational lift- called up, retrieved, and then shipped to ing. In contrast, Tilera’s chips contain up 1.3% a user’s screen from a distant data center. to 100 smaller, lower-power cores. When ELECTRICITY USE ATTRIBUTED TO DATA CENTERS Yet such tasks are handled mostly by pow- networked together, the cores are capable (240 Billion kWh) erful microprocessors designed for more of handling common cloud applications like HUNGRY FOR ENERGY Data centers now complex jobs. retrieving user data while consuming about consume as much as 1.5 percent of the world’s That means a waste of electrical power, half as much electrical power, Bishara claims. electricity. Electricity accounts for about 30 per- says Ihab Bishara, director of cloud comput- Some cloud operators are already start- cent of the cost of running a data center, leading to demand for low-energy processors. ing products at Tilera, a chip startup in San ing to put computationally intensive jobs on Jose, California. Microprocessors serving servers that can handle them while shifting the cloud are too powerful, he says; in the simpler tasks to low-power servers, says Reu- Intel’s Atom processors (and sells them to future, he believes, many tasks carried out in ben Miller, a senior research analyst with buyers like France Telecom and Mozilla), data centers will be handled by cheaper, low- IDC. “Large companies [need] processors and Calxeda, a company that builds low- power chips like those his company makes. that are more power efficient,” he says. “It’s power servers using mobile-phone chips Currently, the chips inside data-center creating opportunities.” from ARM Holdings. servers are nearly all manufactured by Intel, Low-power contenders include Tilera as Intel is likely to remain dominant, not which commands roughly 90 percent of the well as SeaMicro, which makes servers using least because of the large amount of software that’s already designed to run on the company’s chips. However, IDC’s Miller says that as simple cloud computing tasks proliferate, the market for other chip designs will expand. In the next few years, he says, “I think Intel has the potential to see its market share come down.” Bishara believes that changes in the market for servers could speed the adoption of new chip designs. Ten years ago, he says, no company bought more than 10,000 servers annually, but now companies like Amazon, Google, Apple, and Baidu collectively buy hundreds of thousands every year. “You’re T getting a little bit of a Walmart effect in MCKIE / MARK / GOOGLE ILERA the supply chain,” he says. Big buyers can demand new types of less expensive chips custom-designed for the cloud. “Before, the supply chain was controlled by Intel,” Bishara COOL COMPUTE Low-energy processors are etched on a silicon wafer. says. “Now companies can make a choice.”

6 Business in the Cloud business impact October 2011 Emerged Technologies

New Directions for a Cloudy Future: TR’s Picks Cloud computing is changing how businesses, consumers, and even armies store and use data. Technology Review looks at six ideas at the cutting edge. By ANTONIO REGALADO

CLOUD BIOMETRICS The Unique Identifica- tion Authority of India last year began taking fingerprints and iris scans of every Indian and issuing unique, 12-digit identification numbers based on the biometric readouts. The idea is to battle fraud in welfare programs, but the database is being called the world’s most ambitious human mapping exercise. India’s population of 1.2 billion means the system will have more profiles than Facebook (which has around 500 million users). Plans are under way to build a centralized data center in the technology city of Manesar.

INTERNET AT 60 MPH The Evos concept vehicle, a plug-in hybrid from Ford, is billed as the first ANDROID BRAIN Half the weight of some robots is due to on-board computers and the batteries “cloud-connected car.” Ford has patented ideas needed to power them. This lightweight robot created by Google engineers uses an Android phone for wirelessly accessing data about a person’s as a powerful robot brain. The phone’s internal gyroscope and camera act as sensors; a wireless con- health or habits to customize their driving experi- nection to Google’s servers gives it nearly infinite memory and the ability to use apps such as maps ence by altering motor dynamics or interior tem- to navigate or Google Goggles to identify nearby objects. All this cloud robot needs is a body—in this perature. Ford believes the global vehicle fleet OOGLE / UIDAI / FORD

G case one made from Lego Mindstorms. will go wireless.

www.technologyreview.com Business in the Cloud 7 Emerged Technologies

PRINT ANYWHERE Is the “cloud printer” a last-ditch effort to sell ink cartridges, or is it the future of printing? HP teamed up with Google to let you print from any desktop or mobile device by sending documents to a printer via e-mail. The printer connects to your Wi-Fi network. The HP Photosmart eStation goes for $299.99.

DIRECT REPORT Persuading large companies to use remotely hosted business software is the largest moneymaking opportunity in cloud computing. Startup Tidemark has unveiled online analytic tools for businesses that provide real-time financial results and projections on any device, to any worker. Tidemark says its software gets data out of the hands of “Excel jockeys” with a consumer-friendly look and feel. The price: $200 per user per month.

CLONE CLOUD Smart phones communicate via the wireless network but don’t usually connect or collaborate directly with one another. Researchers at Carnegie Mellon created a network of smart phones dubbed Hyrax able to carry out shared computing tasks. Although phone processors are not the most powerful, a computing cloud made of phones could have advantages, such as allowing data processing to happen closer to the data itself. T IDEMARK / HP /ALEXANDER GEORGE / NORTHROP GRUMMAN GRUMMAN / NORTHROP GEORGE /ALEXANDER / HP IDEMARK

KILLING CLOUD Billion-dollar military computer systems spread data across battlefields and through the sky to U-2 planes, E-8C radar planes (shown) and Predator drones. Now the military wants to migrate to Web-based platforms to crunch data and locate enemies. Officials claim one data center at Bagram Airfield in Afghanistan provides “massive storage and processing capabilities” to sort through millions of intelligence reports in seconds.

8 Business in the Cloud business impact October 2011 Emerged Technologies

Four Ideas for Using Server Waste Heat Data centers use a lot of electricity, much of it just to keep computers cool. Here are some ideas to recycle the machines’ waste heat. By NEIL SAVAGE

ccording to Stanford University, data centers like those of Amazon and Facebook gobbled around 250 billion kilowatt hours in 2010, and around half that energy Aisn’t used for computing tasks at all. Instead, it powers the fans and chillers used to cool down hot computer chips. As rising electrical bills become an environmental and business concern, Technology Review identified four creative ideas for recycling computer waste heat from data centers.

BLUE COOL Blue pipes carry cold water to chill computers at Syracuse University’s Green Data Center. The facility generates its own electricity using small, gas-fired turbines. Thermal radia- tion from the turbines is used to heat water GREEN DREAM A rack of University of Notre Dame servers (at rear) heats an enclosed botanical gar- and power an absorption chiller, a refrigeration den at the South Bend Conservatory in South Bend, Indiana. Air drawn from outdoors cools the com- device that uses heat as a power source. The puters; hot air is released into the greenhouse. In winter, when temperatures plunge to -22 Celsius, system produces the cooling equivalent of 300 air from the greenhouse is circulated over the computers. The servers are connected to the univer- tons of ice, three times what the data center sity’s main computing cluster and are given more processing tasks if higher temperatures are needed. needs. Excess cold water is pumped to an adja- Paul Brenner of Notre Dame’s Center for Computing Research calls the system “environmentally cent office building for air conditioning. In winter, opportunistic computing” and says it saves the conservatory $15,600 a year in heating costs, while hot water is used in the office building’s heating the school cuts its cooling bill by $38,000. system (red pipes). OTRE DAME / IBM N

www.technologyreview.com Business in the Cloud 9 Emerged Technologies

HEAT HARVEST A pyroelectric energy harvester turns heat from a computer processor into electricity at Oak Ridge National Laboratory. A tiny cantilever, just 1 millimeter wide, rests on the chip. As the chip heats it, the cantilever bends away until it cools, then bends back to touch the hot chip again. Rapid oscillations of the cantilever create an alternating current of electricity of one to 10 milliwatts, says it creator, Department of Energy scientist Scott Hunter. A one-inch computer chip could have 1,000 such energy harvesters attached to it, producing up to 10 watts. Depending on how hot the chip is, Hunter believes he can convert between 10 and 30 percent of waste heat back to electricity.

