Google Apps Contract In LA Hits Security Headwind

The City of Los Angeles faces worries about privacy and security as it considers moving to Google Apps.
Google says that government agencies on all levels are considering cloud computing as an option. "We're excited that Los Angeles is considering joining other cities like Washington, D.C. and Seattle who have chosen cloud computing for their technology solutions," a spokesperson said in an e-mail. "Hosted software is designed to be extremely reliable, safe, and secure."

According to the City's report, the City's Information Technology Agency (ITA) "has stated that the level of security for City data will be higher under the proposed contract than is currently the case."

Nonetheless, the LAPD and the City Attorney have a considerable amount of highly sensitive information. The ITA believes that document confidentiality can be maintained through enterprise encryption options available through Google.

Rick Gordon, managing director of the Civitas Group, a security consulting firm, has concerns about lack of a reliable audit standard, data lock-in, and Google's opacity regarding its internal data security procedures. He characterizes the City report as "hand-waving at its worst."

"While the City will audit the service provider, neither has articulated a reliable standard to which the provider will be audited," he said in an e-mail. "More troubling is that LA will rely on the contract winner to help define a security standard -- an incestuous practice. Rather than having the provider define the security itself, the City should be looking to established third-party standards that hold the provider accountable to a reasonable level of security."

Concerns about lock-in, however, aren't exclusive to Google. According to the City's report, the LAPD currently uses 1,200 Microsoft Access databases and until Google offers an alternative that can import the data from Access, the City will have to continuing to support Access.

Chances are, however, security and privacy worries will be addressed to the satisfaction of most stakeholders. The Obama administration is specifically promoting cloud computing as a major government initiative to save money and better serve users of government systems.

With Seattle and Washington, D.C. already committed to cloud computing, and Los Angeles on the verge of doing the same, further federal, state, and local conversions to the cloud seem likely to follow.

InformationWeek and have published a report on data-centric protection. Download the report here (registration required).