Who owns data in the cloud? The answer could get tricky.

When government moves data to the cloud, who owns it? And how can it be secured or, in extreme cases, decommissioned?

During a panel discussion on Security in Public/Private/Hybrid Clouds, part of the at the Government Technology Research Alliance meeting earlier this week, everyone involved acknowledged the need to raise the level of trust in the public cloud. Agencies and the public need to be confident that government data is properly secured within the U.S. and can be, if needed, properly destroyed.

Cloud computing refers to services, applications, and data storage delivered online through powerful file servers.

One attendee noted that his agency is working with a cloud provider, Hewlett Packard/EDS, which has its cloud computing resources in the U.S., but systems administrators in other countries such as Argentina, Brazil, Malaysia and Uruguay.

“How do we understand, other than getting a government-certified cloud, where this stuff might be run from and where assets reside?” he asked.

“Everybody I talk to in government requires data to stay within the United States," said Peter Mell, a member of the panel and a senior computer scientist in the Computer Security Division at the National Institute of Standards and Technology (NIST). He is also vice-chair of the Interagency Cloud Computing Advisory Council.

“What is implicit there is that the systems administrators will be in the U.S., which as you pointed out is not always the case,” Mell said.

Related coverage:

Continuous monitoring guidance under way at NIST

One of solutions to the problem – besides public cloud computing vendors providing that level of security – is to look beyond just thinking of the public cloud. Instead, agencies should think about how they are becoming more cloud-like in their information technology operations and then adopt their own private clouds.

“I believe in some ways that all of your agencies are adopting cloud computing and you don’t even know it,” Mell said.

As these agency data centers evolve and adopt virtualization, digitize applications and provide dynamic Web interfaces -- Web 2.0 stylings of data center applications – agencies are becoming more cloud-like. If agency managers then apply NIST guidelines for cloud computing to those information technology operations, they can evolve to the point where they can say they have a cloud environment.

At that stage, “You own it and control it and it will work well for you,” he said.

The federal government is vast, and vendors have been struggling with the question of who speaks for the federal government, said Phil Wenger, deputy policy lead for the Budget Formulation and Execution Line of Business for the Office of Management and Budget.

Wenger said the CIO Council’s efforts to provide assessment and authorization through the Federal Risk and Authorization Management Program (FedRAMP) should help provide cloud computing providers with a standard, governmentwide set of security requirements. However, he said the government can make it a requirement that systems administrators working with government data should be in the United States.

“Those are the things we can do,” Wenger said.

"The reality is when you put data in the cloud you should have your own copy” of the data, said Stan Wisseman, a senior associate with Booz Allen Hamilton.

As part of their relationship with contractors, agencies have to figure out their cloud provider's strategies up front. “I don’t have an obvious answer but to make sure you have the data protected elsewhere,” Wisseman said.

Part of answer to the question about getting out of the cloud is you can never get your data back, another attendee in the audience said. He asked if there are any plans for a template for service-level agreements like in commercial practices that people can follow.

“Why do we have our data in India or China or other places where they shouldn’t be?” he asked.

“I don’t’ see anything different in how you plan for enterprise computing and cloud computing,” said Alfred Rivera, director of the Computer Services Directorate of the Defense Information Systems Agency. DISA runs a private cloud known as The Rapid Access Computing Environment, which allows Defense Department users to quickly acquire computing power and build applications.

“The hard question from a public cloud perspective is, how do you ensure the data is now your property and not the property of the cloud vendor?” Rivera said. As for planning for security and the private cloud, DISA followed the constructs and guidelines that the agency and DOD would use for computing in general for data center operations. And these guidelines “are still compliant not only with the cloud but for all operations we do,” he said.

Service-level agreements aside, the data is still on de facto basis controlled by the cloud provider, another attendee said.

One possible way to maintain control is to encrypt the data before it leaves the organization’s boundary. It would only be decrypted when it gets back into the enterprise. The keys to encrypt that data would be owned by the agency or organization, he said.

Booz Allen Hamilton has worked with an agency to encrypt data in the cloud, Wisseman said, adding that encryption offers its own set of challenges. However, “I think some type of stealth protecting model is a good way of working at it,” he said.