If you have been at a recent Washington Capitals hockey game when the opponent scores a goal, you know the crowd routinely shouts out “Who cares!”

Last week, Steven VanRoekel, Federal CIO, released the long awaited OMB plan for the Federal Risk and Authorization Management Program, or FedRAMP; which reminds me to be thankful for pronounceable acronyms. The purpose of FedRAMP per the implementing OMB memorandum, is to “provide a cost-effective, risk-based approach for the adoption and use of cloud services”.

So were I a federal CIO, which I was, or an executive working for a provider to the Federal Government, which I am, what are the short- and long-term implications?

First, and most important, I think there are short- and long-term implications, which is not always the case with long awaited announcements and OMB produced memoranda.

However, I suggest the longer term implications tie more to the general topic of infrastructure rationalization than focusing specifically on the ever popular and impossible to avoid ongoing cloud frenzy.

It has long been my contention that while the IT focus in commercial organizations should be top-down to be most effective, in federal government it is the opposite: better off focused on a bottoms-up approach.

This difference reflects how funding, or revenue, is achieved.

In a commercial company revenue comes in from customers, is filtered through a sales organization and the decisions are controlled by executive leadership. IT leadership focuses on using the defined strategic goals to drive derived IT goals down into the rest of the organization.

In a government entity, funding comes through the appropriations process, and except in very rare circumstances, such as the Veterans Administration, is associated with the individual components that make up larger agencies or department, rather than with the overall mission of the department.

The real value of initial cloud implementations is they represent the next big step in allowing federal CIOs to get a handle on what IT provisioning is going on within the organizations.”

Because of this, the first hurdle for government CIOs is overall situation awareness; discovering what IT assets exist and figuring out how to put in place configuration management to keep track of those IT assets.

To just take one example, when OMB started pushing to consolidate data centers, it took months or longer to get an accurate inventory of how many data centers there were, let alone put together a plan to consolidate them.

Reducing costs is a reasonable goal to associate with cloud computing. Be warned that recent articles question whether cost savings will be large as some are articulating. See, for example, the discussion I participated in this last Friday on the Federal News Radio Countdown, hosted by Francis Rose.

The real value of initial cloud implementations is that they represent the next big step in allowing federal CIOs to get a handle on what IT provisioning is going on within the organizations. Every application that is moved to the cloud is one that now is visible to and can be managed and measured by the CIO. Consistent security approaches can be taken. And it is the inconsistencies, not whether an application is internally hosted or externally hosted, that lead to security weaknesses.

There are a few additional specifics from the OMB memorandum that I wanted to note.

First, the process still has some time before it will be put into place. The goal is to have the FedRAMP PMO, to be run by GSA, operational no later than 180 days from issuance. This follows interim steps including establishing formally the list of security controls, creating a Concept of Operations, and creating a charter for the Joint Authorization Board (run by DoD, DHS, and GSA) dealing with governance.

Second, it will interesting to see how robustly the effort will be funded over the next few years. Congress has not been consistently supportive of shared service implementations. From my stint at DOT, I remember the difficulties that OMB had keeping the various eGovernment initiatives sufficiently funded.

While outside the scope of this write-up, I contend that one reason that DoD continues to make progress in this area is because of the existence of a home, what I refer to as a “center of gravity”, for managing the resulting shared infrastructure, namely DISA. While I have nothing but the greatest admiration for Richard Spires and Casey Coleman, running shared services is not currently the primary mission of either DHS or GSA respectively.

Third, I found it interesting that both the CIO and the chief financial officer need to certify together the list of all cloud services that cannot meet FedRAMP security authorization requirements within their agency. The dividing line between what is expected from CIO’s and CFOs regarding program management is not always clear cut, and is made even less clear when the CIO has been folded underneath the CFO.

In April, 2009, I asked the question “Why are 42 or so different procurements now looking at clouds?” I was quoted as saying that I thought that instead cloud computing could be offered in a way … in which any federal agency can access a handful of major … contracts.”

And now a little over 2 ½ years later, we are only six months away from saying “You can.”

Daniel Mintz is chief operating officer of Powertek Corp. He served as CIO of the Department of Transportation from 2006-2009.

While I also consider the possibility of cost savings associated with Cloud Computing important, I believe other implications are more important in the long-term. I discuss a second one today, and will touch on two more in the next few blog entries.

