Discussion Paper: Cloud Computing Consumer Protocol
August 2013
EXECUTIVE SUMMARY
Increasing the use of technology by small businesses has huge potential to drive economic growth. However, Google is not convinced by the evidence presented that a self regulatory protocol will deliver the best outcome. The better approach is to generate more awareness and provide more support to help small business people capitalise on the economic opportunities of the internet. Internet computing, colloquially known as ‘cloud’, is a decade old technology that is already a reality for the majority of Australians in their daily lives as consumers, using services such as webmail and social networks. Comparatively, all enterprises, both big and small, are lagging in adoption.
At Google, we see the barriers to all technology uptake being: understanding the role of
technology; knowledge of what to do; and time and cost. We do not perceive a lack of confidence in ‘cloud’ that could act as a barrier to uptake; rather, many small businesses are already using ‘cloud’ without identifying it as the technology. For example, 95% of small businesses use email, primarily webmail, which is internet computing.
The internet creates huge opportunities for small businesses to grow. Deloitte research found that small businesses that make the most of the web grow revenue two times faster than those that don’t. The first step of a digital journey is to create a website to reach customers. A later and far more advanced step is to use internet computing to work more efficiently internally. According to Deloitte, 40% of small businesses are yet to take the initial step of creating a website. Thus, it is hardly surprising that an even larger proportion have not taken the more advanced step of using internet computing to run their operations. The surveys cited need to be placed in this broader context. The internet computing market is quickly maturing to exhibit strong reputational incentives that encourage good behaviour. The market is already exhibiting some of the more positive
characteristics suggested by the protocol and competition between providers will ensure they further develop over time. For example, tools like Google Takeout already provide data portability.
Internet computing exists in a dynamic environment that requires flexibility, making a highly prescriptive protocol unsuitable. It should be noted that the current competition and consumer law and privacy law provide a strong regulatory protection framework for businesses and consumers. It is also inappropriate to conflate small businesses with consumers as they use the same enterprise services as big corporates and can switch providers far easier than with traditional ICT.
The introduction of unnecessary self-regulation could impede market operation and curtail both the development of Australian internet computing providers and the dynamics of Australian businesses accessing important global services. Australian tech startups, which are essentially small
businesses creating internet computing services leveraging global infrastructure, could be placed at a competitive disadvantage. Tech startups are a huge opportunity in Australia and have the potential to unlock over $109 billion in value and create 540,000 jobs by 2033.
Small businesses not knowing what ‘cloud’ is, and consequently not having confidence in it, is not a consumer protection problem, but a marketing and awareness problem. If there is to be a policy initiative, then we recommend a ‘checklist’ of good features, which could be used by small
businesses to make an informed decision between different internet computing providers. Both Government and industry would have a key role in promoting this educational effort.
Google is one of the world’s largest providers of internet computing services to consumers, with billions of people using services like YouTube, Gmail, Google Maps and Google Search. Google is also one of the world’s largest providers of internet computing services to enterprises, with millions of business customers, including over half of the Fortune 500, using Google Apps for Business, Google Cloud Platform, Google Maps for Business and Google Enterprise Search.1 Google also runs one of the world’s largest data center networks, utilising custom built hardware and custom written software, much of which has been made available open source:
www.google.com.au/about/datacenters .
EVOLUTION OF INTERNET COMPUTING
The scale and pace of change driven by the internet only continues to accelerate.2 Technological advancements in processing speed, data storage and bandwidth have long been characterised by exponential growth, going back to the surprisingly accurate 1970’s ‘Moore’s law’ predication that the number of transistors on circuits would double every 2 years.3 The rise in internet use has driven unforeseen technological innovations and advancements in computing, and has led to new generations of interconnected web services, applications, consumer devices and infrastructure. The concept of ‘cloud computing’ was created when the distributed and interconnected architecture of the internet was first applied to corporate data centers in the mid-1990’s. Other early concepts used to describe computing over the internet include ‘terminal computing’, ‘network computing’ and ‘distributed computing’ - but they are essentially all the same thing - ‘internet computing’. Today, almost every form of computing device, ranging from a smartphone to a data center, can utilize computing resources on the internet to manage increasingly complex tasks. Instead of using just one computer server to host a website or application, it is now routine to use hundreds or even thousands of machines.
