1. Information Technology Recordkeeping and Archiving in the Cloud: Is there a Silver Lining? Professor Sue McKemmish

2. Overview  What are the implications for recordkeeping and archiving of the rapid uptake of cloud computing?  What are records and archives? What is cloud computing?  Models and types of services  Benefits and risks  Australian case study –National Archives & Public Record Office Victoria  Checklist – evaluating and selecting services, assessing and managing risks, negotiating contracts  ISO 15489 Records Management Standard – draft provisions  Cloud for Europe initiative  The future: Archives-as-a-Service and Recordkeeping & Archiving 3.0 2

3. Records Information created, received and maintained as evidence and as an asset by an organization or a person, in pursuit of legal obligations or in the transaction of business (Standards Australia; Standards New Zealand. AS/NZ ISO 30300: 2013: Information and Documentation – Management Systems for Recordkeeping – Fundamentals and Vocabulary (ISO 30300: 2011 MOD). Sydney: Standard Australia, 2012; Wellington: Standards New Zealand, 2012). Archives are records of continuing value Multiple forms, media and formats Captured and stored in many places Increasingly managed and stored in “the cloud” 3

4. Cloud Computing The US National Institute of Standards and Technology (NIST) defines cloud computing as:  a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of resources (e.g., networks, servers, storage, applications and services) that can be dynamically configured to meet needs of multiple clients Benefits: Cost-savings from a pay-as-you-go business model – no need for large investments in software, platforms, infrastructure and in-house IT staff Accessible anywhere, any time – supporting a flexible and mobile workforce Can be scaled to meet demand and optimise resource use. 4

5. 5

6. Cloud Services 6

7. Recordkeeping Risks  security, privacy, integrity, authenticity, accessibility and digital continuity  commercial continuity  lack of transparency of many cloud service providers  degree of risk and possible consequences vary for different models and types of services  highest risks and most serious consequences associated with software and platform services in the public cloud  relatively low risks associated with infrastructure services  hybrid clouds optimise benefits and minimise risks associated with public clouds  risks associated with location of data stores and servers, and trans border data flows are the same regardless of the model or type of service. 7

8. 8

9. Australian Responses  The Australian Government will be a leader in the use of cloud services to achieve greater efficiency, generate greater value from ICT investment, deliver better services and support a more flexible [mobile] workforce. (AGIMO 2013)AGIMO 2013  Cloud computing poses both benefits and risks for Australian Government agencies. Gains in cost and efficiency need to be weighed up against the risks associated with privacy, security and records management (NAA 2011)NAA 2011 9

10. 10 Dual Role Regulation of current recordkeeping Preservation of government archives as collective memory and cultural heritage Long-term preservation of digital records depends on best practice current recordkeeping Case Study National Archives of Australia Public Record Office of Victoria

11. 11 Digital Continuity Vendor Lock-in Location and Jurisdiction Transparency Accountability Governance Rights in Records RK Functional Requirements Commercial Continuity

12. 12 Location & Jurisdiction Personal, security & confidential records Location & Jurisdiction Personal, security & confidential records

13. 13 Transparency Accountability Governance Applies to all records Transparency Accountability Governance Applies to all records Rights in Records Personal and confidential records Records subject to copyright and IP Rights in Records Personal and confidential records Records subject to copyright and IP

14. Presentation title14 Recordkeeping Requirements All records Recordkeeping Requirements All records

15. 28th February 2011Presentation title15 Digital Continuity Vendor Lock-in Commercial Continuity

16. 16 Revisions to ISO15489 Records Management (draft stage only) Focus on: Sustainability of service Controls over integrity of records Extractability of records and their metadata Contracts that define: Rights and responsibilities of the owner of the records, the users of the service and the provider of the service Requirements for submission, control, dissemination and security of records Working Party: “Impact Assessment of Distributed and Outsourced Platforms and Services Usage on Records Management and Archives”

17. EU Digital Agenda The ECP aims at driving the first steps towards better public procurement of cloud services in Europe, based on common definitions of requirements and possibly eventually going as far as joint procurement across borders … Pooling public requirements could bring higher efficiency and common sectoral requirements (e.g. eHealth, social care, assisted living, eGovernment services) would reduce costs and enable interoperability. The private sector would also benefit from higher quality services, more competition, rapid standardisation and better interoperability and market opportunities for high-tech SMEs (European Commission 2013).

18. 18 Postcustody 2.0 Archives-as-a-Service Archival community needs to be proactive “in the formation of the new, preservation-aware cloud services” Australian case study is an example of this approach. In the future? Whole-of-government preferred supplier & procurement arrangements for cloud computing Preferred suppliers compliant with requirements in jurisdiction of client organisations An EU-type Australian government cloud? Stančić, Hrvoje; Arian Rajh, Arian; Milošević, Ivor. "Archiving-as-a-Service". Influence of Cloud Computing on the Archival Theory and Practice. // The Memory of the World in the Digital Age: Digitization and Preservation / Duranti, Luciana ; Shaffer, Elizabeth (ed). UNESCO, 2013, 108-125.

19. 19 Somewhere beyond custody, in the archival multiverse, lies the vision of Recordkeeping & Archives 3.0, taking advantage of the benefits and opportunities of cloud computing to build regional, national, state and community archival clouds In this scenario the policies, standards, strategies, guidelines and tools being developed by archival authorities like the National Archives of Australia and Public Record Office of Victoria contribute to the development of broader requirements that embrace the recordkeeping and archiving needs of all those involved in community cloud partnerships. To realize this vision, recordkeeping and archiving communities need to take a pro-active approach, as clients, standard setters – even potential service providers themselves – to shaping cloud services, and the future of recordkeeping and archiving in the cloud. Recordkeeping & Archiving 3.0