Information Technology

Recordkeeping and Archiving in the Cloud: Is there a Silver Lining?

Professor Sue McKemmish

2

Overview What are the implications for recordkeeping and archiving of the rapid

uptake of cloud computing?

What are records and archives? What is cloud computing?

Models and types of services

Benefits and risks

Australian case study

– National Archives & Public Record Office Victoria Checklist – evaluating and selecting services, assessing and managing

risks, negotiating contracts

ISO 15489 Records Management Standard – draft provisions

Cloud for Europe initiative

The future: Archives-as-a-Service and Recordkeeping & Archiving 3.0

3

Records

Information created, received and maintained as evidence and as an asset by an organization or a person, in pursuit of legal obligations or in the transaction of business(Standards Australia; Standards New Zealand. AS/NZ ISO 30300: 2013: Information and Documentation – Management Systems for Recordkeeping – Fundamentals and Vocabulary (ISO 30300: 2011 MOD). Sydney: Standard Australia, 2012; Wellington: Standards New Zealand, 2012).

Archives are records of continuing value

Multiple forms, media and formats

Captured and stored in many places

Increasingly managed and stored in “the cloud”

4

Cloud Computing

The US National Institute of Standards and Technology (NIST) defines cloud computing as:

a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of resources (e.g., networks, servers, storage, applications and services) that can be dynamically configured to meet needs of multiple clients

Benefits:

Cost-savings from a pay-as-you-go business model – no need for large investments in software, platforms, infrastructure and in-house IT staff

Accessible anywhere, any time – supporting a flexible and mobile workforce

Can be scaled to meet demand and optimise resource use.

5

6

Cloud Services

7

Recordkeeping Risks security, privacy, integrity, authenticity, accessibility and digital

continuity

commercial continuity

lack of transparency of many cloud service providers

degree of risk and possible consequences vary for different models and types of services

highest risks and most serious consequences associated with software and platform services in the public cloud

relatively low risks associated with infrastructure services

hybrid clouds optimise benefits and minimise risks associated with public clouds

risks associated with location of data stores and servers, and trans border data flows are the same regardless of the model or type of service.

8

9

Australian Responses

The Australian Government will be a leader in the use of cloud services to achieve greater efficiency, generate greater value from ICT investment, deliver better services and support a more flexible [mobile] workforce. (AGIMO 2013)

Cloud computing poses both benefits and risks for Australian Government agencies. Gains in cost and efficiency need to be weighed up against the risks associated with privacy, security and records management (NAA 2011)

10

Dual Role

Regulation of current recordkeeping

Preservation of government archives as collective memory and

cultural heritage

Long-term preservation of digital records depends on best practice

current recordkeeping

Case Study

National Archives of Australia

Public Record Office of Victoria

11

Digital Continuity

Digital Continuity

Vendor Lock-in

Vendor Lock-in

Location and Jurisdiction

Transparency Accountability Governance

Rights in Records RK Functional

Requirements

Commercial Continuity

12

Location & Jurisdiction

Personal, security & confidential records

Location & Jurisdiction

Personal, security & confidential records

13

Transparency Accountability Governance

Applies to all records

Transparency Accountability Governance

Applies to all records

Rights in Records

Personal and confidential records

Records subject to copyright and IP

Rights in Records

Personal and confidential records

Records subject to copyright and IP

14Presentation title

Recordkeeping Requirements

All records

Recordkeeping Requirements

All records

1528th February 2011Presentation title

Digital Continuity Vendor Lock-in

Commercial Continuity

Digital Continuity Vendor Lock-in

Commercial Continuity

16

Revisions to ISO15489 Records Management (draft stage only)Focus on:

• Sustainability of service

• Controls over integrity of records

• Extractability of records and their metadata

Contracts that define:

• Rights and responsibilities of the owner of the records, the users of the service and the provider of the service

• Requirements for submission, control, dissemination and security of records

Working Party:

“Impact Assessment of Distributed and Outsourced Platforms and Services Usage on Records Management and Archives”

EU Digital Agenda

The ECP aims at driving the first steps towards better public procurement of cloud services in Europe, based on common definitions of requirements and possibly eventually going as far as joint procurement across borders …

Pooling public requirements could bring higher efficiency and common sectoral requirements (e.g. eHealth, social care, assisted living, eGovernment services) would reduce costs and enable interoperability. The private sector would also benefit from higher quality services, more competition, rapid standardisation and better interoperability and market opportunities for high-tech SMEs (European Commission 2013).

18

Postcustody 2.0

Archives-as-a-Service

Archival community needs to be proactive “in the formation of the new, preservation-aware cloud

services”

Australian case study is an example of this approach.

In the future?

Whole-of-government preferred supplier & procurement arrangements for cloud

computing

Preferred suppliers compliant with requirements in jurisdiction

of client organisations

An EU-type Australian government cloud?

Stančić, Hrvoje; Arian Rajh, Arian; Milošević, Ivor. "Archiving-as-a-Service". Influence of Cloud Computing on the Archival Theory and Practice. // The Memory of the World in the Digital Age: Digitization and Preservation / Duranti, Luciana ; Shaffer, Elizabeth (ed). UNESCO , 2013, 108-125.

19

Somewhere beyond custody, in the archival multiverse, lies the vision of Recordkeeping & Archives 3.0, taking advantage of the benefits and opportunities of cloud computing to build regional, national, state and

community archival clouds

In this scenario the policies, standards, strategies, guidelines and tools being developed by archival authorities like the National Archives of

Australia and Public Record Office of Victoria contribute to the development of broader requirements that embrace the recordkeeping and archiving

needs of all those involved in community cloud partnerships.

To realize this vision, recordkeeping and archiving communities need to take a pro-active approach, as clients, standard setters – even

potential service providers themselves – to shaping cloud services, and the future of recordkeeping and archiving in the cloud.

Recordkeeping & Archiving 3.0