When we start thinking about moving applications to the cloud it leads us to reconsider how we develop applications. This change in thinking has, as a foundation, the move to object oriented design, and has been encouraged by  a change in conceptual ownership. I talk about both of these in this post.

OBJECT ORIENTED DESIGN. First, I want to emphasize that I am far from an expert in software development, let alone object development, and all of the implications. As usual, however, this does not stop me from having opinions.

When I was a beginning programmer, when I actually had jobs that resulted in results as opposed to my current responsibilities to produce insubstantial policies and hard to measure roles as a manager or heaven forbid, a leader, computer programs were written functionally. That is if you were writing a payroll program you would consider the steps one took to do the payroll:

• Hire a person
• Enter the time for the week
• Process the payroll

And so forth.

In more recent years, the focus changed to objects. That is when designing that same payroll program you might start with what were the ‘objects’ that would be involved in the system:

• A person
• The personnel record
• The check

Where an object could be a ‘thing’ or a process. You would then work through what information that object might expose and/or what actions the object might do or have done to it.

Cloud Computing lends itself well to the concept of object oriented implementations. It is likely to be difficult to think through how to do something functionally in a cloud, e.g. how do you divide up the function between your desktop computer and the work being done remotely over the Internet. But it is not so difficult to think through putting some objects in one location and some objects in the other. While you are still left with the issue of how to find (“discover”) an object and how to get them to ‘talk’ that is send messages to each other, these are solvable problems.

While I am sure I am over simplifying the concept, the way I look at it this is the basis for what has now become Service Oriented Architecture (SOA).

If you consider the object as a service, that is, it provides a service to someone (or something), then SOA allows us to take a coherent approach to putting objects in the cloud and provides a discipline regarding how they interface.

OWNERSHIP. As important as how one develops software applications is the change in how organizations and developers look at the ownership of the result.

When something is developed in-house and implemented on the organization’s own computers in their own datacenter, there is a tendency to look inward for everything associated with the application. One is less likely to think about using external resources to optimize any of these activities.

However, when the application ends up partially or completely housed in a cloud, whether private or public, then the orientation for planning inevitably starts to focus on how to optimize the situation using at least some resources that are not under internal control. That is, it forces developers to think about the external provisioning.

Once one starts down that path, many additional options start to be under consideration.

What about using someone else’s services/objects to supplement my development? What would I have to do when designing and implementing my application to take advantage of such external resources?

Internet/cloud based providers have incentives to make this kind of interaction easier since this enhances their value-add. Mash-ups, http://en.wikipedia.org/wiki/Mashup_(web_application_hybrid), which can enable very creative solutions with significantly less development investment have become increasingly commonplace.

In summary, the second value-add of the movement to cloud is the change in approach to architecture of and implementation of applications.

I talk about and eventually will write about the movement from Ptolomaic, earth centered, to Copernican, sun centered, to Warholian, nothing centered, thought processes. This is the movement we are undergoing in application development, hastened by the move to the cloud.

What we design for today is not what will exist even two to three years in the future. The impact is only starting to be understood.

I have been part of a number of panels over the last few months which focused on the subject of Cloud Computing, the current state of the’art’, and as usual what barriers exist that need to be dealt with to make it easier to utilize. There certainly has been much written about it both pro and con and it remains a high-priority focus for the current Administrator and, in particular, Vivek Kundra, the Federal CIO.

For one of the graduate classes I am teaching this semester at the University of Maryland University College, the subject is touched upon as part of a broad look at technology changes and implications. The topic generated much comment by my students.

It seems to me that the subject starts from the wrong side of the discussion, the technology side. When the discussion turns to the impact, it starts at an important but not the most important concern, that of return-on-investment (ROI).

Today and in a number of future blog entries, I will talk about what I think are the current important issues associated with cloud computing. Today I start with what I perceive as a foundational issue, cost, but later in the week will move to what I believe are more important considerations and goals.

Note: I do not plan to rehash what cloud computing is, or is not, there are too many other write-ups that do this. Look at the National Institutes of Standards work on such definitions, I think it is pretty good.

SAVING MONEY. To me the least important, though I hasten to say not unimportant, goal of cloud computing is to reduce costs.

In the simplest sense, the provisioning of IT services costs money because of an overhead cost associated with buying computers and putting them somewhere as well as the operating costs of running them. When you spread that cost over more users then the cost per application usage goes down.

