Enterprises are increasingly interested in cloud computing as a potential solution to capacity challenges. The idea is that if you have a virtualized data center, the cloud could potentially be an “overflow” data center where you expand capacity during periods of high demand. If the cloud can extend your data center, then you don’t need to build another one or increase the capacity of the one you have just to handle intermitted spikes in computing demand.

It’s a great idea, at least in theory. A few of the companies that Nemertes advises are already looking into cloud computing and trying to decide how to approach it. Cloud offers the possibility of capacity on-demand, effectively a dial that you can tweak to increase or decrease computing capacity, while paying only for what you use. Not only can this save money on infrastructure, but much more importantly provides tremendous flexibility for launching new applications or even business lines with minimal capital investment. If they come, you will build (rent) it.

Many of the key challenges on cloud computing arise at the border between your infrastructure and the cloud. How do you move resources from one side to the other? Is the cloud application dependant on storage that resides on your side of the border? What impact will that have on the bandwidth requirements? And how do you seamlessly move virtual machines between the cloud and your data center as demand grows and shrinks? These are all valid and interesting questions. But an even larger question looming like a dark cloud on the horizon is that of jurisdiction and legal status. Is stuff in the cloud on the same legal footing as stuff in your data center?

Turns out that currently, stuff in the cloud is not on the same legal footing as stuff in your data center. Unfortunately, the legal precedents being set around the country are potentially devastating for enterprise adoption of cloud computing. The executive branch is repeatedly taking the position that data stored in the cloud does not have the same assumptions of privacy and due process as does data stored in your own infrastructure. The very fact that you put the data “out there” somehow strips any “expectation of privacy” which is a key criterion for the level of due process protection (based on my limited understanding of law). A recent decision by the Sixth Circuit Court of Appeals (Warshak v US) seemed to agree to this idea of a lower “expectation of privacy”.