U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

75–311 PDF 2012

CLOUD COMPUTING: AN OVERVIEW OF THE TECHNOLOGY AND THE ISSUES FACING AMERICAN 

INNOVATORS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INTELLECTUAL PROPERTY, 

COMPETITION, AND THE INTERNET 

OF THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

SECOND SESSION 

JULY 25, 2012 

Serial No. 112–122 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 

(II) 

COMMITTEE ON THE JUDICIARY 

LAMAR SMITH, Texas, Chairman 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

ELTON GALLEGLY, California 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

STEVE CHABOT, Ohio 

DARRELL E. ISSA, California 

MIKE PENCE, Indiana 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TIM GRIFFIN, Arkansas 

TOM MARINO, Pennsylvania 

TREY GOWDY, South Carolina 

DENNIS ROSS, Florida 

SANDY ADAMS, Florida 

BEN QUAYLE, Arizona 

MARK AMODEI, Nevada 

JOHN CONYERS, JR., Michigan 

HOWARD L. BERMAN, California 

JERROLD NADLER, New York 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

MELVIN L. WATT, North Carolina 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO R. PIERLUISI, Puerto Rico 

MIKE QUIGLEY, Illinois 

JUDY CHU, California 

TED DEUTCH, Florida 

LINDA T. SA ́ NCHEZ, California 

JARED POLIS, Colorado 

RICHARD HERTLING, Staff Director and Chief Counsel 

PERRY APELBAUM, Minority Staff Director and Chief Counsel 

SUBCOMMITTEE ON INTELLECTUAL PROPERTY, COMPETITION, AND THE INTERNET

BOB GOODLATTE, Virginia, Chairman 

BEN QUAYLE, Arizona, Vice-Chairman 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

STEVE CHABOT, Ohio 

DARRELL E. ISSA, California 

MIKE PENCE, Indiana 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TIM GRIFFIN, Arkansas 

TOM MARINO, Pennsylvania 

SANDY ADAMS, Florida 

MARK AMODEI, Nevada 

MELVIN L. WATT, North Carolina 

JOHN CONYERS, JR., Michigan 

HOWARD L. BERMAN, California 

JUDY CHU, California 

TED DEUTCH, Florida 

LINDA T. SA ́ NCHEZ, California 

JERROLD NADLER, New York 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

BLAINE MERRITT, Chief Counsel 

STEPHANIE MOORE, Minority Counsel 

(III) 

C O N T E N T S 

JULY 25, 2012 

Page 

OPENING STATEMENTS 

The Honorable Bob Goodlatte, a Representative in Congress from the State 

of Virginia, and Chairman, Subcommittee on Intellectual Property, Competition, and the Internet .................................................................................... 1 

The Honorable Lamar Smith, a Representative in Congress from the State 

of Texas, and Chairman, Committee on the Judiciary ..................................... 3 

WITNESSES 

Robert W. Holleyman, II, President and Chief Executive Officer, Business 

Software Alliance (BSA) 

Oral Testimony ..................................................................................................... 6 

Prepared Statement ............................................................................................. 8 

Justin Freeman, Corporate Counsel, Rackspace US, Inc. 

Oral Testimony ..................................................................................................... 15 

Prepared Statement ............................................................................................. 17 

Daniel Chenok, Executive Director, Center for the Business of Government, 

International Business Machines Corporation (IBM) 

Oral Testimony ..................................................................................................... 27 

Prepared Statement ............................................................................................. 28 

Daniel Castro, Senior Analyst, Information Technology and Innovation Foundation (ITIF) 

Oral Testimony ..................................................................................................... 33 

Prepared Statement ............................................................................................. 35 

LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING 

Prepared Statement of the Honorable Melvin L. Watt, a Representative in 

Congress from the State of North Carolina, and Ranking Member, Subcommittee on Intellectual Property, Competition, and the Internet ............... 2 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Letter from Robert W. Holleyman, II, President & Chief Executive Officer, 

Business Software Alliance (BSA) ...................................................................... 64 

Supplemental Material submitted by Robert W. Holleyman, II, President 

& Chief Executive Officer, Business Software Alliance (BSA) ......................... 67 

Report by TechAmerica Foundation ....................................................................... 114 

Prepared Statement of William Weber, General Counsel, Cbeyond, Inc. ........... 149 

(IV) 

OFFICIAL HEARING RECORD 

MATERIAL SUBMITTED FOR THE HEARING RECORD BUT NOT REPRINTED

111th Congress hearing entitled ECPA Reform and the Revolution in Cloud Computing, September 23, 2010, Subcommittee on the Constitution, Civil Rights, and 

Civil Liberties, Committee on the Judiciary, submitted by the Honorable Melvin 

L. Watt, a Representative in Congress from the State of North Carolina, and 

Ranking Member, Subcommittee on Intellectual Property, Competition, and the 

Internet. The hearing is not reprinted in this record but is available at the Committee and can be accessed at: 

http://judiciary.house.gov/hearings/printers/111th/111-149—58409.PDF. 

(1) 

CLOUD COMPUTING: AN OVERVIEW OF THE 

TECHNOLOGY AND THE ISSUES FACING 

AMERICAN INNOVATORS 

WEDNESDAY, JULY 25, 2012 

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON INTELLECTUAL PROPERTY,

COMPETITION, AND THE INTERNET, 

COMMITTEE ON THE JUDICIARY, 

Washington, DC. 

The Subcommittee met, pursuant to call, at 12:10 p.m., in room 

2141, Rayburn Office Building, the Honorable Bob Goodlatte 

(Chairman of the Subcommittee) presiding. 

Present: Representatives Goodlatte, Smith, Marino, Watt, Nadler, and Lofgren. 

Staff present: (Majority) Vishal Amin, Counsel; Olivia Lee, Clerk; 

and (Minority) Stephanie Moore, Subcommittee Chief Counsel. 

Mr. GOODLATTE. Good afternoon. The Subcommittee of Intellectual Property, Competition, and the Internet will come to order. 

And I will recognize myself for an opening statement. 

Today we are holding a hearing on cloud computing. Cloud computing represents a fundamental shift in the delivery of services, 

software, and data storage. The move toward cloud services helps 

lower the barriers to entry and democratizes access to technology 

for small- and medium-sized businesses. 

Companies no longer need to purchase or build server farms or 

have an IT team to deal with security issues and hardware malfunctions. The cloud brings together reduced costs, device and location independence, reliability, scalability, security, and performance. 

But with new technology come new issues that deal with security, privacy, and market access. As more software becomes cloud 

or Internet-based, cybersecurity and privacy issues become intertwined. 

To set the stage for today’s hearing, we have witnesses that can 

speak to the key service areas of cloud computing. These include 

infrastructure, platform, and software. Infrastructure as a service 

refers to storage where companies offer dedicated or share servers 

to customers to store their information. Platform as a service 

means that a company is delivering an operating system that allows others to build new apps on top of their system. The third flavor of cloud refers to software as a service. Here the software is installed in the cloud, eliminating the need for physical copies of softVerDate Aug 31 2005 16:02 Sep 07, 2012 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6601 H:\WORK\IP\072512\75311.000 HJUD1 PsN: DOUGA
2 

ware. Updates occur seamlessly, and customers access the software 

through the Internet. 

But apart from the overall technology, there are issues that companies in this industry are concerned about, and there are issues 

that our customers are concerned about. In the market access 

arena, cloud companies need to be able to operate globally, and restrictions placed on cloud providers in particular countries can effectively limit market access and prevent services from being delivered to and adopted by consumers. 

There are also issues dealing with international operability. As 

cloud computing services take hold, it is important for there to be 

clear rules of the road when it comes to industry standards and 

international rules. Cloud companies and customers also have a 

strong interest in ensuring that the privacy and security of the 

data stored and used on their systems is secure. 

For consumers, it means they want to know how their personal 

information is being used and protected. For companies, the concern is on security, ensuring that company trade secrets and business information is adequately protected and easily accessible in 

the cloud. 

I look forward to hearing from all of our witnesses on these and 

other issues that they are seeing, and also engage in a discussion 

on the issues that cloud computing faces going forward. We need 

to ensure that as this new American technology sector grows, it is 

able to compete on a level playing field abroad and to promote U.S. 

innovation technology and jobs. 

And with that, it is my pleasure to recognize the Ranking Member, the gentleman from North Carolina, Mr. Watt. 

Mr. WATT. Thank you, Mr. Chairman, and I think the Chairman 

has sufficiently outlined the range of issues that are, I think, important to this hearing. It is an important hearing about things in 

the cloud, which some people say that is where I always am. So I 

want to figure out what is going on up there. 

I think I will just submit my statement for the record. I will have 

some questions about how we can incentivize competition in the 

cloud. But except for that, I think the Chairman has outlined the 

issues. So I will submit my statement for the record. 

I know we have got a very short time window that we are operating in, and I think hearing the witnesses is a lot more important 

than hearing me. So I will yield back. 

Mr. GOODLATTE. I thank the gentleman, and without objection, 

his entire statement will be made a part of the record. 

[The prepared statement of Mr. Watt follows:] 

Prepared Statement of the Honorable Melvin L. Watt, a Representative in 

Congress from the State of North Carolina, and Ranking Member, Subcommittee on Intellectual Property, Competition, and the Internet 

Thank you, Mr. Goodlatte. 

I will be brief. This hearing promises to cover a full range of issues involved with 

cloud computing. For many consumers, migration to the cloud has been driven by 

fast broadband connections, low-cost mobile devices and a mobile population that expects access to data and applications anywhere and anytime. This generation has 

become accustomed to the luxury of never having to delete an e-mail or document 

because of the ‘‘unlimited’’ and safe storage capabilities cloud computing affords. Organizations, including start-ups, are also embracing cloud computing because of the 

3 

flexibility and agility it provides. A business, for example, can scale up or down its 

information technology ‘‘IT’’ usage according to demand with no long term commitments and no high imbedded costs. 

These extraordinary benefits to companies and individuals alike also come with 

increased concerns about reliability, security and privacy. The power outages earlier 

this month at Amazon’s Web Services datacenter in North Virginia due to fierce 

thunderstorms throughout the Mid-Atlantic region of the U.S. raise lingering concerns about the reliability of cloud services. Two weeks later, the District’s Metro 

subway system experienced a mysterious software failure that has been widely subject to speculation that its data center was hacked. As the migration to the cloud 

continues, companies must take care to ensure the security of their systems on several levels. 

There are multiple layers of privacy concerns as well. Although I am sympathetic 

to the barriers companies are facing internationally due to other countries’ perceptions of our privacy laws, I am more concerned with the consumer’s right to privacy 

within the cloud. While I continue to believe that consumer privacy is paramount, 

the cloud offers new and innovative ways for the technologically savvy criminal to 

exploit the cloud for nefarious purposes. The ‘‘Backpage’’ prostitution scandal with 

Craigslist is just one example. The cloud must develop with caution to ensure that 

illegality does not flourish within the cloud, and Congress should update the Electronic Communications Protection Act (ECPA) to provide clear guidance on when 

and how law enforcement is entitled to access otherwise private data and communications. 

Finally, one area that I do not think has been given enough attention is competition in the cloud computing industry. Although news accounts suggest that competition is currently robust, there are concerns that it may be changing. I am interested 

in hearing more in this area—how we ensure continued competition and lower costs 

to businesses and consumers. 

With that, Mr. Chairman, I yield back. 

Mr. GOODLATTE. And it is now my pleasure to recognize the 

Chairman of the Judiciary Committee, the gentleman from Texas, 

Mr. Smith. 

Mr. SMITH. Thank you, Mr. Chairman. I just want to point out 

to those who are present that I believe this is the first time this 

Subcommittee or any Committee has had a hearing on this particular subject. And I think that, Mr. Chairman, that is to your 

credit. This is an important subject and an important area of tech 

that is going to do nothing but increase in the future. 

I have a short opening statement, and then we will get on to the 

panelists. 

America’s economic success has been built on innovation. Cloud 

computing can transform everything from business operations, data 

storage, and analysis to the delivery of software and services to 

businesses and consumers alike. The cloud industry is growing rapidly. Wall Street Journal reported that technology cloud services 

worldwide had $16 billion in revenue in 2009, and cloud service 

revenue is expected to double this year and hit $73 billion by 2015. 

Because cloud providers can offer more robust data services at a 

lower cost than would be possible for a company to replicate for 

itself, the move to the cloud will help companies reduce information 

technology costs and add to their technical capabilities. 

But as these new technologies and products develop, it is clear 

that certain foreign governments have taken steps to disadvantage 

American cloud companies by imposing barriers to market access. 