It is important to acknowledge that while internet computing is the future of computing and many of its benefits are yet to be realised, it has been in existence for some time and is already a reality for the majority of Australians in their lives as consumers. They use it everyday for webmail services like Gmail, social networking, mobile apps and storage. Enterprise services have also been in the market for well over a decade. For example, Salesforce was founded in 1999 as a provider of Customer Relationship Management software as a service. The popularity of internet computing services is a testament to the value that such services have delivered to consumers and
businesses - and the highly competitive nature of the sector in which they are developed. Internet computing will fundamentally change ICT over the next five years.
1 see www.google.com.au/enterprise/solutions.html.
2 BCG, ‘The 4.2 Trillion Dollar Opportunity’, March 2012, p3 http://goo.gl/jSMoS.
All software delivery will be over the internet
All software, not just new software, will be delivered over the internet. Software as a service is nothing new and there are many successful examples such as salesforce.com, Google Apps and Webex. The majority of new software created by tech startups will assume internet delivery only. For example, it is unlikely that a new company whose business model proposed the delivery of millions of CDs to customers to install software would receive much support from investors. Even existing software companies such as Microsoft and Oracle are working to change how they deliver software to be internet based. For established players, internet computing brings cost savings such as through a better user experience because the provider manages the underlying hardware. This quickly leads to an environment where businesses will use many different software
applications delivered over the internet from many different locations and companies - some that may be onshore, others that may be offshore, and even some that may be managed internally. Australian businesses will need to have procedures and policies with respect to security and privacy to allow them to use new software and, in some cases, continue to use software they already depend on.
‘Hyperscale’ providers will lead ICT innovation
While the term ‘hyperscale’ is used loosely, with respect to internet computing it refers to providers that operate hundreds of thousands of servers and allow users to purchase large amounts of compute power for short periods of time. Commonly cited examples include Google, Amazon.com, MS Windows Azure and Yahoo!. Hyperscale internet computing providers have several
advantages stemming from their scale, including being able to make significant investments in innovation such as building data centres using custom hardware and custom software.4
Hyperscale providers design their own servers to eliminate all hardware components that are not required, thus saving power and manufacturing costs. Amazon has teams of motherboard design engineers whose goal is to eliminate every excess capacitor to reduce power requirements. Facebook has released details from their Open Compute Project server architecture showing their low-power design work. Smaller providers typically use ‘off the shelf’ servers sold by enterprise IT vendors that have superfluous features such as USB ports, keyboard and monitor connectors and an array of networking features.
In networks, much of the pioneering innovation has not come from traditional networking vendors, but from internet computing providers themselves. One example is the work done in OpenFlow by Rackspace and Google which has been in production for some time, yet is only now being
considered by commercial providers.
Scale also allows hyper providers to amortize the cost of extensive security teams over a large set of global data centres. This allows them to continuously monitor threats and keep their facilities in compliance with internationally recognized security standards. For example, Google has a team of over 300 security experts allowing a focus on innovation, rather than reactively dealing with threats,
4 See Steven Levy, ‘Going With the Flow’, Wired, http://goo.gl/tH9aC and Rober McMillian, ‘Google: We’re One of the World’s Largest Hardware Makers’, Wired http://goo.gl/zBRNm.
problems and applying patches. An example of this innovation is the free ‘2-step verification’ secure login for consumers to access Google Accounts like Gmail.5
Importance of accessing supercomputing
As the evolution of technology continues to accelerate, the key issue for government and business will be the ability access to the computing services they will need to function efficiently and obtain an edge. Some of the best and most crucial software will only be available on global platforms. Many types of software will be designed to simultaneously leverage hundreds of thousands of CPUs and disks for a short period of time. Computing at this scale has the power to fundamentally change our ability to solve some of the world’s most challenging scientific and business problems. Many everyday applications may also need to call upon thousands of cores for short periods of processing time, such as payroll processing, which can take days on legacy systems.
Data-driven innovation is growing in importance as an essential factor of production across all sectors and functions in the economy. Colloquially known as ‘big data’, it involves deriving insight through the rigorous analysis and interpretation of many discrete sets of data, to solve problems in new and often unexpected ways. The sheer computing power required to derive insight from data requires access to internet computing as it requires the ability to interactively analyze terabytes of data consisting of billions of rows, often in real time. Such requirements are typically only met by hyperscale internet computing providers that allow users to dynamically access significant computing resources for short periods of time.