CLIMATE MODELING A server farm at Telecity’s new Condorcet data center in Paris is part of a study of climate change. Heat from the computers is piped into an arboretum (not shown) to model warmer climate conditions expected to prevail in France in the year 2050. Scientists from the French National Institute for Agricul- tural Research are studying which species of forest and urban plants will thrive in the future. Telecity’s data center also uses energy-efficient lighting and air-conditioning. The company claims the environmental steps save 28 million kilowatt hours a year in electricity. O RNL / IBM

10 Business in the Cloud business impact October 2011 Emerged Technologies

IN THE CLOUD Google’s betting that people are ready to be online at all times. Its Chromebooks connect to the Web, and that’s it.

no conventional applications such as Micro- soft Office—is unnerving. Whether you’re composing e-mail, creating a presentation, or editing an image, you have to do it using the Web. Without an Internet connection, very few Chromebook apps will work at all. Sheth says that poses no problem for many workers. “A significant proportion of people in business today just use a browser for everything they do,” he says. Many call center workers and sales reps already rely on software accessed through a browser. Sheth’s most clearly detailed business case for Chromebooks revolves around Google’s Business Experiment: what the laptops offer to IT staff. There’s no need to install and configure security Nothing but Web software, because the only software on the Computers that do everything in a Web browser are touted as an inex- computer—the ChromeOS operating sys- pensive alternative for companies. tem—is updated automatically by Google By TOM SIMONITE and encrypts all saved data. “There’s a huge pain point for IT managers around manageability, upgrades, and ecades of Moore’s Law have a replacement will be priority-shipped for any security,” says Frank Gillett, who covers trained us to expect every new computer that breaks. Gartner research esti- emerging technologies in IT for Forrester Dcomputer to do more than the mates the total cost to a business is between Research. “Google has built a back-end ser- one before. Google’s most ambitious foray $3,300 and $5,800 annually for a regular vice for Chromebooks that takes care of all into cloud computing, however, has it woo- desktop computer, and more for laptops. that very well.” ing businesses with computers that do less. The cost of owning a Chromebook, accord- Sheth declined to say how many Chrome- Those computers are known as Chrome- ing to Google, is simply 12 times its monthly books have shipped, but there are some signs books. The laptops, officially launched in subscription cost—at most, $396 per year. the market for Web-only computers may June, use an operating system called Chro- In typical Google fashion, Chromebooks prove larger than many anticipated. Gillett meOS that is little more than a souped-up were not released as a fully polished product. recently surveyed IT buyers and found that version of Google’s Chrome Web browser. They first appeared in December 2010, when around 16 percent of them said their users “Chromebooks came from this realization Google sent a prototype, the Cr-48, to thou- could survive with just a Web browser. “I that cloud computing gives an opportu- sands of volunteer testers and journalists. expected to prove they’re really skeptical, nity to rethink what the desktop is,” says Feedback from that experiment was used but they weren’t,” he says. Rajen Sheth, Google’s program manager for in creating the first Chromebooks available As Google upgrades the ChromeOS oper- Chromebooks. The pitch to businesses: out- for sale, which appeared this summer and ating system, its stripped-down computers fitting and supporting workers with Google’s are made by Samsung and Acer. are likely to become more capable. “We’re Chromebooks costs a lot less than giving Despite the low cost, Chromebooks out- really aiming for the future vision of the them conventional PCs. perform conventional PCs in some respects. enterprise. Today is the market entry strat- Google offers Chromebooks under a They take only eight seconds to boot up and egy, not the end point,” Sheth says. He pre- subscription model, where each machine can manage even a long workday on a single dicts that it will be another three to five costs between $20 and $33 per month. battery charge. Yet logging in to find nothing years before most business tasks are done OOGLE

G That includes support and a promise that but a browser—no desktop with shortcuts, through a Web browser.

www.technologyreview.com Business in the Cloud 11 Case Studies

Google, sensing an opening, began marketing a special version of its popular Gmail service tailored for government agencies. One change: data is kept in its own bank of computers, separate from those used for “civilian” Gmail. In 2009, the city of Los Angeles chose Gmail for its 30,000 employees. That decision was a watershed. Jon Walton, chief information officer for San Francisco, says that governments had previously been reluc- tant to consider e-mail outsourcing for security reasons. “But L.A. broke that taboo,” he says. “I give all the credit to L.A. for opening up this opportunity for everyone.” The L.A. announcement was one of several jolts Microsoft received before it beefed up its cloud service. Now Microsoft will run a government agency’s Exchange servers in the company’s own data centers, which The Battle for the Government eliminates the need for hardware on the As governments all over the world move their IT to the cloud, they are user’s premises. becoming some of Google and Microsoft’s most coveted customers. One of Microsoft’s key advantages, says By LEE GOMES Susie Adams, chief technology officer at Microsoft Federal, is that most employees who work at computers, both in and icrosoft has San Francisco, Each company has a fleet of salespeo- out of government, are longtime users of Minnesota, the United States ple calling on government accounts, and Microsoft’s Office products and don’t wish MDepartment of Agriculture, the each is eager to give the impression that to switch to something unfamiliar. European Environmental Agency, and the momentum is on its side. Every significant Google counters that its cloud-based Regional Government of Catalonia. marketplace victory is thus trumpeted with offerings, like Gmail and Google Docs, are But Google is doing pretty well too, with press releases and other fanfare. Some com- both less expensive and less of a hassle to Los Angeles, Orlando, Singapore’s minis- petitions for customers end up in court, as run. David Mihalchik, head of Google Apps try of education, four states in Mexico, and when Google sued the U.S. Department of Federal, says most of the company’s success the U.S. National Oceanic and Atmospheric the Interior in hopes of undoing a $59.3 to date has been with Gmail and other col- Administration. million deal it made with Microsoft; the laboration products. No big government Those government agencies represent issue is still pending. agency has yet to dump all its Office soft- some of the trophy customers for Micro- Government organizations use cloud ware for Google products, he says, though soft and Google as the two rivals wrestle technology mostly for e-mail. In the past, some are beginning to flirt with the idea. for converts to their competing versions of that function has typically been handled So who is ahead? Shawn P. McCarthy, cloud computing. on servers running inside an agency’s own IDC’s director of research involving the gov- The public sector has historically been facilities; the software was usually either ernment sector, says that Google had an one of the biggest buyers of computer gear Lotus Notes or Microsoft Exchange, one early lead, but Microsoft has since caught up. and services; in the United States, the gov- of the cornerstones of Microsoft’s business- While both sides say their cloud services ernment’s total annual IT budget is $75 bil- software franchise. But earlier versions of save money, McCarthy says it’s hard to know T lion. As local, state, and federal agencies Exchange e-mail have been unpopular with just how much: the terms of big government ECHNOLOGY REVIEW follow the private sector in embracing cloud users in government and the private sector contracts are usually kept secret, lest future computing, Microsoft and Google want to alike, who have complained about its glacial customers become aware of the sorts of dis- grab as much of that business as they can. speeds and frustratingly small in-box limits. counts they might be able to negotiate.

12 Business in the Cloud business impact October 2011 Case Studies

Hollywood’s Cloud Remote rendering lets big-budget animators add more effects and opens doors to smaller studios. By KATE GREENE

or years, the dominant animation “It wouldn’t have been economical for me studios like Pixar and DreamWorks to buy all these machines,” says Ployhar. “I FAnimation made their cinematic knew off the bat that rendering would be magic via expensive computers that ran in the biggest problem.” data centers at the studios. Now the rise of Instead, Ployhar leased time on a cloud cloud computing, which enables anyone to service run by a New Mexico company called buy computer power on demand, is allow- Cerelink. It shares time on a supercomputer ing smaller, independent animation firms with the University of New Mexico, Los Ala- to produce very slick work. mos National Laboratory, and the Santa Fe One such firm is Afterglow Studios, based Institute. Such a setup “opens up a lot of in Minneapolis. Its owner, Luke Ployhar, is doors for a studio like mine,” he says. COMPUTER MAGIC DreamWorks uses 15,000 currently finishingSpace Junk 3D, a 40-min- Services like Cerelink’s are also helping processor cores to animate characters like Puss ute stereoscopic film about the 6,000 tons of established players like Sony and Dream- in Boots. garbage circling the planet; it is scheduled Works Animation juggle their big-budget be released in February. It’s a big project productions, which are becoming ever more for a small firm, which has required more computationally intensive as audiences come of computer processors, which it has used than 16,000 hours of computing time to to expect more 3-D effects. to render the graphics in its feature-length animate, or render, the scenes of orbiting DreamWorks Animation releases two films such as Shrek, Kung Fu Panda, and debris. Ployhar estimates that if he’d bought or three movies a year, and each film takes the forthcoming Puss in Boots. computers to do the job, he would have spent about five years to produce. It does much of Four seconds of animation takes about at least $50,000 on equipment. the work in house: it owns tens of thousands eight to 10 hours of computation to make sure the light appears to fall in a precise, lifelike way on animated panda or cat fur. Each night, 10,000 to 15,000 processing cores in DreamWorks servers in computers in California work in parallel to stitch together still frames from the previous day’s work, says Derek Chan, head of digital operations at DreamWorks Animation. But with roughly 10 projects going at any given time, the California studio has peak periods when it needs to tap the resources of cloud-computing providers, including Cerelink and Hewlett-Packard, which for several years has sold DreamWorks its high- end hardware. Last year, about 5 percent of DreamWorks Animation’s rendering was done in the cloud, but the company plans to increase that to 50 percent by the end