Some of the barriers include restrictive regulations or policies that 

4 

*The hearing submitted by Mr. Watt, entitled ECPA Reform and the Revolution in Cloud 

Computing, is not reprinted in this hearing record but is available at the Committee and can 

be accessed at http://judiciary.house.gov/hearings/printers/111th/111-149—58409.PDF. 

mandate the use of certain technologies or require a cloud service 

to be placed in country as a condition of doing business. 

Cloud computing relies on the seamless flow of data across borders and international interoperability. Unfortunately, some countries have adopted rules that limit the specific types of data that 

can leave their borders, and have put in place restrictive regulatory 

frameworks. 

Some countries also have spread deliberate misinformation about 

U.S. laws, like the PATRIOT Act, saying that it negatively affects 

the security and privacy protections that U.S. cloud providers offer 

compared to European providers. These actions hurt the competitiveness of American companies and cost Americans jobs. 

Today’s witness panel represents a range of cloud services, and 

I am pleased that Rackspace is here today. They are a San Antonio, Texas-based company that has operations throughout the 

world. Founded in the late 1990’s, Rackspace now has nearly half 

of the Fortune 100 as clients. They provide cloud computing services for computing, cloud files for storage, and cloud applications 

for e-mail collaboration and file backups. They also manage webbased IT systems for small-, medium-, and large-sized business, 

and offers scalable services depending on its customers’ needs. 

Though the technology of cloud computing is new, the issues are 

not. As the U.S. government develops domestic policies and our 

policies with our international trading partners, we need to ensure 

that American innovators are treated fairly. 

Thank you, Mr. Chairman, and I will yield back. 

Mr. GOODLATTE. I thank the Chairman. 

Mr. WATT. Mr. Chairman? 

Mr. GOODLATTE. The gentleman from North Carolina is recognized. 

Mr. WATT. I just wanted to make one minor correction to what 

Chairman Smith said. There was a hearing on Electronic Communications Protection Act reform and cloud computing. It was done 

September 23, 2010, by Jerry Nadler’s Subcommittee, the Subcommittee on the Constitution of this Committee. And so technically we have not had a hearing specifically on the cloud, but this 

was an aspect of it, so I will submit the record of that hearing with 

unanimous consent just so it will all be part of the record. 

Mr. GOODLATTE. Without objection, the noting of the previous 

hearing in the Constitution Subcommittee will be duly noted.* 

Without objection, other Members’ opening statements will be 

made a part of the record. 

Mr. SMITH. I said this was the first time this Subcommittee had 

had such a hearing on this—— 

Mr. WATT. Or any Committee. That is where you went awry. But 

I acknowledge that technically you were probably—— 

Mr. SMITH. Let us not waste any more time on that. 

Mr. GOODLATTE. We will be pleased to begin the first hearing on 

cloud computing of this Subcommittee by hearing from our witnesses. We have a very distinguished panel of witnesses today. 

5 

Each of the witnesses’ written statements will be entered into 

the record in its entirety, so I ask that each witness summarize his 

testimony in 5 minutes or less. To help you stay within that time, 

there is a timing light on your table. When the light switches from 

green to yellow, you will have 1 minute to conclude your testimony. 

When the light turns red, it signals that the witness’ 5 minutes 

have expired. 

And as is the custom of this Subcommittee, before I introduce the 

witnesses, I would like them to stand and be sworn. 

[Witnesses sworn.] 

Mr. GOODLATTE. Thank you very much, and please be seated. 

Our first witness is known to and a good friend of many Members of the Judiciary Committee, Mr. Robert Holleyman. He serves 

as the President and CEO of the Business Software Alliance. He 

has headed BSA since 1990, expanding their operations to more 

than 80 countries and launched 13 foreign offices in addition to 

their D.C. headquarters. 

Mr. Holleyman has been named one of the 50 most influential 

people in the intellectual property world by the international magazine Managing IP. He was also named by the Washington Post as 

one of the key players in the U.S. government’s cybersecurity efforts for his work on behalf of industry on national cybersecurity 

policy. 

Before joining BSA, Mr. Holleyman served as counsel in the U.S. 

Senate and as an attorney with a leading law firm in Houston, 

Texas. He earned his Bachelor of Arts degree at Trinity University 

in San Antonio, Texas, and his Juris Doctor from Louisiana State 

University Law Center in Baton Rouge. He also completed the Executive Management Program at the Stamford Graduate School of 

Business. 

And it is my pleasure to turn to the Chairman of the Committee 

on the Judiciary, Mr. Smith, to recognize and introduce our second 

witness. 

Mr. SMITH. Thank you again, Mr. Chairman. I am happy to introduce Mr. Justin Freeman, Corporate Counsel of Rackspace 

Hosting based in San Antonio. 

Rackspace, founded in 1998, has grown into a multinational company with operations spanning the globe. They provide cloud computing services and manage web-based IT systems for businesses 

of all sizes. 

Mr. Freeman is part of Rackspace’s legal team and deals primarily with the rapidly expanding field of cloud computing. He represents Rackspace in technically complex enterprise transaction 

agreements, leads product review and development efforts, and directs public policy matters with a focus on cloud computing security 

and privacy issues. He has an extensive technical background, including specialization in network security systems and patient 

care, critical healthcare IT systems. 

Mr. Freeman received his law degree from Southern Methodist 

University School of Law and his undergraduate degree from the 

University of Texas at Austin. We are pleased he is here today to 

talk more about this important and growing sector of our tech economy. Welcome, Mr. Freeman. 

6 

Mr. GOODLATTE. Mr. Freeman, welcome. And, Mr. Chenok, welcome. Our fourth witness is—third witness is Mr. Dan Chenok, Executive Director of the IBM Center for the Business of Government. 

The center connects public management research with practice, 

helping executives improve the effectiveness of government with 

practical ideas, which has included several center reports that address cloud computing. 

Mr. Chenok also serves as the Chair of the Federal Information 

Security and Advisory Board, which has explored numerous issues 

where security and privacy intersect with cloud computing. 

Before joining IBM, he was a Senior Vice President for Civilian 

Operations with Pragmatics. He also served in the Office of Management and Budget, in the Executive Office of the President, as 

the Branch Chief for Information Policy and Technology. Mr. 

Chenok left the government in 2003. 

He received his Master of Public Policy from Harvard University 

John F. Kennedy School of Government and his B.A. from Columbia University. 

Our fourth witness is Mr. Daniel Castro, Senior Analyst at the 

Information Technology and Innovation Foundation, ITIF. Mr. Castro specializes in IT policy, including issues relating to data privacy, e-commerce, e-government, and information security and accessibility. Before joining ITIF, Mr. Castro worked as an IT analyst 

at the Government Accountability Office, GAO, and was a Visiting 

Scientist at the Software Engineering Institute in Pittsburgh, 

Pennsylvania. 

Mr. Castro received his B.S. in Foreign Service from Georgetown 

University and an M.S. in Information Security Technology and 

Management from Carnegie Mellon University. 

Welcome to you all, and we will begin with Mr. Holleyman. 

TESTIMONY OF ROBERT W. HOLLEYMAN, II, PRESIDENT AND 

CHIEF EXECUTIVE OFFICER, BUSINESS SOFTWARE ALLIANCE (BSA) 

Mr. HOLLEYMAN. Chairman Goodlatte, Ranking Member Watt, 

Chairman Smith, thanks to companies like those who are in the 

Business Software Alliance and sitting here at this table, America 

is the top player in cloud computing. But we better watch out. 

Other countries are doing everything they can to knock us off the 

block. 

They have seen the forecasts that we all have seen. Public IT cloud revenue, which exceeded $28 billion last year, will grow to 

more than $73 billion by 2015. But the big thing that is happening 

is the innovation enabled by the cloud. A recent study found that 

cloud-driven innovation across all sectors will generate more than 

a trillion dollars in revenue and millions of jobs in the years ahead. 

Because the stakes are so high, and because of U.S. cloud companies’ early leadership, some countries are taking policy steps to 

shut us out of their markets. The stakes of this are enormous, and 

if we want to get things right and to continue leading in the cloud, 

there is an urgent need for Congress and the Administration to 

forge an open and competitive global landscape. 

I would like to cover three things today: first, the scope of the 

problem, second, the mix of public policies that are needed to adVerDate Aug 31 2005 16:02 Sep 07, 2012 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6601 H:\WORK\IP\072512\75311.000 HJUD1 PsN: DOUGA
7 

dress it, and, third, some specific things that this Committee can 

do. 

The problem before us is unfolding around the world. As was indicated in my introduction, BSA has 13 foreign offices, and we have 

done a lot of on-the-ground work and two ground-breaking studies 

about the cloud. One is a global ‘‘Cloud Scorecard’’ that looks at 80 

percent of the global ICT market and ranks the competitiveness 

and a host of factors that affect the U.S. and other countries, and 

the ability of companies to succeed in the cloud. And the second is 

‘‘Lockout,’’ which is a report about a new wave of IT barriers that 

are being erected internationally. 

Our research shows that governments in many countries are 

doing things to carve the cloud up into country-sized pieces so that 

local players can dominate their own backyards without competition. For example, in the name of privacy and security, we are seeing some countries require data to be hosted inside their borders, 

even non-sensitive commercial information. You would have to 

build a local data center to do business in some of these countries, 

and that could put a prohibitive burden on international cloud 

players. 

Some countries are even adopting rules that would explicitly prevent the transfer of personal information outside their borders. 

Now these are bad signs for the global economy, but especially for 

America since we are so heavily dependent on selling products and 

services overseas. 

It is critical for Congress and the Administration to show the 

world a better mix of cloud policies. And we can do that by getting 

three things right. First, we need to ensure that privacy and security rules protect consumers while also encouraging robust digital 

commerce. Second, we need to promote a free trade agenda that ensures that data can flow across borders. And third, we need to promote innovation in the cloud the same way we promote it everywhere else. That means protecting innovators’ rights when they 

bring new products to market, and it means stopping all forms of 

cybercrime and theft. 

This Committee has an important role to play in this issue. For 

example, there is a myth that cloud computing puts an end to software piracy. In reality, piracy is evolving. This Committee can ensure that we have tools to vigorously enforce laws against IP theft 

no matter where that technology or how that technology is used. 

Secondly, this Committee can take a lead role in reforming the 

Electronic Communications Privacy Act, ECPA. In the cloud era, 

digital files should be subject to the same laws and protections as 

paper files. And finally, we need to dispel myths about the PATRIOT Act. Foreign governments are scaring customers away from 

U.S. cloud services by portraying our law as unusually invasive. 

The fact is every government has authority to access data to protect national security, and everyone needs to understand that. 

We look forward to discussing these issues with you and to working with the Committee. The future of the cloud computing industry and American leadership depends on your work. Thank you. 

[The prepared statement of Mr. Holleyman follows:] 

8 


BSA-1.eps
9 


BSA-2.eps
10 


BSA-3.eps
11 


BSA-4.eps
12 


BSA-5.eps
13 


BSA-6.eps
14 

—————— 

See Appendix for the attachments submitted with this statement. 


BSA-7.eps
15 

Mr. GOODLATTE. Thank you, Mr. Holleyman. 

Mr. Freeman, welcome. 

TESTIMONY OF JUSTIN FREEMAN, CORPORATE COUNSEL, 

RACKSPACE US, INC. 

Mr. FREEMAN. Thank you, Mr. Chairman. On behalf of both myself and Rackspace, I would like to express my appreciation for the 

time of this Committee and the opportunity to provide some additional insight into the key elements of cloud computing, and address some of the primary challenges of the competitiveness of 

American cloud providers. 

Congressman Smith, I appreciate your introduction of Rackspace. 

With our focus on fanatical support, which is a fierce commitment to a customer-oriented set of core values, Rackspace has 

grown rapidly and now serves more than 170,000 customers in 120 

countries, including most global Fortune 100 companies. 

Rackspace focuses on providing the cloud infrastructure and support technologies that enable the modern economy to benefit from 

the cost savings that cloud computing provides. Our latest focus is 

open stack, which is an open source cloud platform jointly developed with NASA. Open cloud technologies are the forefront of the 

cloud technology revolution. By fostering industry standards for 

cloud computing, which span multiple providers, open technologies 

advance security and help eliminate proprietary lock-in, which 

would be a requirement that cloud applications be tied to a specific 

provider, permitting cloud users to move their applications and 

data from provider to provider as they see fit. 

While the phrase ‘‘the cloud’’ encompasses a set of technologies, 

services, and use cases, far too broad to go into detail here, I want 

to provide you with a sense of the critical elements of cloud computing. At its most basic, cloud computing is simply the use of remote computing resources, relying on the storage and processing 

capabilities of a remote system rather than, say, your local laptop. 