Before the advent of hyperscale internet computing there were many problems that were either impossible or too expensive to solve. Now, researchers can draw upon tens of thousands of cores to work on a problem and then release them while only paying for actual use in units of time. This is a significant step forward compared to traditional IT, where building a 10,000 core server farm would cost many millions of dollars before a single computation was run, and then cost hundreds of thousands of dollars to maintain whether it was being used at full capacity or not.
During Google’s I/O 2012 developer conference, a keynote showed a live demonstration applying 600,000 cores across Google’s global data centers to a genomics problem.6 To put this in
perspective, this means it is likely that Google has more spare compute power available for a demonstration than many Australian providers have in total production.
The dynamic compute power required for data-driven innovation requires significant investment that may only be made by hyperscale internet computing providers. It requires a significant investment to build the necessary capacity to scale computing needs dynamically according to user demand. The small size of Australia’s market and limited international capacity may make it challenging for hyperscale cloud providers to recover their significant capital outlay if they were to build a network of two or more data centres in Australia.
5www.google.com.au/landing/2step/.
6 Google, ‘Behind the Compute Engine demo’, January 2012, https://developers.google.com/compute/io and YouTube video here: http://goo.gl/s4plH.
SMALL BUSINESSES AND TECHNOLOGY UPTAKE
The rapid growth in internet use provides small businesses with huge opportunities to find new customers and suppliers, and to work more efficiently.7 With the internet rewiring our entire economy, every business is now an ‘internet business’.
In Australia, Google sees reasonable uptake of internet computing - it is already a reality. However, many small businesses do not identify the technology they use as ‘cloud’. For example, 95% of small businesses use email, primarily webmail, which is internet computing.8 As consumers, over half of the total Australian population regularly use Facebook and YouTube - both of which are internet computing applications, although many people would not identify them as ‘cloud’.9 The first step on the digital journey of a small business is to establish an online presence with a website, allowing it to use the internet to reach potential customers. A later and far more advanced step is to use internet computing to work more efficiently and run internal business operations. When small businesses are web savvy with ‘high digital engagement’ using the internet to reach customers -- they also use internet computing. This relationship is established by a recent TNS survey for Deloitte:10
● For small businesses that do not use the web to communicate with customers and have low digital engagement, only 15% use the internet to communicate internally.
● For small businesses that extensively use the web to communicate with customers and have high digital engagement, 86% use the internet to communicate internally.
The Deloitte research also found that there is a strong economic case for small businesses to make the most of the web with high digital engagement as they grow revenue two times faster than those with low digital engagement.11 Yet according to Deloitte, 40% of small businesses are yet to take the initial step of creating a website, even though it is proven to increase business
performance.
The surveys cited need to be placed in this broader context. It is hardly surprising a large
proportion of small businesses have not the advanced step of using internet computing to run their operations when 40% have not taken the first step of creating a website.
At Google, we see the barriers to uptake of technology more broadly being: understanding the role of technology; knowledge of what to do; and time and cost.
7 Deloitte Access Economics, Connected Continent, 2013, http://goo.gl/lQJTto.
8 TNS research for Deloitte, Connected Small Businesses, 2013, http://goo.gl/6saEgI, slide 36. 9 See http://www.socialbakers.com/facebook-statistics/australia.
10 TNS research for Deloitte, Connected Small Businesses, 2013, http://goo.gl/6saEgI, slide 42. 11 Deloitte Access Economics, Connected Small Businesses, 2013, http://goo.gl/p3V4kK.
Deloitte Access Economics, Connected Small Businesses12
This April 2013 report shows that the web is quite simply rocket fuel for small business. The report gave a report-card on the level of ‘digital engagement’ of based on a national survey of 500 Australian small businesses. It ranked them in four levels of digital engagement from high - that is, those that are making the most of the web of by using tools like websites and online marketing - to medium, to low through to very low, essentially not using the web at all to reach customers.
The report shows that small businesses making the most of the web with high digital engagement are:
● Two times more likely to be growing and earn two times more revenue per employee ● Job creators, being four times more likely to be hiring
● Three times more likely to have growth as a business objective
● Three times more likely to be increasing investment in digital over the next year ● More resilient with better growth prospects, more diversified sources of revenue and a
larger customer base
Yet, Deloitte found that only 16% of Aussie small businesses have high digital engagement, 25% have medium digital engagement, 24% low engagement and are barely using the internet, while 35%, the largest group, have very low digital engagement and are not using the internet at all to reach customers.