CLOUD-ENHANCED Animations for the independent film Space Junk 3D will be completed using of 2012, Chan says, rather than spend mil- REAMWORKS / AFTERGLOW STUDIOS D more than 16,000 hours of computer time purchased from a commercial data center. lions to expand its existing data center.

www.technologyreview.com Business in the Cloud 13 Case Studies

tous. In June, Sony Ericsson began bundling Why Simple File Sharing Dropbox with some of its Android smart phones. Houston says there will be more Is Serious Business such partnerships to follow. “In the future, Two startups that make it possible to share files at home and work everything will be with you on every device, have ambitions to rule the cloud. and the little blue box will be everywhere, By TOM SIMONITE whether it’s your phone or your camera, so you always have your stuff,” he says. Cloud computing is becoming popular among large companies, too, as a mobile workforce demands access to applications t could be among the most obvious Allowing people to host and share files from any device. Many companies are using business plans ever: offer to store in the cloud is, says Houston, “a serious data-storage software from another startup, Ipeople’s files online so they can access science project,” whose challenges include Box.net, which claims more than 7 million them anywhere. the complex “air traffic control” needed to users, and 70 percent of the Fortune 500, The failure of any mainstream computing synchronize the more than 12 million files as customers. company to meet that simple need has left that users upload or update every hour. The “To store and collaborate, most organi- a gap now being ably filled by one of Silicon zations today have to buy data storage, buy Valley’s fastest-growing startups, Dropbox, a search product, buy servers, and operate a three-year old company reportedly valued Microsoft Sharepoint [a collaboration tool] at close to $4 billion. and Office on top,” says company cofounder Free software from the San Francisco– Aaron Levie. Box.net combines those appli- based company supplies a “magic folder” cations, says Levie. into which users can place photos, spread- Levie’s latest offering is the Box Platform, sheets, and other documents. Stored cen- which enables software developers to build trally in Dropbox servers, those files are then Box.net into other software. As with Drop- automatically synchronized across all of a box, the goal is to create a common cloud person’s computers and mobile devices. data store that many programs can access. Folders can be shared between Dropbox Both Google Docs and Salesforce.com can users, so when one person adds a file, it already work with the Box.net platform. instantly appears in another person’s folder. “Being a platform is the killer app, because The software eliminates the need to e-mail we can become the operating system for files between computers or carry data on every business,” says Levie. portable thumb drives. Box.net and Dropbox face threats from “Storing and sharing stuff easily is one of large competitors now moving into cloud- those things that was going to be fixed any based storage. Dropbox has been haunted day now for the last 20 years,” says Drew by rumors that Google is set to launch a Houston, 28, who cofounded Dropbox with similar storage service called Google Drive, Arash Ferdowsi, who is 26. A $4 BILLION IDEA The annoyance of a forgot- and Microsoft is increasingly emphasizing ten USB drive inspired Drew Houston to start The company, which claims 25 million the file-sharing company Dropbox. office software with sharing features that users, this year reportedly raised $200 mil- competes with Box.net. lion in new funding from investors. Houston Levie and Houston believe they hold an says the money will help achieve his goal company’s engineers had to build software advantage: neither company has legacy soft- of turning Dropbox into a universal “data to move all those files around quickly, and ware to defend. “Even if Google launched store” connected to the growing array of needed to design Dropbox’s software to cope Google Drive, it is unlikely to work as well mobile computers, TVs, and mobile apps. with the idiosyncrasies of different devices, with Apple and other products that compete “We’re actually solving a very big problem: from PCs running Windows to iPhones. with them,” says Houston. “There’s a lot of D we’re building the Internet file system that Now Dropbox hopes that its software, and value to being independent and focused on ROPBOX everything will plug into,” says Houston. its logo of an open box, will become ubiqui- one thing.”

14 Business in the Cloud business impact October 2011 Case Studies

OVER THE BORDERLINE In Canada and some European countries, activists fear that the strict privacy laws in their own countries won’t apply if their data is stored on servers in the United States, where law enforcement officials have the power to snoop on private e-mails.

brewing threat to free trade. It has formed a committee with Mexico and Canada to make sure privacy laws don’t stand in the way. The jurisdictional issue is already having effects. Francis deSouza, group president for enterprise products and services at Syman- tec, says his company has negotiated with a Swiss financial institution about running the bank’s e-mail servers and other software. In principle, they could be hosted in an existing Symantec data center anywhere. But because Swiss bank secrecy laws don’t apply outside the country, deSouza says, Transcending Borders, doing business will mean building a new data center in Switzerland. but Not Laws Yet storing data outside the U.S. may not As cloud computing spreads data around the globe, a haze be enough to shield it from American law of legal and privacy questions follows. enforcement. Microsoft and Google inflamed By ERICA NAONE anxieties in Europe this summer when they confirmed that even data stored outside the United States—including in European data centers—could be subject to lawful U.S. government requests (not to mention those of here’s a problem facing cloud com- fear that strict local privacy rules may not other nations). puting that doesn’t have an easy apply if citizens’ data is stored on servers All this is making the cloud a difficult Tsolution yet. in the United States. The powers of U.S. place to hide, particularly when it comes to Although it is often not obvious where law enforcement to snoop on e-mail and sensitive data. Last year, for instance, Ama- data is actually residing when it’s uploaded other records were expanded by the USA zon booted the whistle-blower organization to a cloud service such as Web-based e-mail, Patriot Act, passed shortly after the Septem- WikiLeaks off its cloud servers amid com- the location does matter. And depending ber 11 terrorist attacks. The Canadian prov- plaints from Washington that WikiLeaks on the legal jurisdiction where the data is ince of British Columbia responded with a was storing stolen classified documents on stored, it could be exposed to government 2004 law requiring public bodies to ensure the machines. scrutiny or to unexpected regulations. that citizens’ personal information, such as Another potential headache: some coun- “When data is physically located within health records, be “stored only in Canada tries require data to be logged for a certain a country, that country has the practical and accessed only in Canada.” amount of time, while others require that ability to force access to that data by vari- The spread of restrictive data laws could data be deleted after a certain time. As a ous means,” says Katitza Rodriguez, inter- make it more difficult for overseas compa- result, companies like Facebook that store national rights director for the Electronic nies and government agencies to use com- data in multiple places may face conflict- Frontier Foundation, a tech-focused civil- mercial cloud providers, the largest of which ing mandates, says Daniel Garrie, general rights organization. are based in the United States. Indeed, the counsel for the Focused Solution Resource That is cause for worry in Canada and U.S. Department of Commerce considers Delivery Group, which advises companies ECHNOLOGY REVIEW ECHNOLOGY T some European countries, where activists legal obstacles to “transborder data flows” a on cloud computing contracts.

www.technologyreview.com Business in the Cloud 15 Case Studies

DAMAGE CONTROL Internet discussion about Internet Mentions of Amazon Cloud Outage the service outage that struck Amazon Web Ser- vices in April spiked as soon as problems began and again when Amazon explained the cause. 8000 8,000 7000 7,000 says that if its services are unavailable for 6000 6,000 more than 0.05 percent of a year (around four hours) it will give the clients a credit 5000 5,000 “equal to 10% of their bill.” Some in the 4000 4,000 industry believe public clouds like Amazon should aim for 99.999 percent availability. 3000 3,000 Until then, businesses must cope with 2000 2,000 the reality of imperfect service. “For me, [service agreements] are created by bureau- 1000 1,000 crats and lawyers,” says Malek. “What I care 0 0 about is how dependable the cloud service 2 4 5 9 1 3 6 7 8 0 1 3 4 7 8 0 1 4 5 8 1 2 5 6 9 2 3 6 7 9 0

1 1 1 1 1 1 2 2 2 2 2 3 1 1 1 1 2 2 2 2 2 3 y y y y y y y y y

a a a a a a a a a y y y y y y y y y y y y April 21 y y y April 29y y y y y (Days)y y is, and what a provider has done to prepare a a a a a a a a a a a a a a a a a a a a a a D D D D D D D D D