We have all been using the cloud in some fashion for quite a 

while. Whenever we store e-mails with a web service like Gmail or 

Hotmail, we are essentially ceding control of that data to the cloud. 

One of the most critical impacts of the cloud is of the shift to 

using remote shared resources, permits businesses to consume information technology in a utility or a pay-for-what-you-use model. 

This cost-effective delivery method makes information technology 

resources scalable, dynamic, and flexible, in turn driving efficiency 

and innovation across all sectors of the economy. 

In order to continue promoting the resulting economic growth, it 

is essential we establish a supportive legal and regulatory environment, which is alignment with the critical cloud technologies. 

We see two major barriers to the ongoing competitiveness of 

American cloud providers: market access issues, which were substantially informed by privacy concerns, and the exploitation of the 

U.S. patent system by patent trolls. 

Concerns about privacy and security of data have become heightened as businesses hand off their data to systems in the cloud. And 

they are a major barrier to the competitiveness of American cloud 

companies internationally. Concerns about data privacy limits, the 

willingness of foreign companies to do business with United States 

16 

firms, and threatening to exclude American companies from competing abroad. 

The lack of international privacy standards is a growing source 

of distrust amongst regulatory agencies seeking to enforce their domestic laws, and businesses struggling to ensure their compliance. 

There is a perception, even if unfounded, that U.S. privacy protections are insufficient to protect the data which is stored either on 

U.S. soil or with U.S. companies. This concern results in a reluctance by foreign companies to do business with U.S. cloud companies, and we increasingly see regulatory authorities, especially in 

the EU and European economic area, moving in the direction of denying U.S. cloud providers access to the European market. 

It is critical to the ongoing competitiveness of American cloud 

companies that we take the lead and move toward to a consistent 

international privacy and data transfer framework while also providing clear interpretation of U.S. law which impact the obligations 

of cloud companies at managing the data of foreign citizens and 

businesses. 

The second major threat to U.S. cloud providers is the exploitation of the patent system by so-called patent trolls. These are 

non-practicing entities which gather portfolios of patents with the 

sole intent of using them to extract settlements from companies unwilling to engage in expensive and protractive litigation. 

These patent trolls are not protecting inventors or benefitting 

startups. To the contrary, a recent study calculated that their predatory tactics have resulted in the direct costs in excess of $29 billion to the industry, with approximately 40 percent of those costs 

formed by small and medium businesses. 

Patent litigation costs routinely exceed $2 to $3 million per suit, 

and patent trolls seek settlement after settlement in order to artificially increase the value of a patent portfolio without any relation 

to its actual market value. The result is a cascading extortionist 

abuse of the patent system. 

Cloud technologies are advancements to existing information 

technologies and require a fair and balanced patent system in order 

to remain innovative. Cloud and open technology standards cannot 

survive in this environment. It is essential that we protect the 

growing use of standardized cloud technologies, the benefits they 

bring, and allow cloud companies to reinvest in technologies, jobs, 

and innovation instead of revenue draining litigation. 

We at Rackspace share your commitment toward creating successful legislation that enhances U.S. business competitiveness, 

while ensuring the Internet remains a free and open driver of innovation for our long-term future. 

Thank you for your time. We look forward to working closely 

with you. 

[The prepared statement of Mr. Freeman follows:] 

17 


Freeman-1.eps
18 


Freeman-2.eps
19 


Freeman-3.eps
20 


Freeman-4.eps
21 


Freeman-5.eps
22 


Freeman-6.eps
23 


Freeman-7.eps
24 


Freeman-8.eps
25 


Freeman-9.eps
26 

Mr. GOODLATTE. Thank you, Mr. Freeman. 

Mr. Chenok, welcome. 


Freeman-10.eps
27 

TESTIMONY OF DANIEL CHENOK, EXECUTIVE DIRECTOR, CENTER FOR THE BUSINESS OF GOVERNMENT, INTERNATIONAL 

BUSINESS MACHINES CORPORATION (IBM) 

Mr. CHENOK. Thank you, Chairman Goodlatte, Ranking Member 

Watt, Chairman Smith, and the entire Subcommittee. 

Mr. GOODLATTE. You may want to turn your microphone on there 

and pull it close. 

Mr. CHENOK. Will do. Thank you, Chairman Goodlatte, Ranking 

Member Watt, Chairman Smith, and the Subcommittee for the opportunity to speak today. And thank you for the introduction earlier. 

I am Dan Chenok, Executive Director of the IBM Center for the 

Business of Government. The center helps government executives 

improve the effectiveness of their agencies and programs and has 

addressed cloud computing from a number of perspectives over the 

past few years. My testimony today draws on this and other experience with the growth of cloud computing. 

Moving the cloud brings numerous demonstrable and positive 

outcomes, such as cost savings, shared resources, increased program effectiveness, energy and environmental improvements, and, 

as others have noted today, innovation. 

I will focus today on three key issues that we see cloud can best 

be leveraged now and in the future. First, how to implement cloud 

efficiently, second, how best to address security, and third, how to 

leverage the cloud’s global model effectively. 

The key for success with cloud implementation is a strategy to 

define how to increase efficiency, save costs, and improve performance of programs in the cloud. A small investment in up front planning can pay large dividends in measured outcomes from any cloud 

migration because most entities integrate cloud into their existing 

legacy environments. They must make choices as to what technologies, processes, and data should migrate to the cloud over what 

period of time and at what cost. 

I would note that the Federal Government has already begun to 

realize the benefits of cloud computing. Movement to the cloud can 

fundamentally transfer how Federal agencies leverage IT. And 

efforts such as the OMB cloud strategy and GSA FedRAMP initiatives are spurring progress. Our center has produced papers 

on cloud implementation available at our website, www.businessof 

government.org. 

With respect to security, despite perceived concerns about security risks, cloud can provide for an environment that is superior for 

applying many critical security measures. Centralizing data storage and governance in the cloud can actually provide better security at a lower cost than is the case with traditional computing environments. 

Moreover, cloud can improve certain key security practices, such 

as detection of threats, remediation to minimize those threats, prediction of where threats may occur next, and protection of data and 

devices. 

Regarding the global model, the benefits of cloud computing increase when providers can move computing and data power to locations that are most cost-effective rapidly and with no loss of service 

quality or security. Real time movement of computing resources 

28 

points out the need to understand, as others have noted today, 

issues involved in cross-border data flows in the cloud. Most issues 

in this space are best addressed via contracts between parties who 

can designate jurisdiction and establish clear provisions for ownership, privacy, and security. 

I would like to highlight several issues that impact the cloud’s 

global nature. These areas are the extent to which government can 

access data across borders, international privacy collaboration, and 

open standards. 

The extent to which government can access data across borders 

can be a subject of confusion among cloud providers and users. 

However, as has been indicated today, many nations have similar 

domestic data policies. A recent white paper from the law firm 

Hogan Lovells found that each of the 10 countries studied vests authority in the government to require a cloud service provider to disclose customer data in certain situations. And in most instances, 

this authority enables the government to access data physically 

stored outside the country’s borders. 

And as Chairman Smith indicated in his opening remarks, this 

study also indicated that in a number of cases, protections from 

government intrusion in the U.S. were actually greater than in 

other countries. 

Regardless of jurisdiction, individuals whose data resides in the 

cloud will have greatest confidence if, to the extent permissible 

under law, they do not lose protection solely based on where their 

data is stored and processed. 

Cloud computing would also benefit from an international regime 

that promotes privacy and supports efficiency cross-border data 

flows. While complete harmonization of rules is not practical or desirable, countries may be able to recognize each other’s rules, including privacy safeguards. 

Finally, the benefits of cloud can best be achieved by reliance on 

open standards that promote data portability and interoperability, 

which are critical for successful adoption and delivery of cloudbased solutions. An open standards approach would also help to address location-based mandates. While certain practices by governments to locally-sourced cloud computing may be understandable, 

governments could enhance the cloud’s efficiency and cost-effectiveness by avoiding local mandates and leveraging and encouraging 

an open global model. 

Chairman Goodlatte, Ranking Member Watt, Chairman Smith, 

the Subcommittee, thank you for the opportunity, and I welcome 

any questions. 

[The prepared statement of Mr. Chenok follows:] 

Prepared Statement of Daniel Chenok, Executive Director, 

Center for The Business of Government, IBM 

Good afternoon, and thank you Chairman Goodlatte, Ranking Member Watt, and 

the entire Subcommittee for the opportunity to speak with you about cloud computing. 

I am Dan Chenok, Executive Director of the Center for The Business of Government at IBM. The Center connects public management research with practice. Since 

1998, we have helped public sector executives improve the effectiveness of government with practical ideas and original thinking. We sponsor independent research 

from the academic and non-profit sectors, and we create opportunities for dialogue 

29 

on a broad range of public management topics. The Center has addressed cloud computing from a number of perspectives over the past few years. 

I also serve as Chair of the Information Security and Privacy Advisory Board, 

which is the chartered under the Federal Information Security Management Act 

(FISMA) to advise the government about information security and privacy issues affecting civilian Federal agencies, and has addressed security and privacy issues involved in cloud computing. 

My testimony today draws on this and other experience that I have had with the 

growth of cloud computing, primarily with respect to how government can best promote the efficient, secure, and cost-effective use of this technology. After addressing 

context and benefits, I will focus on three key issues that impact how cloud can best 

be leveraged, now and in the future. 

CONTEXT

Many descriptions of cloud computing are cited across government and industry, 

including a formal definition from the National Institute of Standards and Technology (NIST). I would offer that the cloud includes environments where physically 

distributed computing resources—including infrastructure, applications, or databases—connect in real time to help a company, consumer, or government agency 

perform a transaction, service, or inquiry. 

Cloud services can be provided over the public Internet, but can also be done 

through connections over networks that run independently. Government agencies 

often establish clouds independent of the open Internet due to perceived risks of 

making data available over public channels—but the government is moving in the 

direction of more use of the open Internet for cloud as well. 

Indeed, whether consumers, companies, and governments realize it, they are already in the cloud all the time. Many popular email services, including Gmail, 

Hotmail and Yahoo, function over the distributed networks that constitute the 

cloud, and provide access to millions of people. Businesses and governments are increasingly using the cloud for email as well. 

BENEFITS OF THE CLOUD

Cloud computing is much in the news and lexicon these days. Questions about the 

cloud include: does cloud help end users, will cloud help businesses and federal 

agencies carry out their mission, and will cloud reduce costs? The answer to all of 

these questions is ‘‘yes.’’ 

Moving to the cloud brings numerous demonstrable benefits: 

• Cost Saving. Cloud computing allows customers to pay for just the computer 

resources that they use. They can avoid both a large initial upfront expenditure 

in hardware and software, and ongoing operating and maintenance expenses 

for their own IT. Resource usage can be monitored, controlled, and reported 

in a transparent way for both the provider and consumer of the cloud service. 

Indeed, a Brookings Institution study found that ‘‘. . . agencies generally saw 

between 25 and 50 percent savings in moving to the cloud;’’ this same report 

refers to other studies which claim savings from 39% to 99%. (http:// 

www.brookings.edu/∼/media/research/files/papers/2010/4/07%20cloud%20 

computing%20west/0407lcloudlcomputinglwest) 

• Increased Effectiveness. Network outages are an ongoing challenge for IT departments. Cloud computing can offer a higher level of service and reliability, 

reduce the harm that can come from network outages, and provide for a more 

immediate response to emergency situations by enabling real-time transfer of 

IT services to areas that are not affected by emergency. 

• Optimized Computing Usage. IT service providers see cloud computing not 

only as a means to better serve their customers, but also to optimize data center 

usage. In many centers, only a small fraction of computing capacity is used at 

any time; the remaining capacity sits idle. Cloud enables flexible scaling across 

customers based on demand, which increases capacity and cost-effectiveness. 

• Energy and Environmental Improvements. While most computers and 

servers are certified as energy efficient, cloud takes green computing one step 

further—decreasing electricity use, slashing carbon emissions, and reducing IT 

costs through cost-effective use of computer and network infrastructure. Cloud 

also opens avenues for telecommuting (e.g., through internet-based email), 

which brings added environmental benefits. 

• Innovation and Transformation. Cloud computing can help to spur innovation and transform operations. In the next several years, andthe use of the 

30 

cloud to pave the way for for business model innovation is likely to increase significantly—innovation that includes entering new lines of business, reshaping 

an existing industry, or transitioning into a new business role. 