With cloud computing you have the potential, emphasis on the word potential, to achieve these savings by running multiple applications on the same computing equipment. This can be achieved when you use techniques to allow more than one application to run at the same time on the same computer increasing its utilization or when the peak levels of demand are different for each application, or both.

This much can be achieved by using what is called a private cloud, that is one that you run yourself. For organizations that have not centralized the provisioning of IT services, this one change can have a significant cost savings. The barriers to doing this are to some extent technical, it is necessary to gain experience in how to do this; but in large part cultural and organizational, it requires different groups within an organization to plan and work together.

Historically, computer usage in data centers is amazingly low, on average between 5 and 15 percent of capacity. By running multiple applications at once, using techniques such as virtualization, this capacity usage can usually be brought up to over 50% and often higher. This reduces the need for additional computing resources and cuts down on environmental costs such as cooling and power.

Moving to a more public cloud, which is one provided outside the organization, has the potential to achieve greater cost savings (maybe). Again looking at this in the simplest fashion, it spreads the overhead cost across still more users, with a public cloud perhaps in the thousands or more.

The other added advantage is that those organizations who have recognized that running data centers is not actually their core competency can out-source, currently a politically complex word, data center operations. On the other hand, organizations that do so need to develop a core competency of working with outside providers, which many organizations do not do.

It is interesting also to realize how many organizations want to move to externally provided IT resources because they feel they are too disorganized internally. This hope generally is not realized. There is an old saying that IT cannot organize a disorganized situation. I can promise you that outsourcing IT will not bring management controls to a situation where none currently exist. You first have to organize internally and only then look for outside provisioning. Electric power providers do not untangle the wiring in your house.

This last step, moving from an internally provided centralized IT provisioning process, private cloud, to an externally provisioned process, public cloud, is made still more complicated for Government due to security and privacy issues as well as fear of embarrassment issues; who needs to read in the Washington Post that your personnel system was hacked while sitting on some public provider; I speak from personal experience that testifying on the Hill about security issues is not why most people go into public service.

Having said that the first step, centralized provisioning, achieves a large percentage of the gain, and is worth working toward.

The other challenge associated with saving money is that many organizations do not do such a great job of tracking the costs which they are trying to reduce. Government organizations in particular often have in place rudimentary, or non-existent, cost accounting systems which keep track of all of the overhead associated with doing such work in-house. Thus the cost comparisons relate lower than actual internal costs against actual external costs. It is not a surprise that different organizations produce different conclusions.

I used to joke when I was at the US Department of Transportation that if you wanted to achieve a certain ROI I could help do so with 10 minutes and Excel.

To be continued …

In the Pentagon that joke morphed. Whenever someone wanted to get additional budget, the reason was to ‘Deal With China’. Well, in fact, maybe that is still true.

In technology today, the current budget justification phrase is ‘Cloud Computing’. Except in this case, exactly what Cloud Computing is or what it can do is even less clear than normal. On the other hand, that lack of clarity means there are lots and lots of meetings, seminars, and conferences that deal with trying to define Cloud Computing and provide advice on what to do about it.

In that context, I was on a panel Monday, May 3, that discussed Cloud Computing and the kinds of new skills that would be needed to support Cloud initiatives, http://events.1105govinfo.com/Events/Cloud-Computing-Summit-2010/Sessions/Monday/CC4.aspx.

I had three major themes.

My first theme was that people tended to mean one of a number of radically different concepts under the general topic of Cloud Computing.

Many actually were talking about consolidating multiple applications on a fewer number of servers – virtualization. It was this step that accomplished much of the savings, if there were to be any, from Cloud Computing. In fact, it was certainly possible to do server consolidation and application virtualization without actually implementing anything that actually was ‘in the Cloud’.

Others used the term Cloud Computing to putting applications on the Internet; in the web. This approach is also often described as Service Oriented Architecture, SOA. I am probably not capturing all of the nuances of SOA but to me this basically means taking a program which traditionally was self-contained and isolated and treating it like a service which others could access or integrate into a larger set of combined services. Doing so efficiently requires writing programs a bit differently, adding the ability for a service to be discovered, that is found by others, and adding the capability to expose aspects of the service to others.

SOA in the end requires not just technology change but also cultural change. To be most effective it requires an organization to be much more collegial and standards based in how it designs and develops software.

