Cloud Computing – Are the Security Risks real - or is Legislation lagging behind technical Opportunities?

fig 1. Cloud Computing concepts and threats

In Denmark the discussion between Security freaks and the avant garde computer nerds has raged this summer om the question whether or not the Public Sector in Denmark should pursue the use of Cloud computing aggressively. (My blog – in Danish – covers this discussion). The con's are led by the IT Council for Security, while the pro's – amazingly – is lead by the Minister of Science, Charlotte Sahl-Madsen, who sees the opportunity to involve a number of innovative, small companies in utilizing the vast amount of public data until now stored away in departmental systems, bunkers or behind firewalls.

Gartner Group has recently publicized it's 'Hype Cycle' for Cloud Computing that points to the observation that the concept is probably currently at the very top of the Hype and bound to go through the 'Trough of Disillusionment' before we start to see real large scale, public use of the technology.

The opponents are pointing to 3 reasons why the public sector should be extremely careful to deploy CC at a large scale:

1. Cloud Computing should comply with all existing legislation concerning data security.

2. Cloud Computing solutions should obey to 'best practices' and common accepted standards that the providers should be certified to guarantee

3. Critical data should obey to national and EU standards in emergencies – currently demanding that critical data (Citizen Records, Health Records, State Financial Records, Military and police records) should be guarded and kept within full physical control of the responsible departments/public organizations.

The Minister of Science requests a new look at Data Security, and even EU is expected to produce a suggestion to ease the European Directives on data protection to stimulate use of Cloud Computing.

But what are the facts and what are the real security challenges in Cloud Computing? Are there any new technological developments that will ensure that legislations' intents are obeyed even if the rigorous requirements for 'physical control and inspection' can not be performed in it's original sense?

First we need to agree on what Cloud Computing is and what is isn't. In February 2009 the UC Berkeley Adaptive Distributed Systems Laboratory gave out a technical report describing the phenomenon.

They point out that Cloud Computing refers to both the applications delivered as services over the internet and the hardware and systems software that provide these services. The applications themselves are labelled Software as a Service. The underlying HW and SW is described as the cloud. When a cloud is made available on a pay-as-you-go manner, we call it a Public Cloud. The service being sold is called Utility Computing. In contrast to this, a Private Cloud refers to internal data centers or data centers not made a available to other that one customer (or a coherent set of customers). The Private Cloud is dismissed from the Berkeley sense of Cloud Computing, even if pricing and to a certain degree scalability might be at least similar to 'Real Cloud Computing'.

Now the business model of Cloud Computing in it's original form thus consist of this 'value chain': we have the SaaS user, the end user that buys the services, web applications. He might buy these services from a SaaS-Provider, who can be seen as a Cloud User, that buys the underlining HW and basic SW capabilities from a Cloud Provider. Of course the Cloud Provider and SaaS provider might be one and the same organization.

The various classes of Utility Computing that are offered through individual business models, vary of course (Amazon, Microsoft Azure, Google, IBM etc.) and the various types are reflected in various models for computation models (Virtual Machines running on 'Hypervisors' or a 'farm' of VM's), by various storage models including variations of DB SW provisioning and finally various Network models from pre-defined IP address spaces, dynamic allocation, fixed topologies, 'elastic zones' etc.

This variation reflects the lack of common standards but is of course a result of the intense competition in the marketplace. But is has led to new definitions a part from SaaS that are used commonly: Platform-as-a service – typically major application areas, SAP for instance – and Infrastructure-as-a service. Especially the latter variation leads to the conclusion that the organization that buys IaaS simply buys the basic building blocks and otherwise are left with the responsibility to populate the Cloud by his own applications and development tools. This type of Cloud business model is especially appealing to SW developers, while the PaaS model is aiming at solving enterprise (or Government institutions') problems.

To confuse the matter more, the terms 'Community Cloud' and 'Hybrid Cloud' have risen recently – the former simply refers to a private cloud with many tenants (municipalities, agencies for instance) while Hybrid indicates that some of the applications in the portfolio in running in the Public Cloud while other services within the portfolio remains in the Private Cloud.