In addition, and as has been noted by both the current and previous Federal Chief 

Information Officers at the Office of Management and Budget (OMB), Federal computer users have lagged behind industry in IT productivity gains from IT, with outdated applications and burdensome rules governing acquisition and management of 

IT services. Movement to the cloud can fundamentally transform how federal agencies leverage IT, and to make federal workers far more effective in their use of IT. 

The Federal government has, of course, already begun to realize the benefits of 

cloud computing. Examples include: 

• the development and implementation of governmentwide and specific cloud 

strategies from OMB and agencies, 

• the recent introduction of the General Services Agency (GSA) Federal Risk and 

Authorization Management Program (FedRAMP) program that fosters interoperability in cloud services across agencies. Indeed, other governments are 

studying FedRAMP’s implementation closely to possibly emulate the model; and 

• work by the National Institute of Standards and Technology (NIST) to clarify 

and guidance on the cloud. 

KEY ISSUES FOR DISCUSSION

Today, I would like discuss three main challenges for government in order to realize the full benefits of the cloud: 

• how to implement cloud efficiently, 

• how best to address security in the cloud, and 

• how to leverage the cloud’s global model effectively. 

Implementation 

Key for success in any cloud implementation is a strategy to define how to increase efficiency, save costs, and improve performance of programs in the cloud. A 

small investment in upfront planning can pay large dividends in measured outcomes 

from any cloud migration. This is especially important because most entities do not 

build brand new computing environments where all activities operate in the cloud. 

Rather, they integrate cloud-based infrastructure, applications, and services into existing legacy environments, and must make choices as to what technologies, processes, and data should migrate to the cloud, over what period of time, and at what 

cost. To guide those choices, organizations need a sound up-front strategy that considers investments relative to resource availability and mission objectives. 

The IBM Center for the Business of Government has produced a number of papers that address cloud implementation, especially in the Public Sector. For example: 

• In a 2009 report for the Center, ‘‘Moving to the Cloud: An Introduction to Cloud 

Computing in Government,’’ David Wyld provides non-technical executives with 

a roadmap to understand key questions to ask as their organizations move to 

the cloud. He frames key challenges facing government leaders in the space, including scalability, security, open standards, procurement, and legal issues. 

• In 2010, author Costas Panagopoulos wrote in our semi-annual journal, The 

Business of Government, about the lessons learned in cloud implementation by 

the Census Bureau (‘‘Counting on the Cloud: Early Reflections on the Adoption 

of Cloud Computing by the U.S. Census Bureau’’). He outlines key lessons that 

include the need to start early in cloud design, to partner with other adopters, 

and to correct problems as soon as they arise. 

• Many perspectives on how best to implement cloud appear on our blog site, concentrated primarily in ‘‘Strategies to Cut Costs and Improve Performance.’’ 

(http://www.businessofgovernment.org/blogs/cut-costs-and-improve-performance) 

In addition, much research and experience demonstrates that to maximize the 

cloud’s benefits, organizations must move aggressively to adopt more standardized 

offerings across organizations. That is, they must change current technology, procurement, and business processes to conform to best commercial practice, rather 

than modifying the cloud to fit existing organizational processes. Standardized offerings provide economies of scale and allow providers to automate processes that result in lower costs for users. 

31 

In addition, while savings can be achieved by migrating current applications, not 

all existing applications can run in a cloud efficiently. Organizations can collect data 

on how applications are being used to make informed decisions about which applications to migrate to the cloud, and in what order. This data can also help to sunset 

unneeded applications and optimize IT more efficiently and effectively. 

Finally, cloud implementation can enable innovation. Developers who come together over cloud-based platforms that rely on open standards can share ideas and 

test approaches in ways that take advantage of the wisdom of many, rather than 

the few who work on a custom application. 

Security 

Relinquishing direct control of the IT infrastructure by adopting the cloud has 

raised perceived concerns about security risks. Cloud computing, however, can provide for an environment that is inherently superior for applying many critical security measures. By centralizing data storage and governance, clouds can actually provide better security at a lower cost than can traditional computing environments. 

Cloud environments can also provide differentiated levels of security, reflecting the 

fact that some data requires a great deal of protection while other data requires far 

less. Cloud providers can work with their customers to deliver security efficiently 

and effectively based on different levels of risk—security services can be built into 

the cloud up front to optimize protection at a given risk level. 

Moreover, by facilitating uniform management practices across a distributed computing environment, cloud can improve certain key security practices, such as: 

• Detection—the cloud creates the ability to link together millions of security 

nodes on the net. By working together, these nodes can better detect new 

threats how to implement cloud efficiently. 

• Remediation—Quick remediation is vital for cyber security—the less time the 

malware is present, the better the protection. The cloud allows implementation 

much more rapidly than the older model of having to load the solution onto 

multiple machines. 

• Prediction—Increasingly, cyber security focuses on limiting the ability of bad 

actors to act in the first place. The cloud helps security teams to identify machines that create and disseminate malware, and to quickly isolate those machines—blocking their ability to infect customer systems. 

• Data and Device Protection—A significant security threat, and one that has 

impacted the Federal government, is breach of data, especially from lost or stolen laptops or mobile devices. Cloud provides for centrally stored data with continuous and automated network analysis and protection, so that if a device is 

lost, the data and applications are not lost with it (unless the user has been 

allowed to load them separately onto the device). 

As noted earlier, I also Chair the Federal Information Security and Privacy Advisory Board (ISPAB). Building off a Board-hosted forum on best practices in this 

space several years ago, the ISPAB has highlighted numerous ways that the Federal 

government can best addresses security in the cloud, especially with regard to the 

operation of the FedRAMP program and the monitoring of traffic that flows in and 

out of agencies over cloud-based applications (see more at http://csrc.nist.gov/groups/ 

SMA/ispab). 

Global Model 

The cloud can be either localized or global in nature. The benefits of cloud computing increase, however, when providers can move computing and data power to 

locations that are most cost-effective, rapidly and with no loss of service quality or 

security. For example, consider the recent storm and power outages in Washington, 

DC—in a situation like this, using a cloud that allows the online relocation of computing resources would provide continuity of service far more quickly and cheaply 

than a platform restricted to local computing locations. 

Real-time movement of computing resources points out the need to understand 

issues involved in cross-border data flows in the cloud. Of course, data has moved 

across borders for decades—airlines, pharmaceuticals, telecommunications, and 

technology companies are among those with long history here. The cloud has amplified attention to cross-border data flow issues such data sovereignty and jurisdictional questions. Most of these issues are best addressed via contracts between solution providers and customers; contracts can designate jurisdiction and establish 

clear provisions for ownership, privacy, security, and consumer protection. 

32 

I would like to highlight some recent findings and observations in three areas that 

affect the cloud’s global nature and American competitiveness in this space—the extent that government can access data across borders, international privacy collaboration, and open standards. 

Government Access to Data 

The extent to which governments can access data across borders is a subject of 

confusion among cloud providers and users. However, many nations have similar domestic data policies. A recent HoganLovells White Paper, ‘‘A Global Reality: Governmental Access to Data in the Cloud,’’ reveals that U.S. law provides some greater 

privacy protections: 

‘‘In jurisdictions outside the United States, there is the real potential of 

data relating to a person, but not technically ‘‘personal data,’’ stored in the 

Cloud being disclosed to governmental authorities voluntarily, without legal 

process and protections. In other words, governmental authorities can use 

their ‘‘influence’’ with Cloud service providers—who, it can be assumed, will 

be incentivized to cooperate since it is a governmental authority asking— 

to hand over information outside of any legal framework. United States law 

specifically protects such data from access by the government outside of 

legal process.’’ 

Furthermore, the paper notes that ‘‘it is not possible to isolate data in the Cloud 

from governmental access based on the physical location of the Cloud service provider or its facilities. Governmental access to data in the Cloud is ubiquitous, and 

extends across borders.’’ As the paper concludes, a detailed analysis of ten countries 

revealed that: 

‘‘every single country that we examined vests authority in the government 

to require a Cloud service provider to disclose customer data in certain situations, and in most instances this authority enables the government to access data physically stored outside the country’s borders, provided there is 

some jurisdictional hook, such as the presence of a business within the 

country’s borders. Even without that ‘‘hook,’’ MLATs allow access to data 

across borders.’’ [Governments cooperate with each other through ‘‘mutual 

legal assistance treaties’’ (MLATs)] 

Regardless of jurisdiction, individuals whose data resides in the cloud will have 

greatest confidence if, to the extent permissible under law, they do not lose protection solely based on where their data is stored and processed. 

International Privacy Collaboration 

With the understanding that many nations have similar laws and that where a 

company stores its data should not reduce protections, consumers, enterprises, and 

governments can look at cloud providers’ experience with providing security and privacy protections in order to make informed decisions about how to use applications 

in the cloud. 

In addition, cloud computing would benefit from an international regime that promotes privacy while supporting the efficient flow of data across borders. While it is 

neither practical nor desirable to seek the complete harmonization of rules, countries may be able to recognize each other’s rules (including privacy safeguards) to 

the greatest extent possible, and to honor those rules through means such as contracts and service level agreements (SLAs). This approach to interoperability would 

not require the same laws in each jurisdiction, but it would allow data and computing transfers to take place over the cloud based on shared understanding of how 

law and policy should apply. 

Initiatives such as the US–EU safe harbor, the use of binding corporate rules, and 

the cross-border privacy initiative in APEC serve as building blocks for such an 

interoperable international privacy regime. The benefits of such a regime would extend beyond cloud computing; they would support any entity that builds data centers in different jurisdictions. But because cloud computing relies heavily on the efficiencies gained from real-time data flows across different countries, the adoption of 

an interoperable privacy regime would facilitate cost-effective adoption. 

Open Standards 

The benefits of cloud can best be achieved by reliance on open standards that promote data portability and interoperability, which are critical for successful adoption 

and delivery of cloud-based solutions. Open standards enable users to reap value 

from a diversity of cloud providers, and to move data and applications based on a 

33 

choice of available applications without friction. Consider the analogy to Internetbased computing since the 1990s: the Internet has seen phenomenal growth and 

spurred so much innovation because its networks dependent largely on open standards—no one company or handful of companies has a dominant position and can 

single-handedly determine its architecture and development. 

An open standards approach would particularly help to address the issue of location-based mandates. Over a dozen countries have recently drafted or are considering laws that would mandate in-country location of cloud data servers and storage 

facilities. The Business Roundtable recently released a report, ‘‘The Growing Threat 

of Local Data Server Requirements’’ (http://businessroundtable.org/uploads/studiesreports/downloads/GloballITlPolicylPaperlfinal.pdf), which provides details on 

this issue. While certain practices by governments to locally source cloud computing 

are understandable—for example, for a country’s national security information— 

governments could enhance the cloud’s efficiency and cost benefits by avoiding location mandates, and leveraging and encouraging an open, global model. 

CONCLUSION

Cloud computing has great promise to enable consumers, businesses, and governments to reduce IT costs and improve IT performance. Key considerations in 

leveraging the benefits of the cloud include implementation, security, and leveraging 

the efficiencies of the global model. Greater education, investment and appropriate 

incentives can allow government and businesses to help all stakeholders use the 

cloud most effectively. 

Chairman Goodlatte and Ranking Member Watt, thank you for the opportunity 

to speak with the Subcommittee. I welcome the chance to answer any questions that 

you may have. 

Mr. GOODLATTE. Thank you, Mr. Chenok. 

Mr. Castro, we are pleased to have your testimony. 

TESTIMONY OF DANIEL CASTRO, SENIOR ANALYST, INFORMATION TECHNOLOGY AND INNOVATION FOUNDATION (ITIF) 

Mr. CASTRO. Thank you. Chairman Goodlatte, Ranking Member 

Watt, Chairman Smith, and Members of the Subcommittee, I appreciate the opportunity—— 

Mr. GOODLATTE. Could you put that microphone—— 

Mr. CASTRO. There we go. Chairman Goodlatte, Ranking Member 

Watt, Chairman Smith, and Members of the Subcommittee, I appreciate the opportunity to discuss cloud computing with you today. 

I would like to focus my remarks on two principles that policymakers should keep in mind with regards to cloud computing. The 

first principle is cloud neutrality. Cloud computing is an important 

trend for how organizations use information technology, but the 

technology itself is not so different from other forms of computing 

that there is a need to create cloud specific regulations. That does 

not mean there are not important policy issues that affect cloud 

computing. For example, one important issue is addressing the 

complex jurisdictional questions that arise from having data subjects, data owners, and service providers under different legal jurisdictions and facing conflicting regulations. 

