MegaUpload, the Patriot Act and Vendor Arrogance

See, I said I was going to be provocative! On the show I raised the issues around MegaUpload and talked about how I saw them as very much the start of an ongoing series of US Federal authorities coming down hard on providers at the behest of the recording industry and Hollywood studios.

Prior to MegaUpload, the general view espoused by vendors was that cloud services were safe overall and that copyright infringement was potentially a risk to individual users connectivity, but not to service providers offerings.

Well the takedown notice on MegaUpload put paid to that contention. So vendors have come out with a response that I have to say smarts of cloudwashing – they’re contrasting the service they provide with that of the less scrupulous service providers. The word “trusted provider” gets thrown around freely. I’m not sure where these vendors get the justification for taking this line – if end users store data with them (as in the case of MegaUpload) and that data is shown to breech copyright (again as in the case of MegaUpload) then there is the risk that these providers too, no matter how much they profess to being a trusted provider, could also face the wrath of the authorities.

I believe that two distinct things need to happen, and soon;

Change the Law

Now I’m no lawyer (but have studied law enough to be dangerous) but it would seem to me that legislation and regulation falls greatly behind the realities of technology. I’d never suggest that MegaUpload is a shining bastion of virtue. But the fact is that honest users had legitimate data stored on MegaUpload servers and the actions of the federal authorities denied those users access to their data. I believe this is untenable and undermines the rights of legitimate individuals and organizations.

Regulations need to mature such that they no longer take such a scattergun approach but rather have the ability to target the specific data that breaches copyright and the specific users who upload that data. Anything else is plain unfair.

Give us Geographic Granularity

Swayed perhaps by the fact that I live outside of the US, I believe that it is simply not viable for cloud vendors (be they infrastructure, platform or software) to provide services where data is located in only one, or a small number of locations. While some would argue that giving users more geographical options fundamentally negates the economy of scale benefits that cloud providers enjoy, I believe that until we offer users highly flexible options around data storage and transfer, that a significant proportion of potential users of cloud services will avoid doing so.

It’s plain arrogant for vendors to pass off this issue as of no consequence or invalid – real customers around the world hold grave fears about the impacts of the Patriot Act and issues around privacy regulations.

What Will Happen?

Some of these issues will be resolved by an increasing demand for cloud services – Amazon’s recent opening of a South American facility, Salesforce building out data centers rapidly and a host of other indicators speak to this point. But my contention is that we need to give natural supply and demand a boost, vendors need to hyper-invest ahead of the supply and demand curve as a strategic move to allay the concerns of users.

At the same time we need to ensure that legislation and regulations truly reflect the realities of the cloudy world we live in and do not allow for a shotgun approach to compliance that primarily meets the needs of just one powerful interest group.

VMware sees this and is today rolling out a tool to help service providers cloud products. the VMware vCloud Integration Manager is a solution that sits in-between the service provider infrastructure and their customer deliver tools (CRM, a web front end etc) to map a customer facing product catalog to the actual provisioning of cloud services.

To clarify, VMware has two distinct classes of service provider using vCloud;

• vCloud data canter providers – abide by a prescriptive architecture and provide a consistent set of core IaaS components. Answering the call for geographically spread enterprises who want to obtain ultimate consistency when using services form disparate vendors
• vCloud powered – service providers who, while using vCloud, do not commit to a specific architectural model but still support the full vCloud API and the Open Virtualization format for portability

Some context around vCloud as a tool that service providers are using to create their own cloud products. VMware claims the following statistics around vCloud;

•3x partners (87) in vCloud Powered vs. Q4 2011 (31)
•7 major players in vCloud Datacenter
•From no clouds 3 years ago to 94 in 19 countries today
•200% VMware revenue growth in 2011 from service providers

Anyway – back to today’s announcement. Graphically the vCIM sits between customer facing/service tools and the vCloud director orchestration platform;

Matthew Lodge, VMware’s director of cloud services, believe vCIM has a compelling proposition;

Service providers are looking to get high-margin cloud services to market as quickly as possible. Until now that involved wrangling manual processes, diverting scarce development resources onto writing glue code and portals, or choosing to implement complex and expensive third-party systems. With VMware vCloud Integration Manager, providers of vCloud services will have the tools they need to automatically provision services, enable reseller partners and speed customer on-boarding.