The application opportunities that have occurred the last couple of years as a result of this combination of highly scalable, robust 'back end' systems and an aggressive 'pay-as-you-go' pricing model covers interesting areas like mobile interactive applications, large scale batch processing jobs, heavy data analytical computation jobs, to more straight-forward desktop services solutions avoiding tedious updating and installation of new SW at each and every employees desktop.

The economics of Cloud Computing explains why the Berkeley-team did not want to include 'Private Clouds' in the definition: The huge requirements of back-end capacity and the real need for economy of scale makes it almost mandatory that the players are very large companies that can afford the risk of large scale investments – and on the other hand are able to manage and balance load in an extremely efficient way. Sharp changes in capacity demand, seasonal fluctuations, including back-up requirements, fall-over facilities etc. plus of course traffic bottlenecks in communication equipment clearly makes the unit costs of Cloud Providers competitive compared to traditional Data Centers. This is the major argument for US CIO Vivek Kundra's Federal Cloud Strategy 'Cloud First', announced February 2011, where it is stated that at least 20 Billion US $ out of the total 80 billion $ spent by federal agencies in 2011 could be saved by moving to the cloud.

Other economic benefits of moving to the Cloud as stated by Vivek Kundra are the improved productivity in application development, fast response time to rising needs, better linkage to emerging technologies and alignment with private sector innovation.

It is tempting to argue that the huge difference between the European 'Cloud Scepticists' and Vivek Kundra is that US is desperately in need of savings and in any case not very concerned about privacy, the Europeans have a more than 10 year legislation on privacy, now adopted in almost all EU countries and at least in some countries (led by Germany) this plays a very large role in public opinion. This is the reason why the EU Commission has requested an in depth study of legal and technical implications of Cloud Computing in light of the EU 94/46 Directive. These changes are not due to occur before spring 2012.

OK, but where are the REAL risks?

Looking at Figure 1 we can identify 4 classes of risks of malicious, unauthorized access:

• End user access – non-authorized attempts to gain access to read, steal, modify data, DOS etc.

• Inter-Cloud Access using external services to hide malware, worms, trojan horses etc.

• Tenant related 'insider' attempts to gain un-authorized access

• Cloud Provider administrator 'insider' attacks

Add to these risks the risk of errors in a shared physical environment if instances of VM and in particular data are not kept isolated from other tenant's.

Let us try to address the question of how a secure cloud solution could be established following the 3 items mentioned by the Danish Council for IT Security.

1. Comply with Data Protection laws.
   Their first concern is that a cloud and Saas-provider should comply with the current legislation. This has as it's root the requirement that it should be guaranteed that only authorized persons get access to data that contains PID (Personally Identifiable Data).

   You could argue that this is first and foremost the responsibility of the department that collects and stores the data to ensure access rights and to ensure that the Cloud provider follows the requirements in this respect: logs access as well as access attempts, prevents unauthorized access to customer data also by his own staff. Ultimately this requires for the government agency that wants to move to the cloud that it maintains a security organization that issues or controls issuance of access certificates and up-to-date Access Control Lists.
   It is likewise a requirement for any procurement and contracts with cloud providers.
   

2. Cloud provider should adapt 'best practices' and standards and be certified.
   Best Standards are at this stage only emerging, and it may be a tough requirement, before internal standardization agencies and governments agree on this. But there are practices that could help guide the Cloud Vendor. (See also Google's White Paper on Cloud Security)

   First of all the psychological fears of privacy breaches could be avoided if the cloud provider could guarantee against intruders passing the firewall and accessing user data, we already discussed the first level of this. The second layer attack could be hidden in the cross-application communication that will eventually occur when external clouds exchange services and data with the tenants of one cloud operator. It might be simple things like services for currency exchange calculations, or it might be much more SOA-like, cross domain data analytics – for instance health care research across several EHR-systems.
   The more basic services to protect against things like VLAN-spoofing and firewall configuration errors should in any case be part of a contract with a trusted provider, but the Achilles-heal is the second type: access to primary data across a number of domains.
   We will discuss this in more detail later to see if there are some technological development ahead.
   

