CIOs speak out on cloud email

Australian chief information officers have spoken out about their experiences after installing cloud-based email solutions from Google and Microsoft as opposed to systems hosted within the company.

Financial services group Mortgage Choice last year switched about 1000 users from its existing Lotus Notes platform to Gmail. The group's CIO Neil Rose-Innes has been positive about the company's move, although he admitted cloud email might not be for everyone.

"It's not necessarily going to suit every organisation, but every CIO should be looking at opportunities to trial or pilot cloud-based or web-delivered solutions," he said in a recent interview. "That's where the industry is going."

Mortgage Choice made the switch after a six-month evaluation trial of Gmail. The company broadly operates on a franchise model, with the head office providing line of business applications out to staff in the field.

Rose-Innes said the company "obviously" found things that were of interest to it in the due diligence process, but at the end of the trial it determined that it suited the company's needs.

"The decision for us was very clear," he said. "The benefit that it delivered in the short and long term is evident — both from an end user [point of view], as well as reduced support overhead, less in-house infrastructure and so on ... It's now an enterprise-grade solution, in my view."

Despite the radical change in technology as Mortgage Choice shifted from a desktop email suite like Lotus Notes to a cloud solution like Gmail, Rose-McInnes says the shift to Gmail was actually less about the technological migration itself and more about educating users about how it worked.

"We had a huge focus on the change management piece," he said. "It's understanding that users were going from a client install of a significantly mature enterprise-grade tool that had a million features of which you use seven ... [to Gmail, which has] 127 features that are most likely to be useful to you on an ongoing basis."

It's a similar situation at Sydney University, which last year migrated some 46,000 students onto Microsoft's Live@edu platform.

In a recent interview, CIO Bruce Meikle said that on the whole the university's migration went "really well". "With a large student base you will always get some queries and complaints, but in terms of a transition, for us it was really smooth," he said.

"The students really are getting a significantly better service than we had been offering. For us to offer that level of infrastructure, storage and so on would be kind of prohibitive."

Sydney Uni didn't offer to transfer students' archived email across to the new platform, so the biggest impact it saw from an IT perspective was the need to provision tens of thousands of accounts, using its student database.

"But using our identity management system, it was not too difficult," says Meikle. "You can reasonably well automate the switch-over. Now, as students enrol, their accounts are automatically created for them in the cloud."

Meikle said that organisations moving to a new email platform had to "seriously consider" a cloud option, although those looking to upgrade an existing platform wouldn't necessarily.

Addressing the downside

Both CIOs acknowledged there had been questions about issues like data security and privacy in the cloud, in addition to the debate about where the email data was actually stored. But these issues, they said, could be worked through.

"In our case the data is not in Singapore, it's in the US," said Meikle, noting the university had received "the usual questions about the US Patriot Act" and so on.

However, the CIO pointed out that in Sydney University's case, the email data was a service offered by the university to students and subject to a reasonable use policy anyway. "If you were going to do something [illegal], surely you wouldn't use something that was so clearly identifiable to you," he said, adding that many students used the free Hotmail or Gmail platforms for their private email anyway — which have the same questions around offshore storage.

Mortgage Choice's Rose-Innes said he has had conversations with other CIOs about cloud email. "Some of the individuals sitting around the table said 'It just doesn't work for us'," he says, noting they had privacy issues with where email was stored.

However, the CIO said privacy worries were usually more a problem "in concept than reality".

Mortgage Choice's contract with Google states that all the data belongs to Mortgage Choice and could only be released under subpoena by the US Government, according to Rose-Innes. "Global organisations have intellectual property and data floating around the globe anyway," he says. "I'm not sure that it's much of an issue — maybe an issue for a federal government or a state government."

Rose-Innes saw the decision to move to Gmail as a commercial decision, and he acknowledged that all commercial decisions have upsides — but also potential risks.

He said the risk of data leakage through the cloud email platform was "fairly high" over a long period of time, but the impact of that over a long period would be very small.

"It's really a commercial decision. In every business, you need to take some form of commercial risk," he said.

Rose-Innes also pointed out that a provider like Google would do "everything possible" to avoid data breaches, as it would affect their business, and that because of its scale, Google had much deeper expertise in security than Mortgage Choice's in-house staff would be able to provide.

Another question was to what extent the email data hosted with Microsoft or Google needs to be backed up, and how that process would take place.

Rose-Innes said Google doesn't "back-up" data precisely — instead the data is replicated live across multiple servers. "There is never a need for recovery because it's always online," he says. "Google's approach is that they don't ever delete anything; it's always available. The backup issue is not an issue for us at all."

Mortgage Choice's CIO also pointed out the Google Message Discovery service, which allows users to access even deleted email for up to 10 years afterwards. "It gives you access to anything," he says.