Rhm2ktmi's List: Cloud - Jurisdiction Location

• The European Cloud Computing Strategy, due to be announced on Friday, will seek to cut through the current jungle of standards in the European Union.
• The standards that the Commission wants would be voluntary but would apply to all cloud providers, not just to deals with public administrations.
• There have already been many efforts to establish working standards for cloud services, led predominantly by suppliers, but the Commission fears that without certified standards "clouds may develop in a way that lacks interoperability, data portability and reversibility, all crucial for the avoidance of lock-in."
• "An appropriate set of standards that can be certified in order to allow public and private procurers to be confident that they have met their compliance obligations

2 more annotations...

• When the European Commission unveils its new cloud computing plan of action this week, the hope is it will reduce fear, uncertainty and doubt around Europe’s confusing welter of data protection laws that are impeding the broad adoption of cloud — especially public cloud — technologies. The European Cloud Computing Strategy is expected to push an array of standards for cloud computing and to help alleviate some of the legal hurdles to adoption.
• Clearly, that geographic requirement flies in the face of the notion that cloud computing is a borderless, frictionless world where consumers transact with merchants not necessarily knowing where that transaction takes place.
• Smart cloud implementors are proceeding but cautiously. Private and hybrid cloud adoption is often preached as a solution to the data protection issue. The right implementations keep PII data under the control of the business and within the required geography. As IDC analyst Mette Ohorlu put it recently,  Europeans are “mad about private cloud.” Her most recent data showed nearly three quarters (73 percent) of European companies surveyed are considering a move to the cloud and of those, 55 percent want to go the private cloud route, up from 36 percent last year.

1 more annotation...

• we've built and been using quite a rich concept of
  "location
• which we use to figure out where app components should be
  moved.
• the Location API is placement specific
• it doesn't expose details such as coordinates,
  jurisdiction, security, qos, network topology
• following use cases
• collocation
• correlation to a service provider
• compatible scopes
• assignability
• I'd also like to have us think about revisions/authority
• Cloudharmony and others are trying to provide some of this, and of  
  course we should try to use these sources in a smart way, as Adrian  
  said
• Put another way, until this data is largely made available by the  
  providers themselves, it's going to be tough
• On the content side, to begin with for sure we will have to seed this,
  using information from providers where they will tell us
• For me the more interesting part -- initially --  is getting a mechanism
  by which this can easily be both described and consumed.
• I agree completely, by the way, that in the longer term this information
  has to come from the providers
• As a practical
  implementation would it make sense for the location metadata API to
  support references to URLs, ie to allow a static location file to refer
  to providers to get full/updated info?
• Also a good opportunity to get involved with other potential consumers  
  of this data who are not in the Java space, perhaps?
• I think what this  
  ultimately boils down to is whether we consider *collating* location  
  information from providers functionality that jclouds provides. As  
  opposed to simply making location information available that is  
  provided by a service.
• Basically, I guess what I'm saying is that if the providers offered  
  good location info through their APIs we'd simply be exposing it in  
  jclouds
• And while they're not we're trying to supplement their info  
  with more stuff from an additional source
• JSON support
• to standup a
  reference rest service that can show how this data can be fed from third
  parties.
• use cases
• ElasticHosts/ElasticStack

22 more annotations...

• Through a common ancestor, objects can describe their location from a placement perspective,
• this data includes an id, scope, description, and parent
• The scope is used to clarify the intended usage. For example, a Node can be launched into a Region scope, but it inevitably is a part of a smaller scope, such as Zone (datacenter) or Host.

1 more annotation...

• For example, during the litigation process, the parties to a case have a legal obligation to identify and produce relevant electronically stored information (ESI).
• Where is your data actually located?

• core ontology for organizational structures, aimed at supporting linked-data publishing of organizational information across a number of domains. It is designed to allow domain-specific extensions to add classification of organzations and roles, as well as extensions to support neighbouring information such as organizational activities.
• Location

• Specifying License Information
• rights management schema
• Verification Links and XMP
• boost confidence in embedded metadata by providing a verifying web statement.

2 more annotations...

• There does not yet exist (that I can find) a generally-accepted definition of Data Sovereignty, but we use it to mean the right of a nation to have its data treated the way it wants.  It is a relatively new notion but one that will undoubtedly be treated with a great amount of respect by everyone in the business of managing and using information, and the Safe Harbor framework is a good example of that deference.  (See these remarks by US CIO Vivek Kundra for another.)

• metadata that describes a particular government data source
• From these, we propose a preliminary vocabulary:
• Jurisdiction  Political jurisdiction of the data.   

1 more annotation...

• Agreements can be made concerning the jurisdiction over disputes concerning the data. However, disputes involving other entities not parties to that agreement may not be subject to the agreement
• A key issue often overlooked by companies evaluating the value of the “cloud” is Jurisdiction, which is a key legal construct.
• Jurisdiction over the parties is called “personal jurisdiction” and can generally be obtained over a party who resides within the court’s geographic authority or has entered into “minimum contacts” with a person or company located in the jurisdiction.
• Personal jurisdiction can also be obtained by consent, which is commonly done through a contract provision stating that the parties agree to submit themselves to the jurisdiction of a specific court. In order to take jurisdiction
• Jurisdiction over the subject matter of an action is referred to as “subject matter jurisdiction.”
• Jurisdiction is important with respect to the powers of law enforcement and government agencies
• Different law enforcement and government agencies have different boundaries within which they can exercise their authority, and some also have subject matter limitations (e.g. environmental issues) on their authority
• Cloud computing is relatively new and could lead to some novel problems concerning jurisdiction
• This typically means that a company is responsible for producing its documents without regard to where the documents are physically stored, provided they are the company’s documents or the company has control over the documents
• What is a dispute concerns ownership or use of the documents themselves
• is the company consenting to jurisdiction in that location
• doing business
• States have laws governing privacy and confidentiality that can provide severe sanctions for violating those laws
• are the documents governed by the law of the state in which they are physically located, by the location of the company possessing them, or by the laws of the state where a person resides

12 more annotations...