3. The 3^rd requirement from the Security Council concerns national security regulations. These requirements are probably more difficult to deal with if legislation is taken literally: that inspectors should be able to physically identify data bases and storage devices. That is, of course unless you are able to prove that a) The data are protected from any 3^rd party reading and interpretation, and b) that even if the case of destruction you are able to re-construct data in a secure way. One would think that Vivek Kundra had this in mind but came to the conclusion that all major cloud providers are deeply rooted in US.
   
   There are, however, some inconsistencies in the current legislation; while it is understood that no foreign power should gain access to a complete Person Registration system, it is questionable why a financial system and related data should be considered 'strategic' if the data are duplicated and can be reproduced. This is the position of the Danish Minister of Science. But the intention as specified in national legislation to keep strategic data within the country seems to be more like a legal problem – especially if the true meaning of the word 'Control' can be solved in other ways. If you have full back up/recovery of data, full duplication and secured your data by top class (maybe even dynamic) encryption of data you could argue that you, the data owner has full control.
   

So it seems that there are technical ways around at least most of the issues – but how real is the idea to have all public institutions manage the access rights, secure encryption of the data and still be able to exchange and exploit data across institutional borders in a 'community-like' public cloud environment? Let us assume that all policy aspects are solved, agreements of responsibilities between tenant of cloud provider (and SaaS-provider) are put in place, SLA's established, certification of best practices – then is the idea of a grand scheme of encrypted data at all feasible?

Already in 2009 the IBM researche Craig Gentry suggested a method of what he called Homomorphic computing which would enable users with appropriate access rights to access and calculate on encrypted data across domains in a way where the final result could be decrypted and produce the same result as if the operation had been performed on the 'raw' data. If this is a feasible and economic practical solution, then most of the obstacles of putting sensitive data in the Cloud have disappeared. But as usual, there is no such thing as a free meal. At the current state of development, the computational requirements for this 2-step encryption method are enormous, at least at present enough to turn the economic advantages of Cloud Computing off. So we will still have to wait for the costs of computing to come down – and as it seems we are already getting beyond Moore's law and accelerating developments, it is now believed that homomorphic encryption will become economical feasible within the next 5 years. And when it will be solved, the interim requirements of close control with the Cloud provider might be reduced.

But then we need in any case to agree on and clean the standards, define and refine policies, practice and implement large scale ID-management and authorization. In any case the answer to the question whether the technical risks of cloud computing are real is yes, and it will be solved. Eventually.

Cloud Computing i den offentlige sektor – En død sild eller ...??

Henover sommeren har der været en hel del artikler om det offentliges brug eller ikke brug af Cloud Computing. Rådet for IT-sikkerhed nedkom med en pressemeddelelse den 18. juni med budskabet: 'Vent med Cloud Computing i den offentlige sektor', som blev kraftigt kritiseret af Børsen i juli, hvor Jesper Frederiksen beskyldte Rådet for at være bagstræbende og for at forhindre den offentlige sektor i at opnå massive besparelser. Selv IT- og Telestyrelsen gik ind i debatten og erklærede sig uening med Rådet for Større IT sikkerhed. (Se ComOn's udlægning: 'Rend og Hop'!)

Parallelt hermed har Videnskabsministeren hele foråret er klæret sig som varm fortaler for mere brug af Cloud Computing i det offentlige: Videnskabsministeren siger ja til cloud-løsninger i det offentlige og har udtalt, at 'Persondataloven forvirrer for meget' og hun har derfor nedsat en arbejdsgruppe, der skal se på, om der kan laves lovændringer, så det bliver nemmere at bruge Cloud Computing i det offentlige.

Så hvad er op og ned i den diskussion?

Rådet for større IT sikkerhed anbefaler, at det er uomgængeligt at 4 krav skal opfyldes, før nye offentlige cloud løsninger etableres:

• Sikkerhedsforholdene hos leverandøren skal kunne verificeres ved fysisk inspektion og certificering af leverandøren, der sikrer overholdelse af EU og dansk lovgivning

• Der skal være løsninger for nødberedskab

• Der skal være klare aftaler, der sikrer at data forbliver i myndighedernes varetægt og lagres inden for EU's grænser

• Kritiske IT løsninger som forsvar, politi og CPR bør under alle omstændigheder være fuldstændigt under statens kontrol

I det hele taget mener Rådet, at manglen på standarder og gennemsigtighed hos leverandørerne gør det højst umuligt at anvende andet en 'privat cloud', d.v.s. en lukket anvendelse af principperne i Cloud Computing, men helt under det offentliges kontrol – muligvis via en tredjepart, men under alle omstændigheder inden for landets grænser.