Meaningfully addressing these issues may eventually require 

countries to develop agreements on questions of jurisdiction or 

standardize some data practices, or, alternatively, advances in 

technology that allow data policies to actually bundle with data, 

and ensure that these policies are enforced may help resolve some 

of these questions. 

While all these issues are important for many cloud computing 

companies, they are not necessarily unique to the technology. HowVerDate Aug 31 2005 16:02 Sep 07, 2012 Jkt 000000 PO 00000 Frm 00037 Fmt 6633 Sfmt 6601 H:\WORK\IP\072512\75311.000 HJUD1 PsN: DOUGA
34 

ever, creating cloud neutral policies will require some change to ensure that laws and regulations do not favor or disfavor cloud computing. 

One important step Congress can take in this direction is to update the laws that govern the electronic surveillance of data. The 

Electronic Communications Privacy Act was enacted in 1986, and 

has not kept pace with the advancement of technology and the 

growth of cloud computing. As a result, there are different levels 

of protection afforded to the privacy of an individual’s data depending on where and for how long the data has been stored. Consensus 

is forming around the idea that reform is needed in this area to 

protect Fourth Amendment rights. 

The second important principle for cloud computing is for policymakers to address anti-competitive foreign practices that challenge 

the dominance of cloud computing service providers in the United 

States. As a leading provider of cloud computing, U.S. companies 

stand to benefit tremendously from the large expected growth in 

cloud computing worldwide. Not surprisingly, other countries are 

aggressively challenging U.S. leadership in this market. 

While fair competition is legitimate, some countries are using unfair policies to intentionally disadvantage foreign competitors and 

grow their domestic cloud computing industry. The rise of cloud 

mercantilism is an emerging threat to the global trade and information technology. 

Some countries are using data security and data privacy regulations to create geographic restrictions on where cloud computing 

service providers can store and process data. Other countries have 

policies that explicitly require cloud computing service providers to 

operate data centers domestically. These requirements have the effect of making cloud computing less efficient since decisions about 

where to locate data centers or how to operate them must be made 

on political mandates rather than technical or economic factors. 

Localization requirements also serve as a form of protectionism 

for domestic cloud computing providers since it may not be economically viable for a foreign competitor to build a domestic data 

center. Examples of this type of behavior can be found in many 

countries, for example, Greece, Vietnam, and Brunei have all 

passed laws which require data generated within the country to be 

stored on servers within those countries. Both the Norwegian and 

the Danish protection authorities have issued rulings to prevent 

the use of certain cloud computing services when those servers 

were not located domestically. The government in Kazakhstan 

issued an order to require that all dot.kz domain names operate on 

servers located within the country. China, Russia, Venezuela, and 

Nigeria have all passed localization requirements ostensibly to protect national security and payment processing. And similar types 

of laws are pending in other countries, including Indonesia, Malaysia, and Ukraine. 

Strong U.S. leadership is necessary to combat the unfair trade 

practices that other nations are using to block foreign competitors 

in the rapidly-growing cloud computing industry. First, the U.S. 

government should clearly and definitively state its opposition to 

local data center requirements and highlight instances of non-compliance by foreign governments. For example, this type of behavior 

35 

could be highlighted by the USTR in a Special 301 report. Second, 

the U.S. government should affirm its intention to refrain from imposing its own local data center requirements. These policies may 

be tempting, but they diminish the capacity of the United States 

to hold other countries accountable for similar forms of protectionism. 

The long-term goals of the U.S. government should be to work toward eliminating geographic restrictions on cross-border flows of 

data. U.S.-based cloud computing service providers have the most 

to lose if these type of areas become widespread. After all, the domestic market for cloud services is much smaller than the global 

market. 

Thank you, and I look forward to your questions. 

[The prepared statement of Mr. Castro follows:] 


Castro-1.eps
36 


Castro-2.eps
37 


Castro-3.eps
38 


Castro-4.eps
39 


Castro-5.eps
40 


Castro-6.eps
41 


Castro-7.eps
42 


Castro-8.eps
43 


Castro-9.eps
44 


Castro-10.eps
45 


Castro-11.eps
46 


Castro-12.eps
47 


Castro-13.eps
48 


Castro-14.eps
49 

Mr. GOODLATTE. The Chair is going to diverge from regular order 

because the gentleman from North Carolina has some other obligations, and we want to recognize him first to ask his question. So 

we will turn now to him. 

Mr. WATT. I thank you, Mr. Chairman, and I thank you for accommodating my schedule. Unfortunately, I have got something 

that has started, and I need to be at immediately. But I did not 

want to miss the testimony or miss the opportunity to ask questions. 

All of the testimony was very interesting and raises some very, 

very interesting issues. It seems to be unanimity on the question 

of cloud neutrality. I take it everybody is in agreement on that. 

That means, I take it, that the same rules that apply to things 

outside the cloud should apply to things inside the cloud. Would 

that be a fair definition of cloud neutrality? 

Mr. CASTRO. Yes, I do think that is a fair definition. 

Mr. WATT. Okay. So but then you raise some interesting questions which, in essence, brings us back to a lot of the same issues 


Castro-15.eps
50 

that we have been dealing with outside the cloud—protection of 

personal security, personal information for consumers, an issue 

outside the cloud, protection against trolls suing each other, although the owners of patents are suing each other regularly, which 

is a big problem, protection against piracy, which Mr. Holleyman 

raised in the context of the cloud, I presume to protect programs 

and what have you. But that is not unique to programs. Piracy is 

a problem. 

And I do not want this to devolve into another question of how 

we protect ourselves against piracy, but it does raise the question 

of whether in light of the failure of our Committee to be able to 

deal with that effectively and the withdrawal of the proposal that 

was on the table, whether any affirmative steps are being made by 

the industry to address piracy either in the cloud or outside the 

cloud. If you are going to have a neutral cloud neutrality and you 

have got problems outside the cloud, then we have got to commit 

ourselves to working on the problems outside the cloud so that 

when we adopt the principle of cloud neutrality, those same principles will protect us inside the cloud. 

So is anybody making any progress in the sector? You all obviously are all involved in this SOPA thing on one side or the other. 

We are not here to recreate that debate today. I just want to see 

whether you all think any progress is being made because if we are 

going to transport that issue to the cloud, we are going to have 

cloud neutrality, I think we got to deal with it. So, Mr. Holleyman? 

Mr. HOLLEYMAN. Mr. Watt, thank you for the observation and 

question. The point which I want to make clearly about piracy in 

the cloud is there was a common myth, and candidly, I probably 

believed this myth as recently as 2 years ago, that software piracy 

goes away when software is used in a cloud context, and that 

where you actually have piracy is with the physical media, but that 

when you shift it to the cloud, you do not have the problem of piracy. And, in fact, what we found is that the piracy evolves. 

I do think you will have less software piracy in a cloud context. 

We identified at least four ways in which it can occur, one of which 

will occur when unscrupulous hosters—fortunately, there are none 

that I know of at this point, but they may be ones outside elsewhere—— 

Mr. WATT. All right. You are identifying a set of problems in the 

cloud that are unique to the cloud, and I want to deal with. But 

that was not really my question. 

Mr. HOLLEYMAN. Okay. 

Mr. WATT. And I am running out of time. 

Mr. HOLLEYMAN. I think your question—if I understand your 

question correctly, it was saying that some of the problems that we 

currently see are simply going to be transferred into an environment in the cloud. So what we need is effective tools to deal with 

those, and that is going to require self-help by industry. And that 

is also going to require appropriate use of law enforcement resources when the piracy can be identified, whether it is in the 

cloud or outside the cloud. 

Mr. WATT. Well, my question was whether we are making any 

progress toward solving this problem outside the cloud or in the 

cloud. I guess that is the baseline question I am asking. 

51 

Mr. HOLLEYMAN. Yeah, I think we are making some progress 

outside the cloud where piracy is bigger in reducing levels of piracy. I think we have seen some good cases the Justice Department 

has brought that have been helpful. We bring about 10,000 cases 

a year. We are seeing piracy rates for software come down. What 

we have to make sure is that the tools that we need can continue 

to work in a cloud-based environment. 

Mr. WATT. I would just open up one other area of inquiry. I know 

my time—— 

Mr. GOODLATTE. Without objection, the gentleman is recognized 

for an additional minute. 

Mr. WATT. My time has expired, because it seems to me that this 

debate about whether we protect ourselves against other countries 

putting up barriers that allow hosting only in their countries is 

similar to this question of whether we do not prohibit call centers 

from going offshore. 

The question is, how do we protect ourselves, how do we protect 

our own consumers’ information without those kinds of barriers in 

our own country? And if we put them up in our own country, does 

that not incentivize other countries to put them up there? The 

same thing with national security concerns. If we are allowing our 

national security apparatus access to information in the cloud, 

would it not be a legitimate concern for other countries to be concerned about the extent to which our national security apparatus 

would have access to their information in the cloud? 

I am not looking for answers necessarily to all of these questions, 

but it just seems to me from my simplistic mind that if we are setting up a set of neutral standards internationally and we are trying 

to get people to play by those rules, we have to anticipate that we 

have got our own set of issues we must deal with domestically before we can start fussing at everybody internationally. Am I off on 

the wrong cloud here, or do you all agree with what I am saying? 

Mr. HOLLEYMAN. I will start by saying, hey, look, I think we 

need to do both simultaneously. I mean, there are some gaps in 

U.S. law that we think need to be resolved, like the need for ECPA 

reform that would ensure some greater levels of privacy for data 

that is stored in the cloud. And that would be an important signal 

for other countries. 

And, secondly, we have to be aggressive in making sure, as one 

of my colleagues said, that we do not put rules in place that require all data on all U.S. citizens in all contexts to be held in the 

U.S. We do not require that now. There are some people who would 

like to do that, but if we did it, it would be a signal to every other 

country that they could do the same. So we have to live by that 

openness, but know that there are appropriate privacy and security 

regimes that will protect appropriate levels of data for U.S. citizens, wherever it’s hosted. 

Mr. WATT. Mr. Chairman, I appreciate your accommodating my 

schedule. I wish I could stay for another round of questioning because really I came with the intention of talking more about competition in the cloud, and I did not ask a single question about competition. 

52 

Mr. GOODLATTE. If you would submit your questions for the 

record, we would be happy to submit them to all the witnesses and 

ask them to respond. 

And we appreciate the gentleman’s participation. And the Chair 

now recognizes the gentleman from Texas, Chairman Smith for 5 

minutes. 

Mr. SMITH. Thank you, Mr. Chairman. I would like to try to see 

if I can squeeze in questions on the subject of patent trolls, privacy 

security, and foreign countries. 

Let me direct my first question to Mr. Freeman. You and I have 

talked about this subject, and I have talked with two others within 

Rackspace on the problem of patent trolls, and the frivolous lawsuits they file, and the cost to the company and to other companies 

across America. 

I think we are aware of the problem, though if you want to discuss it in greater detail, you are welcome to. But what do you think 

are some of the solutions to this almost exponential growth in lawsuits, litigation derived from these patent trolls? 

Mr. FREEMAN. Thank you, Congressman. I think two key mechanisms that limit the incentives that patent trolls have to bring actions for profit without practicing their invention or practicing the 

patent. One approach along those lines is to limit the potential reward from litigation to the actual value of the license or that the 

troll are acquiring entity paid for a patent if it is not also practicing the patent. That is a case where the patent troll is essentially not being harmed by the practice of the invention by another 

entity, so it should not essentially get an ill-gotten gain simply as 

a result of holding onto a patent in an attempt to block innovation. 

Another mechanism is to shift toward a framework where legal 

costs and responsibilities are borne more equitably between the two 

parties. A loser pays a price has been floated, and there are some 

interesting potential reforms along those lines. They can make it 

so that a patent troll has a lot or a litigator has a lot on the line 

when they file a claim for an infringement action. 

Mr. SMITH. Okay. Good suggestions in regard to the first. I think 

we would have to probably be careful so that we would not apply 

such a reform too broadly. You cannot say it is illegal for someone 

to hold a patent just because they are not using it. But I understand the thrust of your reform, and I agree with that. 

Mr. Holleyman, on the subject of privacy, what are some of the 

privacy issues involved with cloud computing that we need to be 

aware of? And you just started getting into that a little bit I think 

in response to the question from Mr. Watt. 

Mr. HOLLEYMAN. Right. On the issue of privacy or piracy? 

Mr. SMITH. Privacy. 

