As the Obama administration urges agencies to adopt cloud computing, the National Archives and Records Administration is worried that federal documents may not be preserved and archived properly if stored on off-site clouds.
Through cloud computing, agencies rent access to servers, storage and applications over the Internet, rather than owning and maintaining systems themselves. And that could conflict with federal rules requiring agencies to maintain records so their "functionality and integrity" remain constant throughout records' lifecycles.
NARA issued a preliminary set of frequently asked questions about record keeping and cloud computing in February, reminding personnel to learn about cloud computing and think about how to preserve records when they're kept in the cloud. NARA will issue a bulletin by Sept. 30 directing agencies as to how to comply with federal records regulations while using cloud computing, said Arian Ravanbakhsh, an electronic records policy specialist at the National Archives.
"With new technology, what we try to do is have this conversation up front so we're not behind the curve on technology," he said.
It's crucial that agencies think about how to track and retain documents, he said. NARA is concerned that cloud contracts could end before agencies have thought about data continuity, and the bulletin may urge agencies to draft records-preservation requirements into cloud computing contracts so both agencies and vendors are aware of what the law requires, Ravanbakhsh said.
"Some documents have 20-year archival requirements. If it's in the cloud and you need to migrate it because the cloud experiment is over, how do you get those records out?" he asked.
This isn't the first time the government has struggled to juggle records preservation with emerging technology. It faced the same questions when e-mail became popular in the 1990s, and it addressed similar concerns about a decade ago when agencies expanded their Web sites.
Agencies can learn from those examples when they consider how to preserve data stored in clouds, said Ray Bjorklund, senior vice president and chief knowledge officer at FedSources, a marketing research firm based in McLean, Va.
"When you think about e-mail, it resides in an electronic format and can move very easily from one repository to another. Just like cloud computing, how do you keep track of it?" he asked.
NARA has just started examining the impact of cloud computing on agency records, and it has yet to identify agencies that are practicing good records management. It hopes to identify successful agencies so they can share best practices, Ravanbakhsh said.
Ravanbakhsh said it's up to each agency's records management staff to ensure employees are thinking of records preservation as they migrate programs and data to the cloud. The records management staff must engage in staff discussions and be part of the contract discussions, he said.
Not everyone thinks cloud computing's rewards outweigh its risks. It's up to agencies to abide by regulations, and until agencies know how they'll juggle regulations with cloud computing, they should pull out of clouds entirely, said Alan Pelz-Sharpe, principal with The Real Story Group, an Olney, Md.-based information management analyst firm.
Pelz-Sharpe, who travels around the world speaking at conferences on information security and records continuity, said it is too early for federal agencies to safely engage in cloud computing.
"Records management is about close control through the lifecycle of a piece of information. You know where it is and what form it's in. … When you go to cloud computing, you have no idea," he said.