D D D D D D D D D D D D D D D D D D D D D D for outages.” Amazon has computing data centers in five regions around the world. Compa- Service Blackouts Threaten nies can opt to run applications in multiple regions as a precautionary measure—the Cloud Users same way you’d back up your computer to When Amazon’s computers went dark last April, companies realized an external hard drive. that there are no guarantees in the cloud. Following the problems at Amazon, Net- By CINDY WAXER flix, which uses Amazon’s cloud to stream videos, developed Chaos Gorilla, internal software that allows its engineers simulate how effectively Netflix’s systems can reroute data when a network zone goes down. or all the unprecedented scalability rienced outages. During a 30-day period One company that wasn’t affected by and convenience of cloud comput- in August and September, for instance, recent cloud problems is SimpleGeo, a San Fing, there’s one way it falls short: Google’s cloud-based apps experienced six Francisco startup that uses Amazon to serve reliability. Just ask Jeff Malek, cofounder service disruptions, according to the com- location-awareness tools to its clients. Sim- of BigDoor, a Seattle company whose game pany’s Apps Status Dashboard, including one pleGeo emerged unscathed thanks to its use software is hosted on the public servers of hour-long outage on September 7 that shut of back-pressure routing, which avoids net- Amazon. Last April, problems in a North- out several million users of Google Docs. work areas suffering slow response times. ern Virginia data center crippled Amazon’s Some outages have been caused by unpre- Cofounder Joe Stump compares the technol- northeast operations, affecting many cloud- dictable events like lightning strikes, but ogy to a driver’s adjusting speed or switch- based businesses. Spotty service over four software updates are frequently the culprit. ing lanes on a clogged highway. Although days left BigDoor scrambling to find tech- Google said changes to its software caused SimpleGeo may have dodged network out- nical solutions and issuing a steady stream Google Docs to go down, and an attempt ages, doing so came at a substantial cost. of apologies to its 250 clients. to run updated code was also blamed for “We have three engineers dedicated full time Since then, BigDoor has joined a growing a massive e-mail outage affecting users of to building internal tools to manage our number of companies that are seeking new BlackBerry phones in Europe this month. infrastructure,” he says. ways of building outage-resistant systems Even though outages put businesses at Indeed, Stump says only one thing is 100 in the cloud, often at additional expense. immense risk, public cloud providers still percent certain when it comes to the cloud: A Major cloud providers such as Salesforce. don’t offer ironclad guarantees. In its so- “You always have to architect your systems LTERIAN com, Microsoft, and Google have all expe- called “service-level agreement,” Amazon under an assumption of failure.”

16 Business in the Cloud business impact October 2011 Case Studies

PAYDAY Automatic Data Processing’s chief information officer, Mike Capone, demonstrates the company’s Vantage software for human- resource managers.

So in the past few years, ADP has hun- kered down to write code for a system that links its disparate HR programs so they all essentially run in the same cloud, with a single online interface to control any or all of the applications. This month ADP formally launched the system, called Vantage. For ADP’s largest customers, “this is going to be our marquee product for the last five years and the next five years,” says Mike Capone, the company’s chief information officer. Yet this is only one way ADP plans to more fully exploit cloud computing. Right now it stores and processes its customers’ information in own data centers—a setup The Virtual HR Department known as a private cloud. “It’s so important How cloud computing is shaping strategy at one of the world’s largest to what we do,” Capone says. “We want to outsourcing companies. own it.” But Capone thinks that in the next five By BRIAN BERGSTEIN to seven years, the economics and reliability of public clouds—those run by massive providers such as Amazon—will improve to the point that even a company like ADP will loud computing is making entirely information stored in one system wasn’t hand off the management of its IT infra- new business models possible. It’s accessible in another. Someone in a corpo- structure. Calso forcing many established com- rate HR department would have to enter “If I was starting my own company today, panies to move aggressively to keep their employee information multiple times I would never build my own data center,” customers. because, for example, the benefits program he says. Consider the example of Automatic Data didn’t talk to the time-tracking program. Would ADP customers sleep less soundly Processing, one of the world’s largest pro- That was inefficient, and it left ADP wide if their HR outsourcer outsourced its com- viders of software for managing payrolls open to a competitive assault from rivals puting? D.J. Vail, corporate controller for and human resources. For years, ADP has offering combined services, which are now Education Affiliates, an ADP customer with offered software that could be said to run easier to launch thanks to the flexibility of more than 4,000 employees, says it wouldn’t “in the cloud”: companies upload informa- cloud-based systems. bother him. After all, his company already tion about employees to ADP, and ADP then A recent survey of 444 human resources runs its own software in cloud services. manages that information. managers around the world, by Towers Wat- “That’s where the future is headed,” he says. The company processes paychecks for son, a consulting firm, found that 54 percent And no matter whose computers ADP one in six American workers; it also helps are already running or planning to run some is using to deliver online HR services, its companies maintain databases of job can- HR functions in the cloud. Those managers contract with Education Affiliates requires didates, administer benefits, and track how have plenty of choices out there, including ADP to submit to audits of the security and many hours employees work. offerings from traditional software com- reliability of its technology. “As long as we Traditionally, each of those services has panies like SAP and Oracle and startups continue to get our assurances,” Vail says, DP

A operated separately, meaning that employee such as Workday. “then that’s enough comfort.”

www.technologyreview.com Business in the Cloud 17 Case Studies

CLOUD SAVANNA Safaricom hopes to put data centers in Kenya’s proposed Konza Technology City, which today is just some scrubland south of Nairobi.

uled to go online soon. But the credit card requirement remains. And this provides an opening for Safaricom, which runs M-Pesa. “Your average small business in Kenya has a line of credit with Safaricom. So they can use that to hire the [cloud computing] virtual machine,” says Phares Kariuki, an engineer in the Kenya branch of Westcon Africa, a major African IT vendor. Makori says the Safaricom service will offer data storage as well as remote comput- Chasing the African Cloud ing on either Linux or Windows operating Safaricom launches what it calls Africa’s largest cloud service to help systems. For now, customers will need to fuel a Kenyan IT boom. provide their own software, but Safaricom is in negotiations with Microsoft, Oracle, By DAVID TALBOT SAP, and others to provide cloud-based software as well. In the longer term, Safaricom and other cloud providers may install data centers in a enya’s dominant telecommuni- cents a kilowatt-hour—roughly 50 percent planned high-tech city called Konza Technol- cations provider, Safaricom, is more than the U.S. average of 13.5 cents. A ogy City. Still in the concept stages, it would Klaunching a cloud computing server might cost about $5.00 a day to run be built about 37 miles south of Nairobi, on service today that it says will be the larg- (more than $1,800 a year), not including what today is scrubland; the government est on the continent, reflecting the cloud’s cooling and management costs. dubs it the “Silicon Savannah.” emerging importance to economic growth Considering that salaries in Kenya aver- Cloud services are still gaining criti- in Kenya and other parts of Africa. age $6,265 for an accountant and $14,588 cal mass in Kenya, says Erik Hersman, “We are calling it the largest indigenous for an IT manager, that leaves traditional cofounder of the mobile mapping platform cloud in Africa,” says George Makori, Safa- in-house IT infrastructure affordable mainly Ushahidi and a key figure in iHub, which ricom’s senior manager of cloud and man- to well-funded startups and to larger busi- brings together innovators and investors aged services, in Nairobi. “The demand is nesses, like insurance companies, banks, in Nairobi. He calls the payment issue with really, really huge.” and large retailers. large providers “a gap that is difficult.” But Safaricom will provide cheap computing In theory, Kenyans have been able to he adds that startups are generally able to to individuals, entrepreneurs, and large com- use the services of large cloud providers make do with their own individual companies alike, though Makori says small and such as Amazon and Rackspace. But those puters during their initial stages of growth. medium-sized businesses, which sustain 80 who do have faced data latency of several Even as cloud solutions emerge, familiar- percent of Kenya’s GDP, might benefit most. hundred milliseconds or more, because the ity with the concept is still spotty in a country “By empowering these [small to medium cloud servers are so far away. Moreover, that is rapidly getting wired. In Safaricom’s businesses] through cloud computing, you these two giants require users to pay with initial market research six months ago, “one are increasing the GDP of the country,” he a credit card—a barrier to entry for many thing we found out that most people don’t says. Safaricom’s effort joins those of other Kenyans, for whom the mobile payment know what cloud computing is,” Makori says.

local cloud providers, such as MTN Business. system M-Pesa is more common. “The first challenge is to demystify the cloud. K ENYA ICT BOARD In Kenya, traditional IT infrastructure The latency problem is being addressed We are able to show that we are very, very is particularly costly in both absolute and by improved Internet connections in Kenya, cheap compared to you now going out and relative terms. Electricity costs about 20 including a fourth transoceanic cable sched- procuring your own IT infrastructure.”