Mr. HOLLEYMAN. Privacy. Well, look, I think on the issue of privacy, one of the single biggest issues is going to be how we work 

in the context of the European Union, which is moving to adopt a 

data privacy regulation that will be unlike a directive. This will be 

mandatory across all 27 member states. There is sort of an 18- to 

24-month process in which that is happening, and that is going to 

require a regular dialogue with U.S. government, both Administration and U.S. Members of Congress, because at the end of the day, 

we have to have a regime that preserves the safe harbor, provisions 

53 

that currently have been negotiated between the U.S. and the EU 

so that data can be exchanged appropriately across borders. And 

that we also have to ensure that the Europeans do not adopt a privacy regime that is so restrictive that will have a de facto effect 

of blocking access by U.S. companies. 

Mr. SMITH. And as you say, we have seen some signs of that already I think. 

Mr. HOLLEYMAN. Absolutely. 

Mr. SMITH. Thank you. Mr. Chenok, I want to ask you about security issues involved with cloud computing. You touched on them 

a minute ago, but can you elaborate? 

Mr. CHENOK. Yes, thank you for your question. Security in the 

cloud is—— 

Mr. SMITH. Is your mic on? 

Mr. CHENOK. Yes, I will do that. Thank you for your question, 

Chairman Smith. Security in the cloud is not dissimilar to how security is handled in other forms of technology. You could imagine 

a cloud with very strong security protections built into the system—lots of surveillance of the Internet traffic coming out of the 

cloud, immediate warnings to the operators of the system that then 

go out to the users of the cloud if there is an incident. Similarly, 

you could imagine those same kinds of protections being built into 

a well-constructed system that is a more traditional system, let us 

say a client server system or another type of computing system. 

So security issues in the cloud in some ways can be built very 

well or not. And the key is to incentivize, and for companies like 

ourselves that are here with you today to understand how to build 

security into solutions that we develop for the cloud from the beginning so that customers of ours—consumers, businesses, and governments—have confidence that the solutions that we provide and the 

solutions that are discussed in the context of government to government discussions are secure and private. 

The other point I would make, just reiterating what was in the 

testimony, is that the cloud itself can provide for a much more 

rapid response if there is a security incident that comes in. If you 

are in a traditional environment with lots of different servers in 

different places and different people worrying about those, and a 

computer security incident occurs in a patch to fix the incident is 

delivered, it is often delivered essentially manually from place to 

place and person to person. With the cloud, you can deliver that 

patch automatically, instantaneously, and the problem is rectified 

immediately. 

Mr. SMITH. Okay. Thank you, Mr. Chenok. I am out of time. Mr. 

Castro, I just want to thank you for answering my question a 

minute ago in your opening statement about the threat of foreign 

countries and what our government should do. You were very specific. I hope the Administration will listen. 

Thank you, Mr. Chairman. 

Mr. GOODLATTE. I thank the gentleman. The gentleman from 

New York, Mr. Nadler, is recognized for 5 minutes. 

Mr. NADLER. I thank the gentleman. 

Mr. Castro, a key guiding principle articulated by several company witnesses at one of our prior hearings held in September 2010 

when I was Chairman of the Constitution Subcommittee was the 

54 

desire for technology neutral or cloud neutral, as it has been described today, standards for government access to communications 

under the Electronic Communications Privacy Act, ECPA. This 

would mean that with regard to government access to content communications stored in the cloud, communications stored in the 

cloud would be treated the same as communications stored locally 

by a customer. 

If a primary goal for ECPA reform is establishing clear and consistent standards, it does seem that this would be essential. Do you 

agree? 

Mr. CASTRO. I do agree. 

Mr. NADLER. Anybody else agree or disagree on that? Everybody 

agrees that we should have the same standards for government access to material stored in the cloud as for government access stored 

on your laptop. 

And, Mr. Holleyman and Mr. Chenok, the principle we are discussing, that of cloud or technology neutrality, is a core principle 

of the Digital Due Process coalition. DDP takes the position that 

‘‘Government access to content and communications should require 

a search warrant issued based on a showing of probable cause, regardless of the age of the communications, the means or status of 

their storage, or the provider’s access or use of the communications 

in its normal business operations.’’ 

This technology-neutral standard adopts the current standard for 

communication stored by an individual locally for the communication stored in the cloud. IBM and BSA are members of the Digital 

Due Process coalition, so I presume your companies would support 

a bill adopting this standard. Would you agree with that or comment on it, Mr. Holleyman first. 

Mr. HOLLEYMAN. BSA is a member of the Digital Due Process coalition, and we support their recommendations. 

Mr. CHENOK. And IBM is a member of the Digital Due Process 

coalition and support it, yes. 

Mr. NADLER. So you would agree that the standard should be a 

due process standard, a search warrant based on a showing of 

probable cause, regardless of age. We have in ECPA now these different standards based on whether it is longer than 180 days or 

less than 180 days based on assumptions 25 years ago that if you 

had it on your computer or on somebody else’s computer for more 

than 180 days, obviously you did not care about it. You did not care 

about your privacy. Does everybody agree that that logic is no 

longer the case? 

Everybody seems to agree? 

Mr. HOLLEYMAN. Mr. Nadler, I agree with that logic, and, again, 

we are part of that coalition and support those recommendations. 

I would actually like to follow up with some additional detail for 

the record for your question. 

Mr. CHENOK. I would join Mr. Holleyman in following up. 

Mr. NADLER. I thank you. I yield back. 

Mr. GOODLATTE. I thank the gentleman. The gentleman from 

Pennsylvania, Mr. Marino, is recognized for 5 minutes. 

Mr. MARINO. Thank you, Chairman. 

Good afternoon, gentleman. Thank you for being here. As a 

former prosecutor, I believe that for every action there is an equal 

55 

and opposite reaction. So with that said, we in America, we are 

very good at developing technology, the best in the world I think. 

But nevertheless, we fall short worldwide of anticipating the downside of our advancements and our technology. And pursuant to our 

topic today, the clouding issue, I am going to ask each of you to 

take a moment and perhaps predict what you see the downside of 

the technology that we are achieving today concerning clouding. Do 

you understand my question? Mr. Holleyman? 

Mr. HOLLEYMAN. Look, I think the biggest downside I see is that 

there are going to be a lot of changes in the economy that result, 

as you move to using this new technology, which means that the 

nature of some jobs will change, the nature of how information is 

stored has changed. But as I began with the IDC report, there is 

also a huge value add to the economy, as much as a trillion dollars 

in new growth, not just in technology, but across all sectors because of cloud-enabled innovation. 

Mr. MARINO. Okay. Mr. Freeman, do you have a comment? 

Mr. FREEMAN. I think I echo those thoughts. There is going to 

be an economically disruptive effect as the amount of data that is 

available and information about individuals’ consumption behaviors 

is magnified exponentially. If there is not an alignment of the legal 

principles and the legal system applicable to types of data, regardless of whether they are stored in the cloud or locally, I think that 

is going to pose a big challenge and potentially be disruptive to 

continue cloud innovation. 

Mr. MARINO. Thank you. Mr. Chenok? 

Mr. CHENOK. Thank you, Congressman Marino, for your question. I think two points. One, if not implemented well as with any 

technology, cloud can increase issues involved in how a technology 

is placed in a work location or used by a user. So the concern would 

be address cloud’s implementation and make sure that it is done 

in a manner that addresses some of the issues that we have discussed here today earlier with regard to location mandates and 

open standards to make sure that those types of policy choices are 

built into the implementation. Without that, you could get some 

unintended effects. 

And also misperceptions. Some of us have talked this morning 

about certain beliefs about the cloud that are not necessarily true 

in fact, but color how people come to it and color the uptake in 

terms of use of the cloud. And so thinking of fact-based, I think, 

is very important. 

Mr. MARINO. Thank you. Mr. Castro, do you have a thought? 

Mr. CASTRO. Yes. You know, I think cloud computing technology 

is disruptive businesses and organizations and government in very 

positive ways. But it is also, of course, there is a duality to technology, and it can be used for negative purposes as well. So just 

as we see legal businesses becoming more productive and doing 

more with this technology, we can also see that taken up by illegal 

activity to be more productive. And obviously that is a very bad 

thing. 

Mr. MARINO. A good segue into my next question concerning the 

illegality of it and the potential of those outside. It should not be 

in a particular area garnering the information, penetrating the system. How about our security end of the thing, anyone? 

56 

Mr. HOLLEYMAN. In a cloud context, you need to look at kind of 

the access controls and how it is secured. I mean, the cloud, if configured properly, can be a much more secure environment than the 

highly distributed environment we have today where people leave 

laptops or they leave their thumb drive. And so if done properly, 

the cloud can be a net positive. 

Mr. MARINO. Well, let us take it a step further, and I am going 

to use an example. Years ago in law enforcement, we develop a 

basic walkie-talkie where law enforcement can communicate with 

one another. But then quickly, there was developed a scanner 

where we could—where the criminals could hear that we were coming after them. So how do we prevent that? Has that been taking 

into consideration at this point? I know we’re anxious to put this 

all together, but are we thinking of the ramifications and the technology that can really counter what we intend to do? 

Mr. CHENOK. So, Congressman Marino, there are technical protections that can be built into data in transit that can be established and assigned to the cloud in terms of understanding how information is moving and whether there is interception of that information while it is moving, and can very quickly spot when somebody is trying to penetrate a system or penetrate a set of information resources that are moving along, and then quickly identify how 

to resolve that situation. 

And continuing to build those technologies in and designing the 

system properly from the front will help to address those types of 

risks. 

Mr. MARINO. And, Mr. Castro, I am going to flip a question to 

you. I am running short of time here. How many entities within 

when I send my e-mail to whoever is receiving it are going to have 

access that information within that cloud? 

Mr. CASTRO. In theory, you could have just one. You know, you 

could have just the one actual provider, depending on how the 

cloud computing environment is set up. Ideally, you have it 

virtualized in a way that the data is actually segmented in ways 

that other providers that might be offering services would not actually have access to your specific data. 

Mr. MARINO. I see my time has run out. Thank you, gentleman. 

My daughter is going to be proud of me because I was talking 

about the cloud system today. [Laughter.] 

Thank you. Thank you, Chairman. I yield back. 

Mr. GOODLATTE. Does she think most days you have your head 

in the clouds? [Laughter.] 

Like my teenagers did when they were that age? The Chair is 

pleased to recognize the gentlewoman from California, Ms. Lofgren, 

for 5 minutes. 

Ms. LOFGREN. Thank you, Mr. Chairman. My apologies for being 

late. I had a competing meeting. But I do think that this is a very 

important discussion. I understand Mr. Nadler raised the issue 

that I have also been working on, the need to update ECPA for our 

current technology times. It has been a long time. And there are 

certainly privacy issues that need to be addressed, and certainly 

some of the assumptions that Americans have about the privacy afforded their digital data is not, in fact, adhered to under the legal 

57 

standards. And so that is something that I hope to help address as 

time goes on. 

I am wondering, in terms of as we deploy throughout the world, 

whether there are issues that we also need to address on standard 

setting for interoperability and portability of data when it comes to 

cloud computing, something I have not heard discussed at all, and 

yet I think it is pretty obviously something that needs to at least 

be attended to. Am I mis-advised to be concerned about that? 

Mr. FREEMAN. I think that is very correct. I think there are two 

key types of portability that have to be considered. The portability 

of user data, you can rapidly see adverse effects if cloud data or 

user data is stored within a given provider, and users of businesses 

are essentially held hostage and unable to extract that data later. 

Ms. LOFGREN. That is right. 

Mr. FREEMAN. The other thing is the portability of applications, 

the services that essentially are the cloud. If a government agency 

or a business is too reliant on a single provider’s proprietary infrastructure and may find itself unable to migrate out to either another provider in the case of a service issue or be left without an 

alternative solution in the case of a service failure. 

Ms. LOFGREN. I am interested as well—I think some of the security issues have been dealt with. But I think there is an overlap 

between, maybe for lack of a better word, security issues and interoperability. And I wanted to raise the issue of—and I will use the 

U.S. as an example. We recently took an action, we as the United 

States government, against a site alleged to be a big pirate site, 

Megaupload. But in a way, that is also cloud computing. I mean, 

it is not what we think of in the business world, but that is what 

it is. 

Have you addressed the issue of governments aggressively enforcing property rights when it comes to cloud computing that then 

disadvantages other users? We have heard for example that why 

somebody would store their baby pictures on Megaupload, I do not 

know, but apparently some people did. And now their baby pictures 

are going to be toast. 

Have we addressed that issue as a group that thinks about it, 

how we can protect innocent users when there are enforcement actions? 

Mr. HOLLEYMAN. Ms. Lofgren, I am totally familiar with 

Megaupload case, and I know that there are some pending proceedings both at Justice and in the courts, of which I am not privy 

to—— 

Ms. LOFGREN. Right. I just use that as an example. You do not 

have to talk about that case. 