IT-og Telestyrelsen er ikke enig i IT sikkerhedsrådets konklusion og de fremhæver, at de har gode erfaringer med cloud computing til tre systemer, især eFaktura og Nemhandel. Når Datatilsynet indtil nu ikke har godkendt Odense Kommunes skolevæsens brug af Google Apps, mener man i ITST at det løser sig, når kommunen finder nye formuleringer. I øvrigt henviser man til det arbejde, der er udført i IT Sikkerhedskomiteen om De juridiske rammer for Cloud Computing 17.5 2011

På hjemmesiden Digitaliser.dk, har der løbende kørt diskussioner om brug af cloud computing. I bloggen skrevet af Marie Munk: Partly Cloudy er hun især positiv overfor brugen af standard SW (SAAS – Software as a Service), men i det hele taget indstillet på at det offentlige kan gå foran og afprøve nye serviceformer. Men ser vi Private versus Public Cloud – Niels Pagh Rasmussens kommentar – er denne mere på linie med Rådet for IT Sikkerhed. Og der har da været en del eksempler på brølere – f.eks. omtalen af at Cloud-fejl i køreprøvesystem påtales af Datatilsynet .

EU er i fuld gang med en revision af diverse regler og direktiver, der kommer i spil når man overvejere Cloud Computing. Det fremgår af denne artikel: Charlotte Sahl-Madsen positiv overfor lovændringer der forhindrer regnskabsdata, at arbejdet skal være tilendebragt den 31. august 2011, så kommissionen i starten af 2012 kan komme med nye forslag, herunder også om de regler, der i dag begrænser at nationale regnskabsdata kan flyde frit over grænserne. Man må formode, at man også vil tage stilling til, hvordan den gamle 'Safe Harbour' regel kan opdateres. Safe Harbor – Certificering af data centre i udlandet var den regel, der gjorde det muligt at overlade Europæiske, Schweiziske og Amerikanske Data til certificerede datacentre i hinandens lande. Problemet med Safe Harbour er imidlertid, at i de mere end 10 år den har været i kraft har der aldrig været nogen klage eller sagsanlæg, på trods af at man antager at ca. 1/3 af datacentrene ikke lever op til certificeringen. Dertil kommer, at hele ånden bag Safe Harbour er blevet ødelagt efter 9/11 af Patriot Act – indkskrænket beskyttelse af persondata blev resultatet, så man kan forvente, at US efteretningstjenester har fin adgang til de persondata fra udlændinge, der befinder sig i US.

Ikke desto mindre har især den amerikanske CIO Vivek Kundra udarbejdet en national strategy:

'Cloud First' – Vivek Kundra's national cloud strategy – der peger på særdeles omfattende besparelsesmuligheder ved at flytte federale og statslige datacentre til Cloud Computing.

I lyset af den amerikanske finanskrise, er det nok overvejende sandsynligt, at det vætigste argument her nok snarere er besparelsespotentialet. Samt en formodning om, at da cloud-lverandørerne typisk er amerikansk ejede virksomheder, har man de nødvendige håndtag – samt et noget mere afslappet forhold til persondata. Hør Vivek Kundra tale om Cloud: Vivek Kundra – US CIO – understreger vigtigheden af at flytte offentlige løsninger til cloud computing

Ud over USA er også Australian langt fremme med anbefalinger til anvendelse af Cloud Computing, og man beskriver i strategien fra april 2011, hvordan pilot applikationer som eTax og Business Reporting bliver evalueret. Denne rapport er en glimrende oversigt over muligheder, og den indeholder i øvrigt Gartner Groups 'Hype Cycle' for Cloud computing.

