Military use of cloud services – possibilities and challenges

During the last 10 to 15 years, the use of cloud services has increased considerably, and a large number of organizations have switched to such services, or is considering doing so. The term ‘cloud service’ itself has also become well established, and most people probably associate it with functions or services available over Internet. However, there are many different opinions on what cloud services really are, in terms of both technology and business. This report has two purposes. In part, we want to give an introduction to cloud services in general, and explain what they are and involve. In addition, we look at how the Norwegian Armed Forces differs from civilian organizations with respect to using cloud services, and we discuss factors to consider when introducing such services. For the latter, we have focused on the operative side of military ICT, since this is where we find the biggest differences from civilian use of ICT. To ensure that we cover sufficiently many characteristics of the Norwegian Armed Forces, we have used an existing framework, consisting of seven solution properties: information system security, availability, functionality, robustness, sustainability, interoperability, and flexibility. We have then compared this framework with the properties that characterize cloud services. We found that the major suppliers of cloud services are very good at handling security, but much is still unclear when it comes to approval of cloud services for classified information. To the extent that such approval will be possible, some of the economies of scale-benefits of cloud services will probably be lost. In addition, factors such as new possibilities for big data analysis may require care risk analysis, even when storing unclassified information in the cloud. A number of factors may negatively affect the availability of cloud services, such as unclear sharing of responsibilities between providers, changed political conditions in the provider’s home country, and will and ability of civilian operating personnel to maintain the quality of service in a crisis or war situation. Therefore, it is important to avoid vendor lock-in as far as possible, so that the possibility of switching provider of cloud services remains open. Using cloud services for operative tasks is possible, but as we show in this report, there are several factor to take into consideration. However, through effective use of distribution and redundancy, cloud services can be made very robust, but probably at a higher cost than is normally seen for cloud services. If the Norwegian Armed Forces wishes to use cloud services for operative tasks, and in particular, close to combat, we recommend to first perform a thorough evaluation on what is realistically possible within the constraints of technology, economy and security.