18 Business in the Cloud business impact October 2011 Case Studies

Researchers Rain on Amazon’s Cloud Experts find way to modify controls within Amazon’s cloud service, but the hole is quickly plugged. By DAVID TALBOT

recent paper revealed what its trol over the whole authors call “alarming” vulnerabili- user’s cloud,” says Aties in controls over Amazon’s cloud Juraj Somorovsky, service, but the problems were fixed before one of the research- anyone could exploit them in real life. If ers involved in the they hadn’t been addressed, the weaknesses study. “Cloud inter- could have allowed hackers to sidestep faces are generally cryptographic protections and reprogram a prominent attack or delete customers’ virtual computers and target. If an attacker compromises a cloud of a single vulnerability can be potentially steal their data, the researchers say. interface, he could misuse its vulnerabili- enormous as cloud services proliferate and The paper—titled “All Your Clouds Are ties to get control over users’ data.” Users’ the data they work with mushrooms in value. Belong to Us,” a play on a decade-old Internet computations could also be manipulated, “Scale makes things more vulnerable— meme—was produced by several research- he adds. you have more components interacting with ers based at Ruhr University in Germany. It Kay Kinton, an Amazon spokeswoman, each other,” says Radu Sion, a computer sci- showed flaws in the client controls of Ama- said in an e-mail statement that “the poten- entist at Stony Brook University in New York. zon’s Elastic Compute Cloud (EC2) service, tial vulnerabilities reported by researchers That creates a larger and more attractive which is used by a growing number of large [...] have been corrected and no customers target. Sion, who did not participate in the Web companies including Foursquare and have been impacted.” She also disputed that new research, heads the Cloud Computing Yelp, government agencies including the data would have been at risk, saying that the Security Workshop, which was held along- National Renewable Energy Lab, media process Amazon uses to store customer data side the ACM Computer and Communica- companies such as the Washington Post, would not have allowed even the research- tions Security Conference in Chicago last and academic institutions such as the Uni- ers to see and expose passwords or other week and was where the paper was released. versity of Barcelona and the University of information. As the virtual computers hosted by cloud Melbourne. This is the latest in a series of concerns providers grow in number and complexity, The principal hack described involves a over cloud security. In the cloud services new attack methods of that sort are likely to messaging system that companies use to do offered by Amazon and other providers, com- arise, Sion predicts. The German research things like create and delete virtual comput- puting is done by virtual machines gener- showed “a pretty serious vulnerability,” he ers as needed. The researchers were able to ated in physical data centers, and virtual adds, “but it can be fixed and has been fixed.” change those messages in a way that Ama- machines dedicated to different customers Still, he contends that clouds are inher- zon’s cryptographic authentication systems may be created on the same server. Other ently more secure—and their operators failed to detect. And Amazon’s service would research has shown that it is potentially pos- better able to stay on top of new vulnerabili- have executed the malicious instructions sible to deliberately place a malicious vir- ties—than thousands of millions of distrib- along with the proper ones. The approach tual machine on the same physical server uted users can ever be. And he says ongoing exploited a specific kind of vulnerability as a victim’s machines, and use that virtual research in consultation with industry play- first reported by IBM researchers in 2005. machine to launch various kinds of attacks. ers, like that accomplished by the German The effects were potentially devastating. While the ongoing research that exposed experts, will work to keep commercial offer- “One eavesdropped message—or a message these problems strengthens cloud comput- ings as safe as possible. He adds, “I strongly ECHNOLOGY REVIEW ECHNOLOGY T gained another way—was enough to get con- ing overall, the episode shows that the price believe the cloud is the way to go.”

www.technologyreview.com Business in the Cloud 19 Leaders

containers [in which each cloud client’s data Being Smart about resides]. They’re quickly patched, but it is entirely possible. It is probably not a likely Cloud Security attack, because there are vectors that are Is the cloud a safe place to be? One authority on Web security way easier to do. But you should assume believes your data might actually be safer in the cloud. that the separation between clients is going By BRIAN BERGSTEIN to break down. You’re going to want to be resilient under those scenarios, [in part by setting rules about encrypting data and] who can get access to it.

or many companies, cloud com- “bursts the cloud” to infect other users of Then what’s your worst-case scenario for puting sounds like risky business. the same machine. Is this merely a theo- organizations that shift to the cloud? FThey worry that storing customer retical attack, or has it been done? From a business standpoint, if you’re details or running critical software on the running the system yourself, you have servers of cloud providers such as Amazon a notion of resiliency, meaning—in or Google could make their data more vul- the event of a catastrophe, whether a nerable to being hacked, exposed, or lost. natural disaster or a business bank- A lot of data in the cloud resides on shared ruptcy—you kind of have control of servers—think public data dormitories— the infrastructure. You don’t have a lot where only virtual walls might separate one of control when it comes to the cloud company’s bits from those of its competitors. providers should they go out of busi- Yet such fears are misplaced, says Jere- ness, should they be acquired by your miah Grossman, founder of WhiteHat Secu- nearest competitor. rity, which advises companies such as credit All of a sudden your cloud pro- rater Fair Isaac and prescription giant CVS vider, which your business depends Caremark on their Web security. Grossman, a on, evaporates and goes away. What’s former information security officer for Yahoo, your contingency plan? That’s a major offered some advice about the cloud in an consideration. interview with Technology Review. Some CIOs are likely to run aspects TR: Why do you think there are security of their websites in the cloud but advantages in going to the cloud? retain control of some key applications. Is there a security issue raised Grossman: The average enterprise, in the handoff between a cloud whether you’re talking small, medium, or the service and someone’s on-premises largest of the large—they’re in their respec- systems? tive businesses. A bank isn’t in the business That’s actually how it’s going to be of technology. A retailer isn’t in the business for the vast majority of businesses out of managing IT infrastructure. A service there: “I’m going to host my own web- provider like an Amazon, they have very site, but all my payments are going to particular skills [at] making really secure run through a third party.” There’s a infrastructures. What you get from a cloud DATA DETECTIVE Security expert Jeremiah lot of benefit to doing that, but there’s provider is economies of scale—and some- Grossman says fears over cloud computing are also complexity to the situation. Complex- overblown. body else to manage the problem. ity tends to be the enemy of security. The more complex you make your data flow— This is the most ingenious hacker attack It’s theoretical in the sense that we’ve the more complex you make the systems M on the cloud that I’ve heard of: some- never heard of it being done in the wild. We and all the interconnects—the more diffi- GARCIA ARCO one hires a cloud provider to run a Web have seen different types of attacks in which cult it is to manage it, understand it, and application on a shared server and then it’s possible to break out of the virtualized mitigate all the threats.

20 Business in the Cloud business impact October 2011 Leaders

age a cloud, and every option out there is incompatible with each other,” says James Staten, an analyst at Forrester Research. Among the 115 organizations already supporting OpenStack are Dell Computer, Cisco, and HP, which has built its cloud service using the technology. Staten says establishing a foundation now to oversee OpenStack could increase business interest by heading off problems that have plagued other open-source products. Staten says a foundation means less risk that one company would control the code, or that the software would splinter into multiple incompatible versions known as “forks.” Jon- athan Bryce, founder of RackSpace’s cloud business and chair of the OpenStack project’s policy board, announced recently that Rack- Space would donate its OpenStack trade- marks and copyrights to the foundation. OpenStack isn’t the only “open” cloud Can an Open Cloud Compete? provider. Red Hat, a company that distrib- A new foundation will promote free software as an alternative to pro- utes free software, has been developing its prietary cloud-computing technologies. own open-source cloud, called Aeolus; on Wednesday, the company bought Gluster, a By MICHAEL FITZGERALD startup that has contributed cloud storage code to OpenStack. Bryce has said that he hoped Gluster would continue to work with OpenStack, and noted that Red Hat was new foundation, announced in Chris Kemp, who cofounded the Open- using some code developed for OpenStack. October, will attempt to promote Stack project last year, says he’s leery of a Some other companies, including Face- Aa free, “open source” alternative for cloud-computing world dominated by major book, have also been trying to encourage cloud computing. players like Amazon. “By having just one open-source design of the actual hardware The OpenStack Foundation will maintain major company provide infrastructure as a used in large data centers, including power a suite of free software tools for building and service, they’ve made decisions about how supplies and cooling systems. Some of the managing a cloud-computing platform. The good is good enough, how secure is secure OpenStack tools need to be improved in OpenStack software suite includes software enough, how reliable is reliable enough, how order to compete with established platforms. for computation, storage, networking, and cheap is cheap enough,” Kemp says. Swift, which is OpenStack’s counterpart to system management. The OpenStack project has had the back- Amazon’s Simple Storage Service, or S3, “is Many companies have flocked to cloud ing of Web hosting company RackSpace, a very basic,” Kemp said. computing. It removes the need for expen- competitor of Amazon’s. The first version of Kemp, who is also founder and CEO of sive up-front investments in information its software has been downloaded 50,000 Nebula, a startup developing a networking technology departments, since computer times since it was released in October 2010. appliance for cloud computing, says that power and storage can simply be leased. A number of successful free and open-source OpenStack’s future depends on ensuring However, most cloud services are propri- software projects, including the Linux oper- that each component is top of the line. “If etary, and the technology used to run them ating system and the Apache Web server, are we don’t do those things well, the project is kept secret. Once a company signs up for supported by similar foundations. will not achieve its potential. It won’t scale one cloud service, it can be difficult to move “OpenStack matters because it’s very to the point where big telcos or enterprises ECHNOLOGY REVIEW ECHNOLOGY T to another provider. hard to set up a cloud, very hard to man- can deploy it,” Kemp says.