Medens den Australske model er meget åben over for applikationer, der liogger i 'Public Cloud'. Er UK's CIO-committee mere forsigtige og peger på anvendelser indenfor 'the G-Cloud' – d.v.s. En privat cloud der deles på tværs af ministerier og forvaltninger i UK.

Diskussionerne er langt fra overstået, og det bliver spændende at se, hvordan diskussionen mellem Rådet for større IT Sikkerhed og IT- og Telestyrelsen/Videnskabsministeriet udvikler sig.

For fuldstændighedens skyld kan man med fordel læse rapporten om

Cloud Computing i den offentlige sektor fra 2009 og måske også Google Apps Security White Paper for at se, hvad Cloud Leverandørerne har i tankerne.

e-Government - Outlook 2011

It seems to be a common practice for newsletters, newspapers and magazines to publish expectations for how trends in technology is going to affect our everyday life in the coming year.

As Gartner already discovered several years ago, some of these predictions turn out to be mere hype, not yet ready for large scale implementation, while other trends seem to emerge without anybody watching until they are suddenly there.

With a clear risk that some of my predictions will fall in the first of these ditches, I will try to come up with a qualified guess as to what kind of e-Government solutions we can expect to see in 2011 – not in every country – (particularly not my own home country, Denmark, who will be stuck with an election that will be a decisive factor in any kind of new investments in e-Gov) – but at least in some of the other, more advanced countries.

So let's look at:

• The iPad and tablets

• Cloud Computing

• Internet of things

• Social computing and eGov 2.0

• Interactive Health Care solutions

• Mobility and Identity Management

• Business Analytics – 'smart computing'

• Green computing

Everybody is fascinated about the rapid take-up of the iPad. The impact for Government will be clearly best suited for the education and and training area with lost of new teachware applications based on Apps and networking solutions. However, I expect the education sector to focus much more on the Android marketplace due to the pressure on costs, while the iPad will be reserved for the more expensive segments, interactive magazines and business applications, where the tie-in to Apple is of lesser importance. For the real large scale market it is going to be exciting to see if Tata's new 30 $ tablet PC takes off. If this is the case, ICT literacy in the third World may become a reality.

Cloud Computing and eGovernment at this stage seems to a bit of a contradiction; until the privacy issue is solved and firmly agreed upon between EU, US and Asia, Cloud computing in Government has to be restricted to private clouds where the actual location of data can be proved. If however, a new 'safe harbour' agreement can be made between EU and US we may begin to see large scale cloud computing for a lot of central and local government solutions. The pressure on economy and costs inevitably points in this direction, but my best guess is that before Cloud Computing can become a dominating factor for e-Government, at lot of consolidation and a phase of virtualization for major, old fashioned applications has to be made. As the cobol programmers are dying out, there will be a market for new main frame skills as this will be the next step before virtualization and before cloud computing for real.

Internet of things – as RFID enters any business, we can expect a number of new applications for eGovernment: traffic control, customs inspection, fishery inspections, health care provision controlling logistics, food inspection and drug control will be obvious areas, and I expect quite a number of new applications in this area.

Social Computing and eGov2.0 has been on the agenda for quite some time – and even if recent OECD analysis and predictions seem to demonstrate that a large number of public sector managers expect that web 2.0 is just around the corner in several corners, the up-take in reality has been quite slow. Where it has been emerging it has clearly been implemented in a sort of protest against existing 'official' solutions. In UK, for instance, the group that has published a mash up solution to identity which farmers have received the most funding from EU, is one example. 'rate my teacher' in US is another.

In some countries Government has tried to open up databases for the public – but only in a vey limited scale. In Denmark, for instance, the Minister for IT awarded an innovation award to a Danish girl who produced a GPS-based mash up that could tell the shortest distance to a public toilet. Practical, but hardly an example of citizen inclusion. My expectation is that in 2011 the best eGov 2.0 solutions are still left with the rebels.