Mr. HOLLEYMAN. Look, I think one of the questions is given the 

scope of some of what I would refer to as just, you know, storage 

facilities, and how to ensure that you have protection for the legitimate data that is stored, recognizing that you still need tools to be 

able to deal with the illegitimate data that may be stored or the 

hosting entity. 

And I think it is going to take, you know, a balance of laws. 

What is important, though, is that you still have to have tools, both 

civil and criminal, that allow you to take action—— 

58 

Ms. LOFGREN. Oh, I am not arguing that case. But nobody seems 

to feel any responsibility toward people who are completely innocent here. And there is no standards. There seems to be no interest 

or obligation to innocent bystanders to this action. I am wondering 

if there is not something that we ought to do to address that issue. 

Mr. HOLLEYMAN. Again, I cannot suggest an answer to that. I 

think that is a legitimate question. It is a legitimate question you 

are asking. I mean, we had, as BSA, been engaged in a lot of notice 

and takedown activity with Megaupload, and there were certainly 

some illegal software that was part of that. 

Ms. LOFGREN. Sure. 

Mr. HOLLEYMAN. And there has now been, we both independently and obviously through Justice, have had some recourse. But 

I cannot go beyond that to talk about—— 

Ms. LOFGREN. Well, let us just use it as an example, not that—— 

Mr. GOODLATTE. Without objection, the gentlewoman is recognized for an additional minute. 

Ms. LOFGREN. Thank you, Mr. Chairman. If any of the witnesses 

have a suggestion on whether we should not have some standards 

so that innocent bystanders, if you will, have some recourse and 

rights, I would be maybe off calendar eager to hear them. 

Mr. FREEMAN. I would like to speak to that, if I may, Congresswoman. I think the key is an alignment of existing privacy and 

criminal standards with regards to search and access, regardless of 

the location or the nature of how data is stored. 

You highlighted ECPA earlier, and e-mail is treated differently 

when I print it out and put it in my desk than it is when it is on 

my computer than it is when it is on Gmail server. That alignment, 

along with a bit of international consistency, I think will solve the 

problem for both businesses and consumer. 

Megaupload is a case that, for example, highlights the use of mutual legal assistance treaties to create a coherent and enforceable 

regime. But if those standards are not consistent with regards to 

the data type, regardless of technology, and if they are not consistent internationally, there will be a lack of transparency and 

perceived lack of protection for users’ data. 

Mr. GOODLATTE. The time of the gentlewoman has expired. 

Ms. LOFGREN. Thank you, Mr. Chairman. 

Mr. GOODLATTE. And the Chair will recognize himself for questions. 

Mr. Holleyman and Mr. Freeman, what are some of the more 

egregious market access issues that BSA or Rackspace or other 

businesses have found foreign countries engaging in against American cloud computing companies in the European Union or in countries like Canada, Australia, India, Japan, China? As I prepared 

this question, it seemed to have gotten longer. We will start with 

you, Mr. Holleyman. 

Mr. HOLLEYMAN. Mr. Chairman, it is unfortunately an increasingly long list, as we pointed out in our report. I will give you two 

countries at opposite ends of the spectrum. China has a requirement that you must have a joint venture with a Chinese entity to 

provide a cloud service in China, and there is a condition of providing source code in conjunction with that. And China is no longer 

allowing joint ventures, and of course companies are rightly resistVerDate Aug 31 2005 16:02 Sep 07, 2012 Jkt 000000 PO 00000 Frm 00062 Fmt 6633 Sfmt 6601 H:\WORK\IP\072512\75311.000 HJUD1 PsN: DOUGA
59 

ing any source code disclosures. So effectively, you have a great 

wall that has been erected and continuing to be erected that is 

going to shut out companies in the China market. 

On the opposite end of the spectrum, you have the concerns I see 

happening in Germany where German government officials are 

talking about the fact that all German data should be stored in 

Germany, both high sensitive and low sensitive and medium sensitive data, not only for the German government, but for German 

citizens. And then you have a marketing campaign by Deutsche 

Telecom, which is effectively a third owned by the German government, that is invoking the PATRIOT Act and citing the PATRIOT 

Act as a reason why customers should use Deutsche Telecom’s 

hosting services over U.S. providers. 

And so I think those are two ends of the spectrum, and we need 

to address those problems in both countries. And they are just an 

example of what we see elsewhere. 

Mr. GOODLATTE. Does Deutsche Telecom still own T-Mobile? Is 

that the relationship there? 

Mr. HOLLEYMAN. Well, my understanding is that they still do, 

but I am not the expert on that. 

Mr. GOODLATTE. Following up on that very distressing point, 

having worked as hard as I have on the PATRIOT Act, what are 

some of the misconceptions that they are spreading about the PATRIOT Act, or data privacy policies in the United States in general 

that would help them steer business to Germany companies or 

other countries that may be doing the same thing? 

Mr. FREEMAN. I can tell you at Rackspace, we commonly see almost occasionally absurd positioning of what the PATRIOT Act permits to the extent that it allows almost any U.S. government agency to, without notice or warrant, access any private data that is on 

a server contained within the United States. That sort of—— 

Mr. GOODLATTE. Well, that is totally false. 

Mr. FREEMAN. That sort of fear, uncertainty, and doubt I think 

inform Canada’s FOIPA law, which is a good example of a protectionist measure that excluded U.S. participation in the marketplace. Canada passed a patient privacy bill that prohibited the 

storage of any patient health information on any server located in 

the United States based on this sort of fear and uncertainty. Now 

I think it was more of a protectionist measure that has leveraged 

that type of fear. But our great concern is that we see the same 

types of positioning being touted in marketing campaigns such as 

in Germany and the rest of Europe. 

Mr. GOODLATTE. So what do you do to counter that? Do you have 

a Rackspace Germany that is a separate entity with your cloud 

computing capabilities there, or what do you do? 

Mr. FREEMAN. Thank you, Chairman. Even having a subsidiary 

entity these days is being targeted. Essentially, there is an approach that anyone who has either a server in the United States 

or is a subsidiary or joint venture with the U.S. company is becoming suspect. 

Again, I think these are really pretenses for protectionist pressures, and that they are not based on legitimate understanding of 

the legal principles. I think the best way to deal with it is through 

education, and the establishment of international standards, and 

60 

clear statements from the U.S. government about how the PATRIOT Act works and how it is utilized and implemented. 

I think we all are sort of aware that foreign countries all have 

access in certain circumstances to data for servers that are located 

on their soil. 

Mr. GOODLATTE. I would argue most countries have far greater 

access to that data in their countries without the Bill of Rights that 

the United States Constitution provides for protection of U.S. citizens that would extend to anybody storing their data in the United 

States. 

So what do you suspect we should do with regard to this in the 

sense that it is a trade issue, that it is a protectionist policy? Have 

any of you approached the U.S. Trade Representative to address 

this issue? 

Mr. HOLLEYMAN. Chairman, I will give you a couple of answers. 

One is that the State Department has actually been very aggressive in raising this with other countries. Ambassador Riviere is 

leading that effort. There is a new myth busters document that 

State and Justice are working on to try to dispel the myths about 

the PATRIOT Act, and dispel the myth that somehow the U.S. has 

powers here that other countries have. And I think there has to be 

a bilateral, aggressive negotiation. And I also think that you see 

through USTR on efforts like the Trans-Pacific Partnership and 

building new trade agreements that deal with issues around crossborder data transfers that are related to, but an important complement to dispelling these myths about the PATRIOT Act. 

Mr. GOODLATTE. Mr. Chenok, as more data moves to the cloud, 

where do you see the future of data analytics? What are some of 

the innovations that we can expect in this new field of technology? 

Mr. CHENOK. Analytics is—— 

Mr. GOODLATTE. Put the microphone on again. 

Mr. CHENOK. Analytics runs on a parallel track, Mr. Chairman, 

if you will, with the cloud. The cloud enables companies of all kinds 

and governments to understand information regardless of where it 

sits. Through the cloud, you can use technology to get to information more effectively and efficiently and at less cost. So it enables 

the type of analytics that can be done to really make decisions very 

quickly and rapidly based on data regardless of where it sits over 

an open cloud, without having to establish point to point agreements or computer interface exchanges that might take time and 

increase costs to achieve the same level of the data coming together 

to make an analytical decision. So the two are related and mutually reinforcing. 

Mr. GOODLATTE. Thank you. Those are the questions that I have. 

Since the buzzer for the votes have not gone off yet, I will ask the 

gentleman from Pennsylvania or the gentlewoman from California 

if they have an additional question they would like to ask the panel 

of experts before we dismiss them. The gentlewoman from California. 

Ms. LOFGREN. Mr. Chairman, thank you for that opportunity. 

There was some testimony on abusive patent litigation. And it is 

something I am concerned about, but I am not sure we have got 

the energy to wade back into patent reform. But I am wondering 

61 

if we could get some suggestions on how the Patent Office itself 

might make that situation a better one. 

Mr. FREEMAN. Thank you, Congresswoman. I think it is difficult 

to approach it with the current regulatory authority of the Patent 

Office itself. I am reluctant to tell you that I have all of the solutions to the problem because it is really based on behavior—— 

Ms. LOFGREN. Well, join the club. 

Mr. FREEMAN. Yeah. It is really based on the behavior of a set 

of entities who are exploiting a system that works well in many 

cases. And there is no need to throw out the baby with the bath 

water, so to speak, but I think sort of responsive action is necessary. 

One area is particularly in regards to the development and increasing use of open source cloud software. The patent system does 

not work particularly well when it comes to collaborative open 

source projects because it really did envision more of a focus reward and innovation generating system. 

Ms. LOFGREN. Well, we did have just recently some further discussion on standard setting in the patent system and how we 

might work with that. So, again, I am sorry I was unable to get 

here for all the testimony, but I do think that when you look at 

what, as the Chairman has said, certain countries are doing in 

terms of using tools to block market access, sometimes with legitimate concerns honestly about the lack of standards in American 

law. I mean, EPCA is one of them. 

We have a lot of work to do in this area, and I am glad that we 

had this hearing, Mr. Chairman. And I think we will be working 

diligently in the coming months to address some of these issues. 

And I yield back. 

Mr. GOODLATTE. I thank the gentlewoman. The gentleman from 

Pennsylvania does not appear to have any additional questions. So 

we will thank our witnesses for their excellent testimony today. 

And without objection, all Members will have 5 legislative days 

to submit to the Chair additional written questions for the witnesses which we will forward and ask the witnesses to respond to 

as promptly as they can so that their answers may be made a part 

of the record. 

Without objection, all Members will have 5 legislative days to 

submit any additional materials for inclusion in the record. 

And with that, I again thank our witnesses. And the hearing is 

adjourned. 

[Whereupon, at 1:25 p.m., the Subcommittee was adjourned.] 

(63) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD

64 


75311A-1.eps
65 


75311A-2.eps
66 

f 


75311A-3.eps
67 

Supplemental Material submitted by Robert W. Holleyman, II, 

President & Chief Executive Officer, Business Software Alliance (BSA) 


BSAA-1.eps
68 


BSAA-2.eps
69 


BSAA-3.eps
70 


BSAA-4.eps
71 


BSAA-5.eps
72 


BSAA-6.eps
73 


BSAA-7.eps
74 


BSAA-8.eps
75 


BSAA-9.eps
76 


BSAA-10.eps
77 


BSAA-11.eps
78 


BSAA-12.eps
79 


BSAA-13.eps
80 


BSAA-14.eps
81 


BSAA-15.eps
82 


BSAA-16.eps
83 


BSAA-17.eps
84 


BSAA-18.eps
85 


BSAA-19.eps
86 


BSAA-20.eps
87 


BSAA-21.eps
88 


BSAA-22.eps
89 


BSAA-23.eps
90 


BSAB-1.eps
91 


BSAB-2.eps
92 


BSAB-3.eps
93 


BSAB-4.eps
94 


BSAB-5.eps
95 


BSAB-6.eps
96 


BSAB-7.eps
97 


BSAB-8.eps
98 


BSAB-9.eps
99 


BSAB-10.eps
100 


BSAB-11.eps
101 


BSAB-12.eps
102 


BSAB-13.eps
103 


BSAB-14.eps
104 


BSAB-15.eps
105 


BSAB-16.eps
106 


BSAB-17.eps
107 


BSAB-18.eps
108 


BSAB-19.eps
109 


BSAB-20.eps
110 


BSAB-21.eps
111 


BSAB-22.eps
112 


BSAB-23.eps
113 

f 


BSAB-24.eps
114 


75311B-1.eps
115 


75311B-2.eps
116 


75311B-3.eps
117 


75311B-4.eps
118 


75311B-5.eps
119 


75311B-6.eps
120 


75311B-7.eps
121 


75311B-8.eps
122 


75311B-9.eps
123 


75311B-10.eps
124 


75311B-11.eps
125 


75311B-12.eps
126 


75311B-13.eps
127 


75311B-14.eps
128 


75311B-15.eps
129 


75311B-16.eps
130 


75311B-17.eps
131 


75311B-18.eps
132 


75311B-19.eps
133 


75311B-20.eps
134 


75311B-21.eps
135 


75311B-22.eps
136 


75311B-23.eps
137 


75311B-24.eps
138 


75311B-25.eps
139 


75311B-26.eps
140 


75311B-27.eps
141 


75311B-28.eps
142 


75311B-29.eps
143 


75311B-30.eps
144 


75311B-31.eps
145 


75311B-32.eps
146 


75311B-33.eps
147 


75311B-34.eps
148 

f 


75311B-35.eps
149 

Prepared Statement of William Weber, General Counsel, Cbeyond, Inc. 