The key thing that VMware are banking on is the attractiveness to service providers that using a VMware stack brings – they’re banking on service providers being happy to commit to a homogeneous environment and that the environment of choice is likely to be one from VMware. Part of this strategy means that VVMware vSphere, VMware vShield Edge and VMware vCenter Chargeback Manager to automate the provisioning and delivery of infrastructure and associated services. That level of integration starts to get compelling.

Aware that part of the compulsion comes from integration with existing back office systems utilized by service providers, vCloud Integration Manager will provide a REST-based API to integrate various back office systems (CRM, billing, etc.), along with a Web-based administration portal.

The integration manager will be generally available this quarter and priced on a usage-based subscription model.

Excuse the slightly cataclysmic title of this post, but the first post for 2012 in the CloudU notebook series is one which hopefully will get you thinking about your career and the changes it is going to undergo over the years to come.

One of the drivers for the CloudU program, and especially the CloudU certificate, was an attempt to give traditional IT folks an entry level introduction to Cloud Computing, something to whet their appetite and to give them a grounding, before offering up other, more specific learnings.

Of course our rationale for doing this is the thesis that the job market is fundamentally changing and that Cloud Computing is a major driver for this. It was good then to read the other day a Forbes article by Joe McKendrick that spells this fact out clearly. McKendrick pulls no punches saying that;

Just as cloud computing is a game-changer for many companies, it is also changing the nature of jobs – not only within the information technology department, but in other parts of the enterprise as well.

Interestingly McKendick goes on to discuss some empirical data that speaks to the real change that IT roles are seeing. In particular he references a study from CA technologies which found that;

A majority of 685 CIOs surveyed, 54%, believe that cloud computing has enabled them to spend more time on business strategy and innovation. Approximately 71% who have adopted cloud computing see their position as  a viable path to pursue other management roles, compared to only 44% of non-cloud adopting CIOs.

In other words, it’s precisely the CIOs who have adopted Cloud who are feeling empowered to move into broader management roles, while their more laggardly colleagues remain technically focused.

None of this should come as a surprise to CloudU participants – we’ve always said that management for the new IT is a totally different beast than in the old world. Whereas traditional IT leaders had to remain abreast of technology paradigms and ensure that their departments cut clean code, maintained pristine data centers and had their fingers on the pulse of software updates, a modern CIO has to think about more broad business skills like;

• Vendor relationships
• Rapidly accelerating technology innovations
• Strategic business skills
• Managing and maintaining a workforce when there is a limited talent pool

Now before people get up in arms pointing out that traditional CIOs have to manage these roles, let me say that I accept that fact. But I also contend that the rate of change, and the amount of time that a CIO has to spend on business as opposed to technical issues is far greater under Cloud Computing. And the statistics, at least from the CA report, would seem to back this up. Cloud adopting CIOs feel more confident with strategic, business-related functions within their role than do their traditional counterparts.

It’s also interesting to see other industry folks speak to the same themes – Chuck Hollis, VP at EMC summed up the challenge for IT leaders when he said that;

If you’re an IT leader, you’ve got an interesting challenge on your hands. You most likely don’t have the right portfolio of end-state roles, skills and processes. And you are probably lacking the people with skills who can lead the change from present state to future state.

In other words – we’re here now, and we kind of know we want to be someplace else pretty soon, but we just don’t know how to get from A to B. We just don’t have the people who can take us on that journey. Or our own people maybe could but they simply “don’t know what they don’t know”.

That’s what CloudU is all about – whether your preference is for whitepapers you can print out and ruminate over. Whether it’s for a certificate you can print out and point to in your resume. Whether it’s simply for a community where you can discuss the challenges you’re going through – CloudU aims to fulfill your needs.

So the Cloud is definitely changing your job – what are you planning on doing in 2012 about it?

I posted about the initiative on the CloudU LinkedIn group and had a smattering of comments – many of which identified the lack of what insiders would call genuine Cloud vendors. The other common theme from people was the concern that there was more marketing hype in the announcement than any substantive depth.