Finally, some people meant having applications, or aspects of an application such as the platform it runs on, provided externally; that is, through a cloud. The big challenge here is that when using only internal resources it is possible, though in my opinion unwise, to get by without taking the time or applying the necessary rigor to develop service level agreements (SLA’s) for all of the aspects of your system.

You can tell if people are working hard by peering over their shoulders. You can measure performance by users calling and yelling at you, and dynamically reallocate resources by yelling at someone down the hall.

However, when you move a resource out of your internal operation it becomes absolutely critical to develop robust SLA’s to manage your provider’s performance and define your expectations. It turns out that this is very hard to do especially in areas that historically have not been defined in very precise terms such as security or privacy. This is, again in my opinion, one of the major underlying reasons why there is such resistance to moving applications to the cloud.

My second theme is derived from that last point. It was always useful to create business architecture’s to drive technology development. While it might be inefficient, it was historically possible when everything was accomplish internally to ignore that benefit and instead do what was in effect the opposite approach, develop technology solutions that ended up impacting the business.

However if an organization wants to move to the not-well-defined cloud, it becomes necessary to define the business architecture’s and business goals associated with the applications. Without that definition, the likelihood of achieving the promised benefits associated with Cloud Computing are highly unlikely to be achieved.

My third theme was that the major human capital impacts were:

• Technical and operational IT assets were likely over time to move to external service providers and away from user organizations
• The demands on procurement and legal professionals were going to change as their responsibilities became more and more ‘horizontal’ between organizations and their providers of service and less ‘vertical’ supporting internal hierarchical organizations
• The importance of technical staff who also were comfortable with business issues would dramatically increase.

Federal Computer Week, http://fcw.com/Articles/2010/05/04/cloud-computing-implications.aspx, covered the panel.

“When I use a word,” Humpty Dumpty said, in a rather scornful tone, “it means just what I choose it to mean – neither more nor less.”
“The question is,” said Alice, “whether you can make words mean so many different things.”
“The question is,” said Humpty Dumpty, “which is to be master – that’s all.”

And thus it is with Cloud Computing. The question on the table is whether we are to be the master of the Cloud Computing concept and what it means to us as practitioners and/or users or whether we will treat it as magic providing whatever value we have need of during that moment in time.

For those of you, who are willing to brave Washington during the Nuclear Security Summit, April 13, I encourage you to drop by a Digital Government Institute sponsored event called “Use Secure Cloud Today to Optimize Customer Experiences”, being held at the Willard Hotel, from 8:30am to 1pm; registration opens at 7:45am.

I was asked to be on a panel at the conference starting at 10:30 entitled Meeting Customer Expectations In the Cloud, Practical Experience”. The panel will be hosted by Chris Dorobek, the ever popular host of the Federal News Radio afternoon show The Daily Debrief, and is scheduled to have:

• Gil Guillen from the Office of Electronic Services at the Social Security Administration;
• Laef Olson, CIO, RightNow Technologies;
• Thom Rubel, Vice President, IDC Government Insights; and
• Joe Thele, Director Air Force Personnel Operations Agency.

Based on the last phone call interaction with the other panelists Chris will lead us through three sub-topics:

• Current status,
• Thoughts on why one should consider ‘doing’ Cloud Computing, and
• Examples of lessons learned and how to deal with the barriers that tend to get in the way when doing so.

It should be fun and informative.

You can get further information at:

http://www.digitalgovernment.com/Events/Conferences/Use-Secure-Cloud-Today-to-Optimize-Customer-Experiences.shtml.

And as an added benefit, you can go out before or after and demonstrate for or against the Summit activities.

This year ELC is being held October 25-27 in Williamsburg, VA, http://www.actgov.org/events/ExecutiveLeadership/ELC%202009/Pages/default.aspx.

On Monday, October 26, most of the day is taken up by panels organized into four tracks. I had the privilege to chair along with Eric Won of GSA, one of the tracks focused on Infrastructure and Cloud Computing.

This post will provide an overview of what we intended to accomplish during the course of the track and thus why we made the decisions we made in creating the panels. My discussion at the beginning of the track will in large part echo what I write here, subject to any suggestions made by my vast reading audience.