Mr. Chairman and members of the Subcommittee, Cbeyond appreciates the opportunity to provide a statement for the record for today’s hearing. Cbeyond provides 

cloud and communications services to more than 62,000 small and medium businesses (SMBs) nationwide; in our most established markets including Atlanta, Dallas, Denver and Houston, we provide services to more than 15% of all businesses 

with between 5 and 250 employees. Our annual revenue is nearly $500 million, and 

we have approximately 2000 employees. Forbes magazine recently named us one of 

America’s Most Trusted Companies and—together with Kraft Foods and 

Timberland—we were recently given the Points of Light Corporate Engagement 

Award of Excellence. 

I hope today to give you a brief overview of what cloud computing is, why it matters to SMBs, the role that competitive telecommunications providers play in advancing the technology and barriers that may prevent SMBs from making use of 

the cloud to create jobs and drive innovation. 

What Is Cloud Computing? 

Unfortunately, I am old enough to remember the giant computers of the 1960’s 

with their punch cards and putty-colored terminals with ghostly green type. These 

machines differed from the computers our children grew up with in that their computing power was not in the terminals themselves; the computing power was in a 

mainframe computer located in another room or another building. This was why you 

sometimes heard the machines you typed on described as ‘‘dumb terminals.’’ 

Beginning in the late 70’s and moving through the 80’s, computing power gradually migrated from the network core to the network edge. This was the rise of the 

personal computer, and as competition blossomed and prices tumbled, true computing power became available to home and small business users for the first time. 

This democratization of computing resources remade our economy and fundamentally changed the way many of us work. 

As PCs became ever smarter, faster and cheaper, we began to make demands on 

them that were difficult to achieve without a network. So we built a new kind of 

network. These new networks were fundamentally different from the old because 

now the computing power resided primarily at the edges. The networks themselves 

served to route information (like email) from PC to PC and to store information in 

central locations that needed to be accessed by many people simultaneously (like 

databases). 

Soon, though, we discovered a need to return some real computing power to the 

network itself. Let’s take a law firm as an example. By the mid-90s, law firms got 

tired of having to buy the same programs for all their computers, particularly the 

programs they used to bill their time, store and access important documents and 

organize their calendars. Software makers responded by creating versions of their 

software that could reside on a central server connected to individual computers via 

the Ethernet cables of the law firm network. Now multiple attorneys and assistants 

could access the same central information, bills could be generated automatically 

and the vast document databases that made legal work simpler could be shared, 

searched and accessed by dozens of people simultaneously. 

This model worked well, but it had one major drawback: it required the law firm 

to maintain what amounted to a server farm on their premises and extensive Information Technology (IT) staff to take care of the servers and the internal network. 

It was also capital intensive because the firm had to purchase enough servers to 

run their enterprise software applications and back all those applications up. And, 

of course, they had to buy more resources than they actually needed to account for 

potential growth and be able to respond immediately to problems with an individual 

server; for a law firm—as with any other business—downtime would mean lost revenue. And this brings us to what people call ‘‘the cloud.’’ 

So what is the cloud? At a high level it is the movement of server-based computing power off the premises and onto servers that users access in a remote location over a private network or, in many instances, over the Internet. You already 

know about more consumer-focused, cloud-based services than you may think. 

Netflix’s streaming video service is one. Facebook is another. Both these applications store vast amounts of information on remote servers somewhere on the Internet and deliver that information (and the computing power necessary to process it) 

to you on demand. 

150 

Why Do SMBs Care About the Cloud? 

Understanding the basics of cloud computing is important, but it is just as important to understand how the businesses in your home districts use the cloud. A few 

examples might look like this: 

• A seventeen-location Los Angeles furniture company sending all of its security 

footage directly to the cloud where they can store it securely and use server 

processing power to review and search it. 

• A major insurance company with its US headquarters in Minnetonka moving 

its IT test environment to Amazon servers to avoid the capital costs associated with purchasing dozens of servers it will only need several times a year. 

• A mid-size law firm with offices in Atlanta, Charlotte and Louisville moving 

its billing, time-keeping and accounting software to Cbeyond servers so that 

all of its offices can access the same data at the same time. 

• A group of orthopedic surgeons in Denver moving all its patient records to 

the cloud to avoid the cost of maintaining the servers necessary to store, 

search and access x-rays and to ensure it meets its HIPPA obligations. 

Why would these businesses want to move these applications and information to 

off-premise servers? There are many reasons, some of which are embedded in the 

examples above. First, getting someone else to manage their servers allows an SMB 

to focus on their business rather than their infrastructure. Lawyers want to practice 

law, doctors want to practice medicine, real estate agents want to close deals and 

architects want to design buildings. They don’t want to spend time taking care of 

internal IT resources. Cloud computing allows them to realize this dream. 

Second, cloud computing allows companies to preserve capital. Rather than buying 

servers that they then have to pay to maintain and upgrade, the business can rent 

only the server capacity it needs for the time it needs it. There are no installation 

cycles and no need for extra square footage or additional air conditioning or electrical upgrades. 

Third, cloud computing is fundamentally more secure in a variety of ways. It is 

physically more secure because data centers—unlike most places of business—are 

consciously designed to the highest access security and fire control standards. Business data is also more secure because a server operating in a data center is monitored around the clock and potential failures can often be detected and dealt with 

before they occur; this kind of monitoring and response simply cannot occur in SMB 

IT environments. Data in the cloud can be backed up to multiple, geographically diverse locations automatically; if there is a tornado that destroys a data center in 

Indianapolis, a business can seamlessly and without pause access that data from 

its duplicate in a Denver data center. And, finally, servers in a data center are sitting behind the most sophisticated, well-monitored firewalls available, and their 

anti-virus software is constantly updated with no intervention or action required by 

the business; it’s all part of the service a business buys when it moves its data to 

the cloud. 

Fourth, cloud computing gives a business IT flexibility in that they can grow and 

shrink their computing resources on-demand, preserving both capital and time. If 

a business needs to test major software releases under heavy loads a few times a 

year, it can simply spin up cloud servers, run their tests and then spin them down, 

saving time, saving money and avoiding the cost of infrastructure it has only occasional need for. 

Finally, the cloud allows businesses to increase IT velocity. If an innovator has 

an idea, it can be put to the test immediately. No more waiting for a server to ship 

and get installed. This compresses planning cycles, keeps our entrepreneurs focused 

on innovation rather than the infrastructure of innovation and allows new ideas to 

launch at the speed of the idea rather than the speed of FedEx. 

How Do Competitive Telecommunications Providers Help SMBs Take Advantage of Cloud Computing? 

If my comments thus far make cloud computing sound like the answer to many 

of the problems that SMBs confront as they launch or grow, good. Because that’s 

an accurate view: cloud computing helps preserve capital, increases security and 

makes launching or growing a business both cheaper and faster. But SMBs need 

help to make the best use of cloud computing, help that can only come from their 

service providers. 

Unlike the large businesses that first began making use of the cloud, SMBs do 

not have extensive IT resources. They don’t know how to move the applications that 

151 

run their business into the cloud, and they don’t know how to migrate the associated data. In fact, they generally don’t even know what cloud computing resources 

they actually need to do whatever it is they want to do. 

The large telecommunications and large cloud-only providers do a great job serving enterprise businesses with big IT staffs who know exactly what they need. The 

giant telecom companies and cable providers also provide high-quality services to 

the small businesses that need basic services like Internet bandwidth, phones and 

email. But what about the sophisticated SMB that wants to use the cloud to preserve capital for job creation and innovation? They are in a tough spot: they don’t 

have the IT staff to help them with their migration to the cloud, and the big cloud 

providers are not set up to help them get QuickBooks and similar enterprise applications up and running in their data center. This is where companies like Cbeyond 

can help. 

Competitive telecommunications providers are the experts in the technology needs 

of SMBs because it’s all we do. We have direct sales people who introduce businesses to the power of the cloud and personnel whose only job is to help businesses 

choose exactly the resources they need for the job at hand. We innovate to serve 

our small business customers by creating cloud offerings tailored specifically to their 

needs, building applications specifically designed to migrate their data and providing the kind of personalized support they need to succeed. In short, without competitive telecommunications providers, most SMBs will simply be shut out of the 

cloud computing revolution to the detriment of our economy, our unemployment rate 

and our global competitiveness. 

What Are the Barriers that May Prevent SMBs from Making Use of the 

Cloud to Create Jobs and Drive Innovation? 

As the Committee well knows, small business is the economic engine that drives 

our economy and creates more jobs than any other sector. Small businesses inject 

almost a trillion dollars into the economy each year. They have created more than 

ninety-three percent of all new jobs over the last twenty years and employ more 

than half of the U.S. workforce. They also employ forty-one percent of the nation’s 

high-tech workers who generate about thirteen times more patents per employee 

than do workers at large firms. SMBs that want to leverage the cloud to launch, 

grow, innovate and create jobs face two primary obstacles: assistance with their migration—which I discussed above—and abundant, high-quality bandwidth. 

Cloud services are broadband intensive. Unlike traditional web-based services in 

which the heaviest bandwidth usage is downstream-only, an SMB using QuickBooks 

or other applications in the cloud is sending and receiving large volumes of data in 

both directions; it needs at least 10 megabits per second of private, symmetrical 

Ethernet bandwidth. While this may not sound like a lot in an age when cable companies routinely dangle 100 Mbps claims in the market, the key adjectives here are 

‘‘private’’ and ‘‘symmetrical.’’ What this means in plain language is that an SMB accessing cloud-based enterprise applications needs bandwidth that is not shared and 

has a guaranteed upstream speed that is the same as its guaranteed downstream 

speed. 

Unfortunately, competitive technology providers—the real innovators in the cloud 

for SMBs—are limited by aging rules administered by the Federal Communication 

Commission (FCC) that have the perverse effect of locking small businesses into the 

broadband status quo of six years ago, undercutting the normal business cycle of 

innovation and denying our nation’s SMBs benefits they should have received as 

broadband technology improved. These rules force competitive technology providers 

to buy the wholesale broadband inputs they need to reach their customers in small, 

1.5 Mbps increments of time-division multiplexed (TDM) bandwidth; TDM technology was invented in the 1870s for the telegraph and evolved to its current form 

in 1962. This broadband gap leaves the rollout of the best cloud technologies almost 

exclusively to in the hands of large enterprise customers while innovative technology competitors try to serve SMBs, the job growth engine of our economy, with 

inadequate bandwidth resources. And—worst of all—SMBs are left using twentieth 

century business tools to try to create jobs in a twenty-first century global marketplace. This is no small issue. 

The FCC could fix this problem simply and almost without cost by implementing 

relevant provisions of the Business Broadband Docket which have been languishing 

at the FCC for almost three years: the FCC should ensure the survival of a competitive market by requiring the giant phone companies to sell—at retail prices—the 

packet-based bandwidth necessary for technology competitors to provide cloud services to SMBs. Unleashing this existing broadband capacity for use by technology 

competitors at market-based rates will create an immediate cycle of investment, inVerDate Aug 31 2005 16:02 Sep 07, 2012 Jkt 000000 PO 00000 Frm 00155 Fmt 6601 Sfmt 6621 H:\WORK\IP\072512\75311.000 HJUD1 PsN: DOUGA
152 

novation and job creation by allowing our most entrepreneurial SMBs to do what 

they do best: focus on innovation rather than infrastructure. 

Mr. Chairman and members of the Subcommittee, I appreciate the Committee’s 

interest in this important topic and thank you for the opportunity to provide this 

statement for the record. 

Æ