The good news is, that for small businesses with very low engagement, this is significant low hanging fruit that can increase growth expectations. Establishing a digital presence with a website creates the biggest and easiest payoff, but 40% of business do not have one. A 20% uptake in revenue is associated with businesses that move up a level of digital engagement, such as by creating a website to move from very low to low engagement.
DISTINCTION BETWEEN CONSUMERS AND BUSINESSES
It is inappropriate to consider small businesses as ‘consumers’ as they can acquire the same internet computer services as big corporates, they can switch providers far easier than with traditional ICT, and the business models and technology of enterprise and consumer services are very different.
There is a distinction between business-to-business services used to run the internal operations of any sized business, such as Customer Relationship Management, and business-to-consumer services used by people as individuals such as social networks.
Business-to-business internet computing services are typically used for operational business functions. One of the key benefits of internet computing is that businesses, both big and small, can use the same enterprise software to run their operations without having to make upfront capital investments in hardware. A sole trader can use exactly the same business-to-business internet computing services to run its operations as a big business with 10,000 employees.
Business-to-consumer internet computing services are typically provided at no cost, like social networks, or for a fee for the consumption of content, like music streaming services. They are typically very different in their nature and business models, as they are not sold to be used for operational business functions.
By conflating small businesses with consumers, the discussion paper confuses the different types of internet computing services that consumers and businesses use.
Further, internet computing offers huge benefits to small business people over other types of traditional ICT, primarily because it is extremely easy to switch providers:
● There is no big upfront capital expenditure to acquire the technology
● There are often no long term contracts, many providers offer monthly contracts and allow people to easily scale up or scale down depending on their requirements
● Many providers are starting to offer takeouts, such as Google Takeout, which allow people to download all of their data efficiently, in an open format, and switch providers
Together, these attributes help alleviate any potential ‘unequal bargaining power’ between big providers and small business people. The nature of internet computing means that it is often acquired on demand, meaning that it should be easy for people to scale down or end contracts altogether. The ability to then takeout data, and subsequently upload it to a new interoperable provider significantly reduces any switching costs that could otherwise prohibit a person from changing providers.
SECURITY OF INTERNET COMPUTING
A properly managed and implemented internet computing software solution can be as secure, and often more secure, than traditional ICT solutions.
It is worth highlighting that internet computing providers have a strong commercial incentive to ensure users’ data is secure. This cannot be stressed enough - security is crucial to the success of an internet computing provider. This investment in security also means that it is one of the key advantages that internet computing providers have over other ICT solutions.
As an example of how seriously large scale providers take security, it is part of the agreement for Google Apps for Business that customer data receives the same level of security as Google uses for its own corporate data and services.13 Google Apps for Business also adheres to several international standards.14
Google invests billions of dollars in technology and people to ensure data is safe secure: ● Data centre security—Google’s data centres are hardened with many of the latest
measures in security precautions, including biometric access controls and multi-tiered security perimeters. Google has implemented a multi-layered security process protocol designed to help keep customer data safe. Further, as a direct result of our economies of scale and manufacture processes, our data centre hardware and software stack is very homogeneous, and can updated extremely quickly with vulnerability patches.
● Expert security professionals—Google has a team of over 300 of the world’s leading security experts, allowing a focus on innovation, rather than reactively dealing with threats, problems and applying patches. The result is innovation such as offering ‘2-step verification’ free to consumers to access their Google Accounts like Gmail ‒ the first in the world.
● Hardware security design—Google is one of the world’s largest hardware manufacturers operating some of the world’s largest data centres using custom hardware and software, designed with security as a primary consideration.
● Role-Based Access Control—All customer data on Google networks is protected by digital certificates, and can only be accessed by authorized services and staff. This access is protected by operational and logical measures to ensure integrity.
● Browser-centric services—Browser-based applications help keep sensitive data more secure because minimal data is left on local machines that could be compromised. Furthermore, making data securely available from the browser minimises the amount of sensitive data stored on devices (laptops, USB drives etc).