www.technologyreview.com Business in the Cloud 21 Leaders

One of the most straightforward options criminals are employing is simply to regis- ter for an account (with an assumed name, of course) and “legitimately” procure services for illegal purposes. Criminals are using Gmail or the text-sharing site Pastebin to plan crimes and share stolen information with near impunity. Just navigate to Paste- bin.com and type “Visa” into the search field for a vivid demonstration of how stolen credit card numbers are bought and sold in the cloud. Although such uses are prohibited by most company’s terms-of-service agreements, policing the cloud is expensive and, frankly, not very rewarding. Criminals with greater computing needs are using stolen credit cards to purchase access to computers and storage in the cloud. One emerging use of cloud computing is password cracking. To break into encrypted files, attackers run programs that repeatedly try different passwords until the right one is found. Many of today’s security proto- cols were designed at a time when would- be password crackers might have access to The Criminal Cloud only a few computers. Back then, security Criminals are using cloud computing to share information and to experts considered safe any security scheme superpower their hacking techniques. capable of withstanding 30 years of brute- By SIMSON L. GARFINKEL force guesswork. These days, computers are dozens of times faster, and thanks to services such as Amazon’s Elastic Computing Cloud (EC2), an attacker can rent time on hundreds of them at once. The result: an encryption he cloud opens a world of possibili- nature of the cloud makes it difficult to catch password that used to take 30 years to break ties for criminal computing. Unlike wrongdoers. Imagine a virtual Grand Central can now be cracked in a few days. Tthe zombie computers and malware Station, where it’s easy to mix in with the This isn’t idle speculation. The attack- that have been the mainstay of computer crowd or catch a ride to a far-away jurisdic- ers who broke into Sony’s PlayStation game crime for the past decade, cloud computing tion beyond the law’s reach. network last April reportedly used Amazon’s makes available a well-managed, reliable, Most of all, the cloud puts immense com- EC2 to crack some of the encryption keys, scalable global infrastructure that is, unfor- puting power at the disposal of anyone. Cloud giving them access to tens of thousands of tunately, almost as well suited to illicit com- criminals have access to easy-to-use encryp- people’s credit card information. Hack- puting needs as it is to legitimate business. tion technology and anonymous communi- ers had been discussing how to use Ama- The mass of information stored in the cation channels that make it less likely their zon’s cloud computing service for password cloud—including, most likely, your credit activities will be intelligible to or intercepted cracking since 2009. But things got really card and Social Security numbers—makes by authorities. When criminals are pursued, interesting last year, when Amazon added T it an attractive target for data thieves. Not the ability to rapidly shut down computing GPU-based supercomputing capability to ECHNOLOGY REVIEW only is more data centralized, but for the resources in the cloud greatly decreases the its cloud offerings. German computer secu- security experts and law enforcement agen- chances that there will be any clues left for rity specialist Thomas Roth calculated that cies trying to make the cloud safe, the very forensic analysis. he can use Amazon’s machines to crack the

22 Business in the Cloud business impact October 2011 Leaders

sort of encryption key used to protect most Such across-the-border attacks could put of some cases of “collateral damage” in the Wi-Fi networks in six minutes. political and technical obstacles in the way cloud. In 2009, Twitter was shut down for The cost, according to Roth, would be of authorities seeking to trace an attack several hours after a single Eastern Euro- just $1.68. back to its source. pean blogger became the target of hackers. One company trying to deny criminal Another weakness exploited by criminals The unknown assailants used a “denial of access to its cloud-based servers is Terre- stems from the Web-based applications, or service” attack, in which a site is blocked by mark Worldwide, a subsidiary of Verizon. software-as-a-service offerings, provided by aiming an overwhelming amount of Web According to Christopher Day, its senior vice many cloud companies. With millions of traffic at it. Similarly, last March a similar president for secure information services, users commingling on thousands or tens attack originating in China disrupted the the company has developed a system capa- of thousands of machines, a criminal can websites of the 18 million publishers whose ble of flagging accounts that look as if they easily mix in among legitimate users. Even pages are hosted by WordPress.com, includ- are being created by criminals. Speaking in more complicated for authorities and vic- ing the popular blog TechCrunch. August at a computer forensics conference in tims, these attacks emanate from within Some experts fear that hackers will figure New Orleans, Day explained that criminals cloud programs we use and trust. out some way to infect the very fabric of a tend to order virtual machines that have the For example, researchers at the secu- cloud’s infrastructure. Many cloud systems maximum amount of memory, processor rity firm F-Secure reported that they had have been designed assuming that attack- speed, and disk storage. Terremark’s com- detected several phishing sites hosted within ers would come from the outside, and that puters now automatically mark attempts Google Docs, the cloud-based office pro- no malicious users would be present in the to order such systems for further investiga- tion by Terramerk’s security team, he said. Even so, the cloud can make it difficult The cloud can make it difficult to track digital for authorities or companies to track digi- crime. One reason is the rise of so-called virtual- tal crime. One reason is the rise of so-called ization technology, which assembles virtual servers virtualization technology, which assembles virtual servers from numerous real comput- from numerous real computers. The computer a ers. That is, the computer a user rents from user rents might actually be spread across a Terremark might actually be spread across dozen or more disk drives. a dozen or more physical disk drives scattered throughout the company’s data center. When the virtual machine is shut down, the storage allocated to the virtual disks is rapidly reused by other virtual machines, so the ductivity software. What made the attacks software used to manage the cloud infra- criminal information is overwritten by data possible is a feature within Google’s spread- structure. Terremark’s Day, for instance, from legitimate customers. Although inci- sheet system that lets users create Web-based said his company discovered that tools it dent response and law enforcement officials forms, with titles such as “Webmail Account had purchased to move virtual machines can recover forensically useful data from a Upgrade” and “Report a Bug.” These forms, from one physical computer to another did running virtual machine, it is nearly impos- located on a Google server, were authenti- so using an unencrypted file transfer pro- sible to recover such data after the machine cated with Google’s encryption certificate and tocol. In layman’s terms, this means that a has been “de-provisioned.” In a real sense, asked for sensitive information like the user’s user’s virtual machine could theoretically the machine no longer exists. And neither full name, username, Google password, and get infected with malware simply by mov- does the evidence. so on, according to the researchers. “These ing from Server A to Server B. Criminals may pull a disappearing act are nasty attacks, as the phishing pages are These examples may merely scratch the in yet another way. Many cloud vendors hosted on the real google.com, complete surface. To paraphrase the bank robber Wil- offer “geographical diversity”—the ability with a valid [security] certificate,” wrote lie Sutton, the cloud is increasingly where to create virtual machines that are located F-Secure’s researchers. the data is. That means it will be the target in different physical locations. Criminals can We all share the cloud infrastructure, and of attacks by those seeking to steal identi- use this feature to achieve a kind of juris- that means hacking attacks could cause wide- ties and other information. Ironically, the dictional arbitrage—for instance, attacking spread damage affecting hundreds of compa- cloud itself may provide the computing the United States from Asia or vice versa. nies and millions of users. We already know power needed to carry out these plans.

www.technologyreview.com Business in the Cloud 23 Leaders

JUMP START Edward Tian poses in front of a sign for Beijing’s Cloud Valley, an incubator for startups in China’s cloud computing industry.

into the 21st century—and, in the process, bypass several decades of legacy hardware and software. Cloud computing allows data and applications to be stored not on individual personal computers but on remote servers. That can cut information technology costs and give access to powerful software via smart phones and laptops. As important as such advances are in the West, Tian says, they are even more important to a country like China. “With the cloud, you could have access to unlimited storage power with a very simple computer,” he says. “The cost of a computer could be like a book, maybe $100; all you’d really need is display. And this is fundamental for China, which is still a very poor country. To me, the goal of promoting cloud computing is to let every citizen— particularly those people in underdevel- The Man Behind Cloud Valley oped regions—afford computing access Edward Tian wants to bring the Chinese people the power of a super- and information. My slogan is ‘The price computer at the price of a book. of a book, the power of a supercomputer.’” By CHRISTINA LARSON Tian’s ambitions dovetail with those of the Chinese government. In its most recent Five Year Plan, released in March, Beijing named information technology as n a suburb of Beijing, 800 workers China is home to the world’s largest popu- one of seven strategic “emerging indus- arrive each day to a glass-and-masonry lation of Internet users, some 485 million, as tries” targeted for investment totaling $600 Ioffice block and a shared mission: to well as its most-used micro-blogging service, billion (others include clean energy and create China’s version of the Internet cloud. the freewheeling and often-controversial advanced manufacturing). Cloud comput- Known as Cloud Valley, the 7,000-square- Sina Weibo. ing was placed under control of the newly meter technology campus is the creation of Despite a boisterous Internet culture, created Ministry of Industry and Informa- Edward Tian, a 48-year old entrepreneur however, the country has not been on tion Technology. credited with bringing broadband Internet the cutting edge of computer innovation. “Government is a big advocate because to China in the 1990s. China assembles PCs and laptops that were they recognize the strategic importance of On the campus, millions in investments designed elsewhere, and its use of web-based cloud,” says Panha Chheng, senior director from Tian’s enterprises now fund engineers technology still lags badly. of strategy for iSoftStone, an IT services to wire-up servers into refrigerated shipping Government offices often require fax com- company headquartered in Beijing. “Since containers and all-night coding sessions by munications, and many small businesses cloud is still relatively new, it is still pos- young programmers. These are components do accounting, quite literally, out of a shoe- sible for China to be an early adopter and C of what Tian hopes will become a complete box. With cloud computing, Tian believes, then stay at the forefront.” VALLEYLOUD supply chain for cloud computing—all of it he can help Chinese businesses, individual Tian has a long history in China’s Inter- Made in China. users, and government departments leapfrog net scene. In the early 1990s, as a grad-