According to the TOSCA site it works to;

…enhance the portability of cloud applications and services. TOSCA will enable the interoperable description of application and infrastructure cloud services, the relationships between parts of the service, and the operational behavior of these services (e.g., deploy, patch, shutdown)–independent of the supplier creating the service, and any particular cloud provider or hosting technology. TOSCA will also make it possible for higher-level operational behavior to be associated with cloud infrastructure management.

It’s a heady concept, if it actually works, TOSCA could deliver a number of benefits including;

• Smoother migration of existing applications to the cloud
• Flexible bursting (consumer choice)
• Dynamic, multi-cloud provider applications

Many people have noticed the lack of large IaaS vendors on the TOSCA steering group, in a GigaOm post about the initiative, one commenter sagely points out that;

Until customers demand it, why should they [the big vendors be involved]? And they can’t demand it until we show feasibility … Thus, a standards project. This worked the same way with databases and XML export formats. It took a while for the biggest incumbents to admit that standardized export might be OK.

My POV

I like standards, and I like the idea that customers are able to shift workload between different cloud providers and between public and private. That said, it looks unlikely that any initiative will truly be able to deliver upon a hypervisor agnostic portability mechanism for a number of reasons. Firstly it’s not in the large vendor’s interests to allow for this portability and second because the technologies being utilized are sufficiently ingrained as to make the creation and adoption of a standard problematic.

In back channel discussions others mentioned the fact that TOSCA has some incumbents around the table who have a vested interest in increasing rather than reducing the complexity to ensure lock-in is enhanced and monopolies are secured. That doesn’t bode well for TOSCA to really deliver upon its goals.

TOSCA also enters the market at a time that OpenStack (see disclosure) is gaining momentum among vendors as the open source infrastructure model of choice. While many question the motives and chance for success of OpenStack, there are enough deployments from different vendors already in the wild for me to feel comfortable with it as a true initiative beyond simple marketing.

I’m prepared to cut TOSCA some slack, but would need to see some significant progress before I was happy to say that it is actually more than a loose marketing venture. I’d also want to see some reference implementations of TOSCA to assess how real this really is. Watch this space.

The other classes of people however are those who are open to looking at new approaches, but who want to hear how to do it, along with some tips and tricks for what to look for in their deliberations. I was stoked to receive an email the other day from Stan Klimoff, Director of Cloud Services for Grid Dynamics. In his email, Klimoff sent through a series of simple tips that he uses when talking to folks about a move to the Cloud.

Without further ado then, here follows Klimoff’s four tips for organizations heading to the Cloud;

1.    Identify business processes that can benefit from using the Cloud. For each business process, one should keep in mind the reason to use the Cloud in the first place. Possible reasons for using the Cloud include:

• Cost
• Business agility
• SLAs

2.    Break down the IT processes and applications that support your business processes identified in the previous steps into classes according to the benefits that you want to receive from transition to the Cloud. Depending on what the goal is, the approach will also vary.

3.    Analyze the following items to avoid potential road blocks.

•    Identify the data that is touched by each IT process. Is there any data that has to stay in-house for security or compliance reasons? You may need to change IT processes so the sensitive data is not affected by the transition.
•    Analyze data access patterns. Data-intensive applications are usually not the best fit for a Cloud, unless you plan to put all of your data in the Cloud.
•    Identify security domains. As with any external provider, one should always treat the Cloud as a separate security domain. What is less obvious is that there are different security domains within Cloud itself. Do you need to satisfy PCI DSS requirements? Can your Cloud provider give you guarantees on the data boundaries?
•    Determine availability and reliability targets. Not all of the Cloud providers provide strict SLAs on availability and even when they do, those can be misunderstood (as happened with the notorious Amazon outage earlier this year). However, applications that are more tolerant to weaker availability SLAs can be a good fit.

4.    Calculate total cost.

It’s a good first step; I’d argue with Klimoff’s focus on total cost however, I’ve long said the value from a move to the Clouds goes well beyond any cost savings. The first three points however are spot on and worth using for organizations considering a move to the Cloud.I’d be interested to hear the tests and processes that others use when talking with organizations making the change – feel free to join in the conversation!