Google has published a Security White Paper that provides additional details.15
13 ‘Google Apps for Business (Online) Agreement’, http://goo.gl/aliGZK: “all facilities used to store and process customer data will adhere to reasonable security standards no less protective than the security standards at facilities where Google stores and processes its own information.”
14 1SSAE 16 / ISAE 3402 is an auditing standard by which a third-party auditor evaluates the controls in place for physical and logical security, privacy, incident response, and more; ISO 27001 certified by Ernst & Young CertifyPoint; Federal Information Security Management Act certification by the US Government; US Department of Commerce’s Safe Harbor Program.
COMPETITIVE MARKET WILL DEVELOP PRO-CONSUMER OUTCOMES
The scale and pace of change of internet computing technology continues to accelerate. Simultaneously, the market is maturing to exhibit strong reputational incentives that encourage good behaviour. The market is already exhibiting some of the more positive characteristics
suggested by the protocol and competition between providers will ensure they further develop over time. For example, tools like Google Takeout already provide data portability.
Internet computing is, by definition, easy to scale up, easy to scale down, easy to switch providers and easy to compare offerings - especially when contrasted to traditional ICT. Internet computing is inherently competitive. In such a market, there are strong reputational incentives that drive
providers to deliver quality products, or they will quickly lose market share to competitors that do. Internet computing providers will increasingly compete for customers on aspects like data
portability. Because of the ease of comparing competing offerings online, small business people can easily make comparisons and chose the best fit for their preferences. It is likely that this competition will drive far more innovative and pro-consumer outcomes than self-regulation ever could.
Google Takeout
Google is strongly committed to data portability of its users. The Data Liberation Front is an engineering team at Google whose singular goal is to make it easier for users to move their data in and out of Google products: http://www.dataliberation.org/.
Google Takeout is a product that allows users to download a copy of all their data stored within Google products, in open formats: www.google.com/takeout.
NEED FOR FLEXIBLE POLICY
Internet computing exists in a dynamic environment that requires flexibility, making a highly prescriptive protocol unsuitable. Some examples are:
● Data location - if data stored in an internet computing service is fully resilient, than it is likely replicated across two or more data centres, making it very hard to disclose specific
locations.
● Law enforcement policies - it goes without question that internet computing providers will obey the valid legal processes of the law of the land, be it where they are head quartered as a corporation or where a Mutual Legal Assistance Treaty exists.
● Business continuity - a loss of internet connectivity is not just a problem for internet computing services, but a problem for a business functioning at all levels. Further, the resiliency of internet computing is also a strength if internet connectivity is lost - employees need only relocate to another location with internet access, like home, to resume working at full functionality.
● Backup and maintenance - any framework should be technologically neutral and note cite cites specific technologies.
The introduction of unnecessary self-regulation could impede market operation and curtail both the development of Australian internet computing providers and the dynamics of Australian businesses accessing important global services.
Tech startups, which are essentially small businesses creating internet computing services using global infrastructure, could be placed at an international competitive disadvantage from
unwarranted regulation. In Australia, they have the potential to unlock over $109 billion in value and create 540,000 jobs by 2033.16 Australia has a growing tech sector, primarily because of the ability to easily create and deliver software over global infrastructure. The Internet and computing power are allowing technology companies to disrupt the global economy, leading to a redistribution of industry revenues (and wealth) across geographic borders. In this context, many countries are looking to support and grow startups locally. To the extent that self regulation increases the burdens and barriers for this burgeoning sector, it places Australia at a competitive disadvantage. The dynamic nature of the young but rapidly developing digital economy, has consistently enabled it to adopt market solutions to problems. Government has many good digital economy policies, such as a significant national investment in broadband infrastructure. To facilitate future growth and innovation, Google encourages a focus on technology neutral and flexible policies.
It should be noted that the current competition and consumer law and privacy law provide a strong regulatory protection framework for businesses and consumers.
PRO-COMPETITIVE CHECKLIST
Small businesses not knowing what ‘cloud’ is, and consequently not having confidence in it, is not a consumer protection problem, but a marketing and awareness problem. If there is to be a policy initiative, then we recommend a ‘checklist’ of good features, which could be used by small
businesses to make an informed decision between different internet computing providers. Both Government and industry would have a key role in promoting this educational effort.
The right policy approach in this area is one that supports innovation in services while ensuring that consumers and small businesses have the information and tools they need to maximise the value they can derive from the opportunities created by the online world.