24 Business in the Cloud business impact October 2011 Leaders

through the cafeteria—the food is free—you Deployment of Cloud Computing by Large Organizations can feel that excitement of young entrepreneurs.” Smaller branch campuses of Cloud Valley have also opened in the last year in Shanghai, Nanjing, and Shenyang. All nations China’s use of cloud computing services Australia still widely trails that of other countries. A 2010 survey by the consulting firm Accenture China found that only 11 percent of large organizations in China had deployed any kind of France cloud technology, compared with 42 percent in the United States and more than 60 Japan percent in France and Germany. One obstacle is the slow speed of the United Kingdom Internet in China: painfully sluggish con- United States nections are common and poorly suited to real-time business needs. The structure of 0 20 40 60 80 the Chinese Internet is part of problem, says Reuven Cohen, founder of the cloud service Using for critical applications ( percentages) provider Enomaly. The network isn’t well Using for less critical applications integrated and is prone to interruptions. In addition, says Cohen, continual government monitoring slows down “even the most rou- tine of Internet activities.” uate student at Texas Tech University, he pete with those from IBM; other firms are Security concerns are yet another obstacle cofounded a company, AsiaInfo Holdings, designing software or developing designs to building the cloud in China. The gov- to bring Internet technology to China. In for data centers. Tian expects all the com- ernment could restrict applications if they 1999, the Chinese government asked Tian panies will become profitable. become channels for prohibited political to take the helm at the newly created China The companies are housed together at an ideas. And foreign companies may be reluc- Netcom Group, with the goal of building tant, for obvious reasons, to store sensitive the country’s broadband network. Today, he data on any Chinese server. is a business heavyweight who sits on the “Perceived risk is a major barrier,” boards of Lenovo and MasterCard Interna- In its most recent Five says Dale Sartor, an engineer at the U.S. tional and whose Rolodex includes many of Year Plan, Beijing called Department of Energy’s Lawrence Berke- Silicon Valley’s elite. information technology ley National Labs, who has visited several Tian says he got the idea for Cloud Valley large data centers in China. Users “must three years ago during conversations with one of seven strategic rely on, and trust, the service provider—a two of China’s other Internet luminaries, “emerging industries” scary proposition for many who prefer direct Yahoo cofounder Jerry Yang and Trend Micro targeted for investment control over their critical information and cofounder Steve Chang. Cloud computing business resources.” was the next wave for China to catch, they totaling $600 billion. Tian is accustomed to responding to advised. such worries. “This is almost always the With an initial investment of $78 mil- first question people ask about the cloud: lion, China Broadband Capital, the company office park in southeastern Beijing’s Eco- how safe is your information?” he says. But Tian now chairs, provided seed funding for nomic and Technological Development he plays down the fears. “With every tech- nine startup companies working on different Zone; the facility opened in August 2010. nology revolution, you create a new set of links in the cloud computing supply chain. “It’s important to put all the entrepreneurs problems. But you must compare that with One, China Supercloud, has already begun together to share ideas, and to put capital the efficiency and convenience that the new CCENTURE

A selling Chinese-designed servers that com- behind that,” says Tian. “When you walk technology brings.”

www.technologyreview.com Business in the Cloud 25 Leaders

NO MORE SOFTWARE Salesforce.com CEO Marc Benioff was an early believer in cloud computing.

the beginning for the cloud. And it hasn’t rebuilt them for the cloud. That’s a problem. It built the wrong product and is now trying to justify it. That won’t work. We are in the most exciting time in our industry, one that’s about innovation, collaboration, and going social—and Oracle is talking about the same old proprietary mainframes. The whole of their recent Open World conference was about buying computers. That’s not the cloud!

So some takes on cloud computing are The King of Cloud taking it in the wrong direction? The CEO of Salesforce.com says traditional software is dead, and Yes. Beware of the false cloud! The false thinks giants like Oracle are twisting the meaning of cloud computing. cloud is the anti-cloud. Clouds don’t come in boxes. By TOM SIMONITE As Amazon’s technology chief once said, “Litmus test: if you have to buy more hardware just to get started, it is not a cloud.” ack in 1999, when the first Web now here. Cloud computing has exploded Cloud computing is built upon a multi-ten- boom was in full swing, Marc into a $150 billion phenomenon and sup- ant technology model that allows users to BBenioff, then an executive at Ora- planted traditional business software, even benefit from a shared architecture. That cle, had a vision for the future of software. in the biggest companies. Corporations like makes computing democratic; it serves com- Benioff’s idea was that business programs NBC/Universal, Dell, and some of the larg- panies of all sizes. It is not just for the rich, could be used directly over the Web instead est conglomerates in Europe and Japan use but for governments and organizations in of being installed on users’ machines. He our service. In the future, all software will the developing world. quit his job and founded Salesforce.com, be delivered in the cloud. Businesses will Is there an area of business that the be freed from buying infrastructure that which began offering software for managing cloud has barely touched that it will ut- goes out of date, depreciates in value, and sales and customer relationships that was terly transform? requires a hefty investment to keep run- accessed only through a browser. Benioff I do believe that there are industries that ning. People will access all the services they took the company public in 2004 and saw will still be transformed by the shift. One need via the Web and have them upgraded it added to the S&P 500 in 2008. Today, he area I’ve been watching is health care. We’ve without doing a thing. is credited as a pioneer of cloud computing all been waiting for the health application and as the man who proved software “as a that will revolutionize how we share and service” could be a big business. Will the established giants of enterprise computing successfully adapt to the communicate with our doctors, and help us Benioff exchanged e-mails with Technol- cloud era, or will a new set of born-cloud make better health-care decisions. The shift ogy Review about where cloud computing businesses dominate? ignited by cloud plus social plus mobile will is headed. The only constant in our industry is allow the proliferation of these new apps TR: A few years ago, you declared the change. We are in a new paradigm, one and automate the industries and profes- “end of software.” Could you give a brief that is built on three pillars—cloud, social, sionals left behind by the last generation of progress report on how that’s going? and mobile technologies—and the compa- technology. As I’ve said before, this is the Benioff: The End of Software—a revolu- nies that understand this will dominate. most exciting time I’ve seen in my 30 years tion we called for more than a decade ago—is Oracle didn’t architect its products from in the technology industry.