We’re covering these areas of Cloud Computing on an ongoing basis at CloudU, an educational series aimed at increasing the knowledge and skill that SMBs have about the Cloud.

In an effort to mitigate this threat, MYOB has been working on a multi year (and multi million dollar) project that sees it move from a desktop-centric vendor to one that looks more like a hybrid provider. One of the steps in that process has been to move the software from it’s old database approach to one based on MySQL and hence more able to play in a “cloudy world”.

But one of the things about moving a software platform, and a business, to the cloud is that two distinct barriers are in the way;

1. Moving millions of lines of existing code to a new platform, while still maintaining backwards compatibility and not breaking everything is an incredibly hard job. There’s a reason why the most successful SaaS businesses are ones that had no legacy products to move
2. Cloud is bout much more than a technology shift, in fact the biggest part of cloud is that it democratizes, consumerizes and commoditizes technology. That’s a very difficult thing to face for a vendor that has been used to license fees and annual maintenance contracts

So it was interesting o see the response that MYOB got to its initial attempt to migrate its core accounting product, AccountRight. Alas it hasn’t been plain sailing – with issues arising of both a technical nature and a business one.

Platform shifts are hard

Users are complaining vociferously about performance issues with the new products saying that they’re buggy and slow with unusual requirements put on users (the need for QuickTime for example, strange in a world that’s all about web standards). In their defence MYOB are being forced to support, almost on a case by case basis, individual machines with particular software and hardware issues. Which brings us around to one of the benefits of a true web app – so long as the browser a user has is supported – that should be the sum total of the potential issue list.

True Xero does require users to have Flash installed – but they’ve promised (for awhile now it must be said) to move off Flash onto something that is more preformant and more importantly native within the browser (HTML5 anyone?).

People expect consistency from an existing player

One subject of complaint from MYOB users is that with the new package, only one business entity is allowed per license. As a little background, in the past there was no barrier to multiple entities being run with one software license. While it is undeniable that Xero and all the other vendors charge  separate subscription for each business entity, the key thing here is perception. Companies have grown accustomed to running multiple entities with one MYOB license and when this is no longer available, another of their existing ties to the incumbent provider is lost.

But when suggesting this “give it a go” approach to people, I’m often met by exclamations of concerns and comments that ‘there’s no way small businesses will ever just dive in and have a go with unproven technology”. Well a case study I read recently seems to challenge the veracity around that claim.

Jason O’Neill runs a small construction company, ONC. He seems to be your typical builder whose attitude to technology is summed up best by his comments;

I’m not a technical person, I’m a builder. My knowledge of sending an attachment by email was that’s hard.

One couldn’t hope for a better example of someone unlikely to adopt cutting edge technology. Or so I’d have thought. Only in O’Neill’s case it didn’t work that way. Exposed to Google Apps at a networking event, O’Neill decided to experiment using Google Docs, Calendar and Forms.

He began quite simply introducing a single address book for all his staff that has contacts color coded depending on the type of contractor or customer they are. O’Neill didn’t stop there though; he set up a shared Google spreadsheet to track construction jobs and even started using a simple Google form to collect specific information about different contractors.

Now obviously O’Neill isn’t doing anything amazingly technical. His isn’t a case study that shows Cloud Computing as ground-breaking in technical terms. But what it does show, and perhaps more importantly than technological paradigm shift, is a transformation in the way organizations work, and a fundamental change in how they interact with technology.

I’ve long said that Cloud Computing is a trend that, while exciting from a technological perspective, is even more exciting for the fact that it has the ability to finally deliver on the promise of democratized IT. Cloud Computing finally delivers that vision where almost every person anywhere can access products or services that are of the same level previously only available to the largest organizations.

It means that Jason O’Neill, a small time building contractor, can have a presence, and can enjoy the sort of digital tools that his largest competitors can. And that’s truly exciting.

This series of posts are companion pieces to the CloudU series of educational material. We’d love you to join in some of our webinars or read the whitepapers the CloudU homepage is – here – and you can register to have updates sent to your inbox (in a non-spammy way of course!) there.

