ICT Management. > Strategy & Planning
Software > Buying & Owning Software, Office Applications

Web Based Services - Tales of the Unexpected

By Lasa Information Systems Team

Web based services can offer tremendous benefits to voluntary and community sector organisations – with a web browser and a few mouse clicks we can compose, share and store documents and collaborate with friends and colleagues in a far more effective way than before. However, those using web based services also need to be aware of the risks before making the jump. This article summarises some points to be aware of.

Web based services or cloud computing – where computing power is delivered over the internet as you need it, rather than from your desktop computer – is changing the way many organisations are working, with Google Apps, Zoho office, Microsoft Office Live Workspaces and Microsoft Business Productivity Online Suite giving staff the power to work flexibly, from the road, a remote office or home.  The possible benefits of using web based services are explained in the knowledgebase article Work Smarter, Quicker And Cheaper With Online Tools.

However, before making the jump to web based services, organisations also need to be aware of the many concerns over the mainstream adoption of cloud computing, such as accessibility, privacy, data protection and business continuity, with users potentially being locked out of their own files.

Accessibility

Web based services have barely begun to address issues of web accessibility.  If your organisation is using social media tools like Twitter or Facebook, bear in mind that Abilitynet’s State of the e-Nation 2008 report found that web based social networking sites like Facebook, MySpace, YouTube, Yahoo and Bebo, were effectively ‘locking out’ disabled visitors, the majority of whom couldn’t register or participate, in clear contravention of Disability Discrimination Act (1998).

Where is your data stored, Data Protection and Privacy

Whilst cloud computing is global in reach, many of the data processing and storage centres are in the USA, raising legitimate concerns over data protection and privacy, which Paul Ticher discussed in the knowledgebase article Data Protection and Web Based Applications.  

In the real world, national borders and national laws of sovereign states take precedence, but this lags some way behind the reality of cyberspace, where Google and Microsoft make no promises about where an end user’s data is physically stored.  Under the US Patriot Act, the FBI and other agencies can demand to see content stored on any computer, even if it is hosted on behalf of another sovereign state.  If your data hosting company gets a National Security Letter, then not only do they have to hand over the information, they are forbidden from telling you or anyone else about it.  According to the US-based Electronic Frontier Foundation, more than 200,000 were issued between 2003 and 2006, and it’s likely that Google, Microsoft and Amazon were all on the recipient list.

It’s also worth remembering that as of April 2009, a new EU directive now requires all ISPs in the European Union to store records of user emails and internet phone calls for 12 months.  The data stored does not include the content of e-mails or a recording of an internet phone call, but is used to determine connections between individuals.

The Information Commissioner's Office (ICO) website has a useful code of practice guide on Personal information online (PDF 2.3 MB). The guide includes a section on cloud computing (see section 5 'Operating internationally')

SLA’s and Terms and Conditions

Read the Service Level Agreement or Terms and Conditions - this can be particularly important where service reliability and recourse to legal action for lost data is a concern.

The SLA’s provided by Microsoft and Google make it quite clear that their services are provided ‘as is’, ‘with all faults’, ‘without warranty’ and ‘as available’.  Ask yourself if a service provided without warranty is fit for your organisation’s purposes.  They might promise 99.9% availability and reliability, but the liability for using the service and any data loss is all yours.  Should you wish to enter into legal dispute with Microsoft regarding its online offerings, you “irrevocably consent” that your complaint will be heard at a ”federal or state court in King County, Washington, USA.”

The recent wave of outages suffered by Twitter due to surging demand also highlight that despite all the promises, web based services do fail, and the consequences can be quite serious who rely on it for their communications. 

Reliability

As for service reliability, a case in point is Ma.gnolia, a social bookmarking site that stored bookmarks for tens of thousands of users – or at least until their servers collapsed, irretrievably losing their user’s data in the crash.  Head over to ma.gnolia.com to watch a video of Ma.gnolia’s founders admitting that they didn’t carry out any back-up testing.  If your data only exists in one online service you should take immediate steps to back it up to a location you have physical access and control over.

Choose an established provider

Do your research and choose a well established product by a respected provider – you don’t want to find the company goes belly up taking all your data with it.  A quick trawl though Google will flag up services with a poor record of customer care.

Better still, make sure the you read the SLA and ensure the service provider has robust back up arrangements or ensure it’s possible to get your information and data out so you can create a back up yourself or import into another tool if need be. This may involve additional expense depending on the application.

Conclusion

As with all things, take the time to think about and weigh up the risks you are entering into. Whilst millions of individuals are quite happy to live with web services that offer no guarantees and is entirely at their own risk, managers of voluntary sector organisations should think twice about it. However it's also worth noting that cloud services can provide far more robust security and backup than operate in many of these organisations currently.