Interactive Health Care (formerly labelled Telemedicine) is long overdue and it my hope and expectation that 2011 will see the first real, large scale applications aiming at supporting chronically ill persons in their own home. The cost pressure is simply too massive to let this low hanging fruit untouched. The major problem is not the ICT equipment as such but how to rethink the organizational aspects behind the solution – hot line support services, surveillance personnel, lines of communication with doctors, specialists, hospitals. I dare state that any of the Nordic countries really could start this on a large scale so we could move from the pilot state of affairs where we have been stuck for the last 10 years.

Mobility and Identity Management will most likely be 're-invented' in 2011. Now that most EU countries (expect Denmark) has issued smart card ID-solutions, the next phase will merge intelligent mobile phones with ID-solution and payment cards. This will enable citizens with a limited ICT capability to come to citizen service centre and by means of the mobile get help to access the public services in a secure way. Already in some 3^rd World countries the mobile phone is used as a payment device, and there is no reason why we couldn't use this in other more 'advanced' countries.

Business Analytics and large scale computing (also using cloud scalability) is rapidly gaining momentum in the World of Science. But as a predictiontool for social development, economic trends, electricity usage, flood control, traffic control, disease management, the current state of massive parallel computing and the sw-tools around it will lend itself to better use to formulate and test public policies; from demographic forecasts in the 70'es to climate and emission control in 2011 and beyond is a clear line. We have the tools by now, and particularly the climate issue should make this kind of applications much more attractive as an investment area for politicians that look beyond their own nose.

Green computing is really a combination of virtualization, mass storage, cloud computing – and maybe also open source computing. As computers account for 2% of all electricity consumption and 2/3 of this is really costs of running idle, the ICT industry has to assist in optimizing use of power for ICT. And the public sector seems to be extremely well fitted for being the first area where ICT could be utilized in a much more intelligent way. The next step, as we have seen in some countries, will be to invest in intelligent electricity networks and to use international exchange systems to optimize the use of power.

So there will be a lot to look for during 2011 – as a tax payer I will state that any government has an obligation to review current use of ICT - not as a stand-alone exercise, but in a close relation with the strategies and policies to make the public sector more efficient, fine tune processes and skip outdated procedures, re-use data and information and empower the citizen in a way that will make it much more attractive not only to use self-service, but also to participate socially and assist relatives, neighbours and people in the local community. It will probably be the only way the Western Welfare Society as we know it may survive.

Hvad skal vi med e-Government?

(Vejby Strand - 2.7 2010)

At sommertid plejer at være agurketid er vist blevet modbevist godt og grundigt – bortset fra de almindelige trakasserier mellem regering og opposition (Som godt nok har været lidt mere farverige end sædvanligt – og mere i tråd med almindelige globaliseringsproblemer) – så har Forskningsministeren barslet med sit svar på Højhastighedskomiteens udspil til at modernisere Danmark – 'Digitale veje til vækst', og erhvervslivet har debatteret behovet for udvidede bevillinger til grundforskningen, medens IT branchen har nedsat en 'tænketank', der i løbet af efteråret vil fremkomme med kreative ideer og forslag til at sætte fuld speed på digitaliseringen:

”DANSK IT har initieret projektet Danmark 3.0 for at give vores anbefalinger til en national digitaliseringsstrategi. En strategi, som kan blive afgørende for at fastholde og udbygge det danske velfærdssamfund, og hvor midlet er en effektiv og koordineret national udnyttelse af informationsteknologiens muligheder.” Vi afholdt det første møde sidste tirsdag – jeg ser frem til nogle konstruktive diskussioner.

Og de sidste dage har Novo og IBM blandet sig i debatten: Kim Østrup efterlyser egentlig IT-forskning – ikke mindst i IT-området, hvor han hævder at Danmark kun uddanner omkring 1/5 af de lande, der gør det bedst på IT-fronten (relativt målt, naturligvis. Vi kan ikke konkurrere i antal med Kina og Indien). Efter mange års samarbejde og diskussioner med Kim må jeg give ham ret; vi har en besynderlig uddannelsestradition i Danmark, at eet af de mest 'renlige' fag, der ikke kræver særlige fysiske anstrengelser, i den grad bliver fravalgt af kvinder, at vi mister 50% af de potentielle nye genier allerede i gymnasiet. Dertil kommer at den oprindelige Datalogi uddannelse blev etableret som uddannelsescenter for Regnecentralen, og mange formodentlig fortsat har et 'støvet' indtryk af hvad faget går ud på – eller rettere: hvad det kunne gå ud på.