Over on his blog Kin Lane has a good roundup of the issue that sparked the tension. Essentially it was a question that I posed around the commoditization of technology. In this case I was positing the view that the provision of an API and the services around that API is becoming something of a commoditized service. This is an important trend for a vendor like Apigee that is focused solely on providing the plumbing to facilitate API enablement. Obviously Ramji thought I was trying to pick an argument, nothing could in fact have been further from the truth, I was trying to hone in on a trend that has far broader impacts than just on the API space.

If we look at the cloud computing stack for example, we can see PaaS gaining significant momentum as organizations see the extra value that a platform has when compared to infrastructure services. If you buy into the vision that some of us commentators have, that PaaS will become the future of cloud services, then where does that leave vendors who provide infrastructure services in a largely undifferentiated way. While I’m sure IaaS providers would argue the multitude of reasons why their service is differentiated from just the provision of servers, the reality is that a significant part of the marketplace doesn’t see this distinction.

I reached out to Ramji to talk about our tete a tete and also to get his perspective on my commoditization question in a less charged environment. We had a long discussion in which Sam talked about the view of technology markets he holds after spending 30 years in the industry and seeing a number of cycles of innovation/competition/commoditization. As he said;

Commoditization only happens in mature markets where the needs are well understood, the technology is extremely similar, and there’s limited space for differentiation due to customers’ demand for standardization.  There is competition in the API Infrastructure/Management space and it’s only just begun.

He reflected on TCP/IP, an area that clearly got commoditized, and reflected on what is different in the API management space. We talked about the state of the API market and the fact that, as yet, it is an early stage market with only nascent competition from a handful of tiny providers (Apigee, Mashery, 3Scale, Layer7) and no large scale plays from any of the traditional vendors, as such Ramji contends that any commoditization which may occur down the line, is a long ways off.

While Ramji agrees that some of the parts of what vendors like Apigee do may become commoditized over time, he’s adamant that the value that a highly focused API vendor brings to organizations provides sufficient areas within which to differentiate and hence avoid commoditization en masse. He drew on what Apigee is seeing as drivers to customer acquisition when he said that;

If it’s a commodity, the terms of the sale are either price or support.  This is not the case right now at all, and won’t be for several years (at least 5).  This is partly because it’s a new space, and partly because businesses are still discovering – and inventing – new ways to use APIs, which drives new features and demand new services.

To this point Ramji also anecdotally mentioned that the speed of competitive innovation from the businesses providing APIs themselves is even quicker than the rate at which website innovation happened, relying on a third party to enable that innovation is a small price to pay to keep ahead of the competition.

It’s a topic that I’ve spoken at length with Steve Wilmott, CEO of another API company, 3Scale about. Steve was at the session at Defrag and, while of the view that the question around commoditization was a valid one, is also confident that there are opportunities for vendors to differentiate their services, despite the trend towards commoditization of at least parts of those services. In 3Scale’s case, they’ve spent a lot of time building out an approach that gives the ability for third parties to plug-in additional functionality to the API platform, and are introducing services such as analytics and open billing to give themselves an edge.

Similarly positive is Andy Raskin from another API vendor, Mashery. In discussing this issue Raskin asserted that;

A commoditized market is one in which all the offerings are the same — no differentiation, no innovation.  You can spot a commoditized market a mile away because the buying decision is all about price.

In the API space, that’s not what we’re seeing. Because so many businesses are just waking up to what’s possible with APIs, there are always new features to add, new ways to make our customers’ API programs more effective or easier to manage. And then there are services around the API — strategic planning (opening up data often requires a shift in culture and strategy)  and developer outreach services — that for many companies are key to the success of their APIs. As a result, the buying decision in our market rarely comes down to price alone, but rather to which bundle of features and services is the best fit.

All valid comments, but I still hold my view that commoditization in this space is coming – at least in parts. As more and more vendors move into providing competing services to enable businesses to do stuff, and as the accelerating trend towards the commoditization of IT begins to chip into those companies points of differentiation, I’m interested to see how vendors will respond. While getting defensive and claiming one’s product is a platform immune to democratization might make a good sound bite, it’s not an overly effective strategy for avoiding competitive and market threats. That said, I will accept that we’re in the incredibly early stages of the API market and commoditization is a threat that is still far in the distance.