WHAT IS IT, WHO CARES. There has been a lot of publicity and discussion already about Cloud Computing, what it is, what it isn’t, even if it is or not. As someone once pointed out to me, we went through the Industrial Revolution which was not well-defined at the time and it still happened. The reality is that NIST has created a pretty good working definition which I like (and more importantly GSA likes; a link to version 1.5 can be found here http://csrc.nist.gov/groups/SNS/cloud-computing/index.html, it has been given a high-priority by the current Administration, and many pilots are in process or soon to begin.

We decided to deal with four issues:

• How will this affect what is currently in-place and operational
• What are the institutional hurdles that will need to be dealt with to make success, however we define success, more likely
• How will the classical Government oversight functions measure cloud implementations
• What lessons learned are already available based on real-world examples

INTRODUCTION. In addition to these subjects, we felt that there were still a significant number of people who have never actually seen how easy it is to instantiate a server based in a cloud (which is easier than porting an already running application to a cloud). Therefore during the introduction we will use an environment that JPL, one of the panelists from the Real-World Examples panel (panel 4), has in place and instantiate two servers.

Dave Wennergren, the DoD Deputy CIO, and I will be providing an overview of the day. I will focus on the logistics and panel details. Dave will give an overview of his take on cloud computing in the Government.

PANEL 1, SHARED SERVICES, LOBS, AND MOVING TO THE CLOUD. Who can remember that long-ago time when the focus was creating shared services that would provide relatively centralized provisioning of capabilities to the Federal Government. Oh, right, that was 2008.

In reality as the current Administration has said the cloud journey is, in fact, that, a journey. And it is a journey that will take some time to travel along.

Where are the current Lines of Business focused right now, what is their thinking about the next few years for their offerings, and how are they thinking about cloud computing?

John Marshall, the Vice President, of the CGI Global Sector is moderating a panel with Doug Bourgeois, Director of the National Business Center, one of the most successful government shared operations, Adam Goldberg, Chief, Financial Analysis and Systems Branch, Office of Federal Financial Management, OMB, Mike Hill, VP, Enterprise Initiatives, IBM, and Jim Williams, Commissioner, Federal Acquisition Service, GSA.

PANEL 2, CXO PANEL, HURDLES & OPPORTUNITIES. This and panel 3 are very exciting for me, since we were able to have a significant number of non-IT functions represented. One of the values of ELC is the opportunity to reach outside of our ‘normal’ space.

The panel looks at the kinds of issues that are associated with cloud computing implementation. Having been lucky enough to be part of some of the planning discussions, I can honestly say that if the actual panel is as informative and stimulating as those conversations, it will be very enjoyable and interesting.

The panel is moderated by Casey Coleman, the GSA CIO, and the designated focal point for Cloud Computing for the Federal Government and includes Tom Sharpe, Senior Procurement Executive, Department of the Treasury, Susan Swart, the CIO of the Department of State, Patti Titus, CISO for Unisys Federal Systems and a former CISO at DHS, and Kathleen Turco, CFO for GSA.

PANEL 3, OVERSIGHT.  Federal CIO’s get much help and advice when implementing the many regulatory and legal requirements associated with their job responsibilities. How they are measured by these various oversight functions impacts CIO behavior more than many people realize. We have put together on this panel many of the functions that provide internal, program office, or external oversight to discuss how they are thinking of approaching cloud implementations.

The panel is moderated by Mary Ellen Condon, Principal, Assurance & Resilance, Booz Allen Hamilton, Rebecca Leng, Inspector General’s office, Department of Transportation, Ron Ross, Project Leader, Federal Information Security Management Act (FISMA) Implementation Project, NIST, Greg Silshusen, Director, Information Security Issues, GAO, and Gary Winkler, Program Executive Officer, Enterprise Information Systems, Department of the Army.

PANEL 4, REAL-WORLD EXAMPLES. Images of locking the panelists in a house until they instantiate large applications in the cloud, with the audience voting one panelist off each week have popped up more often in the last few weeks leading to ELC; perhaps lack of sleep has this impact.

The goal of this panel is to look at actual experiences that the panelists have encountered and to look at some of the early lessons learned.

The moderator for the panel is Pete Tseronis, the Dputy Associate CIO, Department of Energy and Chair of the Cloud Advisory Council reporting to Casey Coleman. The panelists include Henry Sienkiewicz, Technical Program Director for DISA, Tom Soderstrom, CTO, for NASA JPL, Susie Adams, CTO, Microsoft, and Pieter Poll, CTO, Qwest.