Når vi ser på alle initiativerne ovenfor – Højhastighedskomiteen, Forskningsministeriet, Dansk IT, så peger alle på at en væsentlig del af den fremtidige indsats for at fremme IT brug, forskning og forståelse falder indenfor det offentliges sfærer: Velfærdsteknologi, sundhedsIT, digital forvaltning, brug af sociale netværker, borgerservice, samarbejde, internationalisering, uddannelse og e-Læring... alle disse emner falder indenfor det, som vi i daglig tale kalder e-Government.

Indtil i dag har kun CBS udbudt eGovernment som et fag. Men vi har brug for mange flere tilbud på mange flere uddannelsesinstitutioner for at få gang i det langsigtede forskningsmiljø, som Kim Østrup efterlyser. Det er en af grundene til at jeg har taget udfordringen op og starter e-Government som et fag på Masters-niveau på IT-Universitetet fra september. Emnet kræver tværfaglighed, og netop mastersuddannelsen på ITU er spændende, fordi rekrutteringsgrundlaget for de studerende er så bredt, at det bør kunne kaste lys over en række af de problemer, som vi i så rigeligt mål har kunne se i grænselandet mellem IT-emner, sociology, politologi – og de tilstødende discipliner som medicin, pædagogik, økonomi, management i videste forstand.

I faget vil vi tage diskussionen op om hvad man i dagspressen opfatter som 'conventional wisdom' og holde det op mod erfaringer fra en lang række cases i ud- som indland. Vi vil diskutere de såkaldte 'best-of-breed' årlige vurderinger og sammenligner af 'e-Readiness', modenhed, 'eService' og hvilke andre labels, der sættes på; Gennem praktisk anvendelse af nogle af de nyere teorier om netværksorganisationer og sociale netværker vil vi diskutere de mange såkaldte 'IT fiaskoer' – hvor det vil blive klart, at Danmark ikke er alene i Universet – Historien er fyldt med virkeligt markante og eksorbitante flops, og gennem analyser af forløbet heraf, er det mit håb at deltagerne bliver vaccineret mod at begå de mest oplagte fejltagelser ved igangsætning, styring og evaluering af offentlige IT-projekter.

Vi vil se på rollefordelingen og balancen mellem institutioner, stat, regioner, leverandører, borgere, brugere – og anvende nogle af metoderne til at analysere de nyere danske projekter og ideer.

Hvordan evaluerer man offentlige IT-projekter? Ja, det afhænger utroligt meget af det perspektiv, man anlægger – er det et nationalt, langsigtet perspektiv eller et traditionelt, kortsigtet perspektiv for at spare penge og medarbejdere? Vi vil diskutere værdibaseret porteføljestyring af mange IT-projekter – og hvordan man prioriterer mellem dem.

Web 2.0, sociale netværker har været længere under vejs i Danmark end i andre lande – vi vil diskutere muligheder og begrænsninger og se på gode og dårlige eksempler.

Nogle af problemstillingerne siges at skyldes de offentlige udbudsregler og at Danmark følger EU's regler i langt højere grad end andre lande. Vi vil se på IT udbudssystemer, vi vil forsøge at opstille og gennemføre et tænkt IT udbud.

Og vi vil diskutere de nye 'trends' – hvordan vil Cloud Computing påvirke e-Government? Hvilke krav til Identity Management og Privacy skal vi arbejde for og med? Hvordan påvirker globaliseringen og offentlige internationale samarbejder vores måde at tænke service på? Hvilken rolle spiller WEB 3.0 for udviklingen af offentlige IT-systemer?

Faget er tænkt som en 'Eye Opener' – og vil forhåbentligt give grundlag for studerende, der vil kaste sig over emnet og læse videre på PhD-niveau – alternativt benytte synspunkter og vurderingsmetoder til at indgå i ledelsesteams for nye offentlige IT-projekter, som kunder, som leverandører eller som brugere og kunder.