26 Business in the Cloud business impact October 2011 Leaders

Who Coined ‘Cloud Computing’? Now that every technology company in America seems to be selling cloud computing, we decided to find out where it all began. By ANTONIO REGALADO

loud computing is one of the hottest Cloud computing still doesn’t appear in buzzwords in technology. It appears the Oxford English Dictionary. But its use C48 million times on the Internet. is spreading rapidly because it captures a But amidst all the chatter, there is one ques- historic shift in the IT industry as more tion about cloud computing that has never computer memory, processing power, and been answered: Who said it first? apps are hosted in remote data centers, or Some accounts trace the birth of the the “cloud.” With billions of dollars of IT term to 2006, when large companies such spending in play, the term itself has become as Google and Amazon began using “cloud a disputed prize. In 2008, Dell drew outrage computing” to describe the new paradigm from programmers after attempting to win in which people are increasingly accessing a trademark on “cloud computing.” Other software, computer power, and files over the vendors, such as IBM and Oracle, have been Web instead of on their desktops. accused of “cloud washing,” or misusing the PROOF OF CONCEPT George Favaloro poses with a 1996 Compaq business plan. The docu- But Technology Review tracked the coin- phrase to describe older product lines. ment is the earliest known use of the term “cloud age of the term back a decade earlier, to late Like “Web 2.0,” cloud computing has computing” in print. 1996, and to an office park outside Hous- become a ubiquitous piece of jargon that ton. At the time, Netscape’s browser was the many tech executives find annoying, but Reuven Cohen, cofounder of Cloud Camp, a technology to be excited about, the Yankees also hard to avoid. “I hated it, but I finally course for programmers. “That is why there were playing Atlanta in the World Series, gave in,” says Carl Bass, president and CEO is a raging debate. By virtue of being a meta- and the Taliban was celebrating the sacking of Autodesk, whose company unveiled a phor, it’s open to different interpretations.” of Kabul. Inside the offices of Compaq Com- cloud-computing marketing campaign in And, he adds, “it’s worth money.” puter, a small group of technology execu- September. “I didn’t think the term helped Part of the debate is who should get credit tives was plotting the future of the Internet explain anything to people who didn’t already for inventing the idea. The notion of net- business and calling it “cloud computing.” know what it is.” work-based computing dates to the 1960s, Their vision was detailed and prescient. The U.S. government has also had trouble but many believe the first use of “cloud com- Not only would all business software move with the term. After the country’s former puting” in its modern context occurred on to the Web, but cloud computing-enabled IT czar, Vivek Kundra, pushed agencies to August 9, 2006, when then Google CEO Eric applications like consumer file storage would move to cheaper cloud services, procure- Schmidt introduced the term to an indus- become common. For two men in the room, a ment officials faced the question of what, try conference. “What’s interesting [now] Compaq marketing executive named George exactly, counted as cloud computing. The is that there is an emergent new model,” Favaloro and a young technologist named government asked the National Institutes of Schmidt said, “I don’t think people have Sean O’Sullivan, cloud computing would Standards and Technology to come up with a really understood how big this opportunity have dramatically different outcomes. For definition. Its final draft, released this month, really is. It starts with the premise that the Compaq, it was the start of a $2-billion- begins by cautioning that “cloud comput- data services and architecture should be on a-year business selling servers to Internet ing can and does mean different things to servers. We call it cloud computing—they providers. For O’Sullivan’s startup venture, different people.” should be in a “cloud” somewhere.” it was a step toward disenchantment and “The cloud is a metaphor for the Inter- The term began to see wider use the NTONIO REGALADO

A insolvency. net. It’s a rebranding of the Internet,” says following year, after companies including

www.technologyreview.com Business in the Cloud 27 Leaders

Amazon, Microsoft, and IBM started to tout Compaq into the business of selling serv- announcing its investment in NetCentric, cloud-computing efforts as well. That was ers to Internet service providers, or ISPs, which described the deal as part of “a strate- also when it first appeared in newspaper like AOL. NetCentric was a young company gic initiative to provide ‘Cloud Computing’ articles, such as a New York Times report developing software that could help make to businesses.” That phrase was destined from November 15, 2007, that carried the that happen. to be ages ahead of its time, had not Com- headline “I.B.M. to Push ‘Cloud Computing,’ In their plans, the duo predicted tech- paq’s PR team objected and changed it to Using Data From Afar.” It described vague nology trends that would take more than “Internet computing” in the final version. plans for “Internet-based supercomputing.” a decade to unfold. Copies of NetCentric’s In fact, Compaq eventually dropped the Sam Johnston, director of cloud and IT business plan contain an imaginary bill term entirely, along with its plans for Inter- services at Equinix, says cloud computing for “the total e-purchases” of one “George net software. That didn’t matter to Favaloro. took hold among techies because it described Favaloro,” including $18.50 for 37 minutes He’d managed to point Compaq (which later something important. “We now had a com- of video conferencing and $4.95 for 253 merged with HP) toward what became a mon handle for a number of trends that we megabytes of Internet storage (as well as huge business selling servers to early Inter- had been observing, such as the consum- $3.95 to view a Mike Tyson fight). net providers and Web-page hosters, like erization and commoditization of IT,” he Neither recalls precisely when the phrase UUNet. “It’s ridiculous now, but the big wrote in an e-mail. was conceived. Hard drives that would hold realization we had was that there was going Johnston says it’s never been clear who e-mails and other electronic clues from to be an explosion of people using serv- coined the term. As an editor of the Wiki- those precloud days are long gone. Favaloro ers not on their premises,” says Favaloro. pedia entry for cloud computing, Johnston believes he coined the term. From a storage “I went from being a heretic inside Compaq keeps a close eye on any attempts at mis- unit, he dug out a paper copy of a 50-page to being treated like a prophet.” appropriation. He was first to raise alarms internal Compaq analysis titled “Internet For NetCentric, the cloud-computing about Dell’s trademark application and this Solutions Division Strategy for Cloud Com- concept ended in disappointment. O’Sullivan summer he removed a citation from Wikipe- puting” dated November 14, 1996. The doc- gave up using the term as he struggled to dia saying a professor at Emory had coined ument accurately predicts that enterprise market an Internet fax service—one app the phrase in the late 1990s. There have been software would give way to Web-enabled the spotty network “cloud” of the day could “many attempts to coopt the term, as well as services, and that in the future, “applica- handle. Eventually, the company closed its various claims of invention,” says Johnston. tion software is no longer a feature of the doors. “We got drawn down a rathole, and That may explain why cloud watchers hardware—but of the Internet.” we didn’t end up launching a raft of cloud have generally disregarded or never learned O’Sullivan located a daily planner, dated computing apps ... that’s something that of one unusually early usage—a May 1997 October 29, 1996, in which he had jotted sticks with me,” says O’Sullivan, who later trademark application for “cloud computing” down the phrase “Cloud Computing: The took a sabbatical from the tech world to from a now-defunct company called Net- Cloud has no Borders” following a meet- attend film school and start a nonprofit to Centric. The trademark application was for ing with Favaloro. That handwritten note help with the reconstruction of Iraq. “educational services” such as “classes and and the Compaq business plan, separated Favaloro now heads an environmental seminars” and was never approved. When by two weeks, are the earliest documented consulting firm in Waltham, Massachus- Technology Review tracked down NetCen- references to the phrase “cloud computing” setts. What is remarkable, he says, is that tric’s founder, O’Sullivan, he agreed to help that Technology Review was able to locate. the cloud he and O’Sullivan imagined 15 dig up paper copies of 15-year-old business Both agree that “cloud computing” was years ago has become a reality. plans from NetCentric and Compaq. The born as a marketing term. At the time, tele- “I now run a 15-person company and, in documents, written in late 1996, not only com networks were already referred to as terms of making us productive, our systems extensively use the phrase “cloud computing,” the cloud; in engineering drawings, a cloud are far better than those of any of big com- but also describe in accurate terms many represented the network. “Computing was pany. We bring up and roll out new apps of the ideas sweeping the Internet today. bedrock for Compaq, but now this messy in a matter of hours. If we like them, we At the time, O’Sullivan’s startup was cloud was happening,” says Favaloro. “And keep them, if not, we abandon them. We negotiating a $5 million investment from we needed a handle to bring those things self-administer, everything meshes, we have Compaq, where Favaloro had recently been together.” access everywhere, it’s safe, it’s got great chosen to lead a new Internet services group. Their new marketing term didn’t catch uptime, it’s all backed up, and our costs The group was a kind of internal “insur- fire, however. Consider the draft version are tiny,” says Favaloro. “The vision came gency,” recalls Favaloro, that aimed to get of a January 1997 Compaq press release, true.”

28 Business in the Cloud business impact October 2011 Infographics

Business Gets Remote Cloud computing is redefining the way companies send e-mail, store data, and allocate IT budgets. By MIKE ORCUTT

GLOBAL SPENDING ON PUBLIC CLOUD SERVICES 7% $176.8 6% Percentage of total 5% IT spending Billions The amount of IT spending on cloud computing 4% services, such as data storage, is growing.

3% $74.3 2%

2010 2015

Source: Gartner

32% 46% is a cheaper will enable substitute organizations Most companies seek efficiency; fewer see cloud to do business computing as transformational force. more quickly

13% 9%

will transform business is a fad that will die

Source: Accenture survey of 669 IT decision makers

www.technologyreview.com Business in the Cloud 29 Infographics

Most companies that shift business processes to the cloud begin with commodity applications.

MOST-USED APPLICATION

Videoconferencing

Online learning

Web conferencing

Ofﬁce software

File storage

E-mail

0% 10% 20% 30% 40% 50% Source: CDW poll of 320 corporate cloud users

Cloud computing will bring significant growth in servers and data storage—but not in IT jobs.

EXPECTED GROWTH OVER THE NEXT 10 YEARS 10x 50x 1.5x The number of real The number of bytes The number of IT and virtual managed by enterprise professionals in servers worldwide data centers the world

Source: IDC

30 Business in the Cloud business impact October 2011