• Have significant interaction with external applications or services
• Are not a point of differentiation between the organization and its competitors

Part of the rationale for this advice was the realization that organizations are still generally anxious about moving core applications to the Cloud; those applications that handle their most sensitive data are still sacrosanct within many head offices.

This made it all the more interesting to read a case study on Box Free IT that seemed to challenge this anxiety at least for one business. Arthrocare is a global medical equipment manufacturer that is headquartered in Texas but has operations all around the world. They are a typical modern business running a distributed operation in multiple geographies and time zones.

Arthrocare runs its operations on SAP, the quintessentially traditional financial and enterprise resource planning (ERP) application. Wanting to move into yet another market, this time Singapore, Arthrocare’s international controller, and by all accounts a very pragmatic and progressive person, Annika Hedstrom took a deeper look at whether the time, cost and hassle of rolling out SAP in a small market was justified.

Hedstrom took a close look at cost but, more importantly in my mind, at time to implement. Previous roll outs of SAP in new markets had taken at least three to six months to get up and running, not exactly agile in anyone’s book.

Hedstrom decided that an agile approach, one that potentially made do with an 80% solution, but one that could be up and running in very little time, was the best option. Instead of SAP and six month deployment times, Hedstrom decided on relative unknown Saasu, a simple, easy to use and most importantly easy to implement application from Australia.

Final time to deploy? Five days. Five days!

Which is interesting when looked at in context of planning a move to the Clouds, and determining what is a good fit for Cloud and what is best to remain on-premise.

Now arguably there are some lightweight on-premise accounting solutions that might have been able to be deployed more rapidly than SAP. But if we look at the multitude of benefits that a SaaS application brings, it becomes a pretty easy decision to make. Moving from on-premise to Cloud, regardless of which vendor is chosen, sees Arthrocare gain the ability to access their application anywhere at any time. This gives them the ability to forget about hardware and software upgrades, and provides the flexibility to integrate with lots of different applications via API.

So when you’re thinking about what is a good candidate for Cloud in your organization, think back to Arthrocare, and imagine the benefits that Cloud could bring to your particular situation.

We’re covering these areas of Cloud Computing on an ongoing basis at CloudU, an educational series aimed at increasing the knowledge and skill that SMBs have about the Cloud.

I must have watched hundreds of presentations over the last few years focused on the benefits Cloud brings to an organization and they all have the same bullet-pointed list. It’s like rote learned mantra washing over attendees.

It’s started to strike me however that this ling list doesn’t do much to answer the questions of those looking to make a move to the Cloud. For them there is one simple question; “How the hell do I start?” With so many vendors selling so many products it’s difficult to know. The options are numerous;

•  Do we go simple and just use some Cloud infrastructure for some test/dev projects?
•  We’ve got some hardware due to be end-of-lifed, do we replace it with the Cloud?
• We have a bunch of email accounts service on-premise; do we make a move to Google apps perhaps?
• Our systems are tied together by a lot of sticking plasters; do we look for a Cloud suite to simplify our systems?

It’s made all the more difficult by dual traits that seem to be occurring in our industry. On the one hand are traditional vendors who spread fear, uncertainty, and doubt (FUD) to increase the concerns organizations have about moving to the Clouds. They decry Cloud as risky, minimize the benefits and call it immature. On the other hand are the zealots who would tell you that an immediate and total move to the Clouds risks organizations being left behind and putting their very existence at risk.

The reality is (of course) different than what either of these parties would lead you to believe. Yes Cloud is an important industry trend and will grow in terms of adoption over the next few years to become, within only a few years, the default way of delivering technology. But there will still be workloads delivered from traditional infrastructure sitting within an organization’s premises.

That’s not to say there aren’t particular things that organizations need to think about. There are indeed a plethora of both technical and business considerations that need to be taken into account; we detailed many of these in a previous CloudU report. But what we need, beyond a checklist of things to look at, is some clarity around what different organizations consider to be the drivers, barriers and key decision points involved in a move to the Cloud.

I’m interested to hear the process that business and technology folks within organizations go through in determining where there workloads reside, and your thoughts or comments would be appreciated.

We’re covering these areas of Cloud Computing on an ongoing basis at CloudU, an educational series aimed at increasing the knowledge and skill that SMBs have about the Cloud.