RCP Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.

Pender's Blog

Blog archive

LAPD Rejects Google's Cloud E-Mail

Did anybody really think this was going to work? Did Google really expect to impress Joe Friday with something called "the cloud"? Just listen to that tone, so flat and humorless. Soak in the foreboding nature of the "Dragnet" theme. This guy was going to send his e-mail -- strictly the facts, of course -- into something called "the cloud"? Think again, mister.

Google made a big splash when it won the deal to provide e-mail services in the cloud for (as Jack Webb flatly drones it) "the city, Los Angeles, California." But the tough, no-nonsense LAPD (yes, we're kind of conveniently forgetting at least the last 20 years or so here) has put the kibosh on that idea, saying that cloud e-mail didn't meet the city's security requirements for the cops.

There's so much to talk about here that we can almost feel the carpal tunnel syndrome setting in (although Joe Friday would have typed right through the pain), but we'll pick out a few things to observe. First, what a mess. Can anyone tell that public employees are at work here? Check out this revealing little passage from the Los Angeles Times story linked above:

"There was definitely a time when Google seemed positive they were going to meet the requirements," said Maggie Goodrich, the Los Angeles Police Department's chief information officer.

She noted, however, that the rules were written for law enforcement agencies that store their own data and did not consider the increasingly popular cloud computing model.

"It will be difficult for law enforcement to move to a cloud solution until the [security requirements] and cloud are more in line with each other," Goodrich said.  

Uh, OK, Maggie Goodrich. So, you took everything into account in this deal except for that little bit about Google running e-mail in the cloud. Really? The cloud was the whole point of the deal -- it saves money, cuts down on need for staff and maintenance, and so forth. But now, the LAPD is saying, "Oh, wait, we don't want cloud-based e-mail after all." That's kind of like saying, "I bought a bicycle, but what I really wanted was a car. Oops!" It's a hard mistake to make.

Let's move on and go back to the L.A. Times story:

For its part, Google noted that the complicated security rules were not part of the original contract it signed with Los Angeles in 2009 and that the city raised the issue well after the deal had been completed.

"We're disappointed that the city introduced requirements for the LAPD after the contract was signed that are, in its own words, 'currently incompatible with cloud computing,'" Google spokesman Andrew Kovacs said in a statement. He also noted that 17,000 employees were successfully using the Google system and that it had already saved city taxpayers "more than two million dollars."

Hey, Google, did you think to ask about the cloud? OK, we've established that the city of Los Angeles was not at its Joe Friday finest in singing this deal. But Google, did you at any point just happen to bring up questions about the cloud and security requirements, or did you just figure you'd go ahead and implement everything and maybe nobody would notice? "Shh, ix-nay on the oud-clay...I think we've got them." Bizarre.

What's even better is that Google issued a nothing-to-see-here, everybody's-out-to-get-us defense when this issue first cropped up publicly back in October. Check this out from RCPmag.com's own Kurt Mackie:

In December 2009, Levin had explained that the city planned to move "all 30,000 city employees to Google Apps from our existing [Novell] GroupWise email system," according to a Google blog post. She noted then that "everyone will benefit from Google's security controls." The Consumer Watchdog letter to Villaraigosa, dated Oct. 18, 2011, claimed that "a mere 17,000 city employees use the Google system while 13,000 LAPD and other employees involved in law enforcement cannot make the move."

A Google spokesperson, without clarification, issued the following statements, asserting that its competitors were engaged in a publicity stunt, and that the city introduced new requirements to meet.

"This is just the latest in a long list of press stunts from a group that admits to working closely with our competitors," Google stated. "We are meeting our commitments to the City of Los Angeles. Indeed, the City recently renewed their Google Apps contract for 17,000 employees, and the project is expected to save Los Angeles taxpayers millions of dollars.

"The City has acknowledged Google Apps is more secure than its current system. Along the way they've also introduced new requirements which require work to implement in a cloud computing environment, and we've presented a plan to meet them at no additional cost."

But wait, it gets better. Are you ready for the plan? You're not ready for the plan. It doesn't exactly involve Google actually meeting any requirements. It's way funnier than that. Let's go back to the LA Times story:

In a unanimous vote, the City Council agreed to change the terms of its $7.2-million contract with Google so that LAPD employees and others will stay on an older on-site email system. Google will pay up to $350,000 per year for those employees to use that system, which is run by Novell, a competitor.

That's the plan: Google is going to pay the LAPD to stay on GroupWise. GroupWise! At this point, your editor needs to get a Subaru to pay his wife for driving her '98 Corolla. This is just brilliant work by Google -- punt, and then pay to keep the client on an e-mail system that actually used flint and stone. (Well, not really; we can't remember what GroupWise was like.)

Hey, we're fans of the cloud here at RCPU. But this scenario does make us wonder whether we should all tap the breaks on the cloud a little bit. Yeah, there's a lot of officious government interference at work here, namely the security requirements for e-mail, that might or might not really be necessary.

But if a major law enforcement agency simply rejects cloud e-mail (forget about it being from Google; we're talking about the cloud in general here) because it doesn't deem the system secure enough, is cloud-based messaging secure enough for your business? How much is your data worth, and to what lengths will you go to protect it? It's just something to think about amid the cloud hype. We're pretty sure we know what Joe Friday would say, though.

See Also:

Posted by Lee Pender on December 15, 2011 at 11:57 AM


comments powered by Disqus

Reader Comments

Thu, Jan 12, 2012 Washington DC

The security requirements have been long established by DOJ in the CJIS--Over 100 pages of complexity. They are and have been tough, but they don't rule out contracting out ("outsourcing" in 3.2.1) to the second or third level. They also explicitly discuss virtual machines with realistic requirements But letting an onsite or offsite contractor make the decisions is not part of the deal (e.g. 5.1.2.1 [Any Service Provider changes have to be managed by the Criminal Justice Agency.]) It probably could be done by Google, but possibly not tolerated and maybe not in their pricing model. For an example of non-compliant CJIS cloud, look at Drop Box which does encrypt your data when it gets to them, with a password that they and only they know.

Wed, Dec 21, 2011 Willem Bagchus Washington, DC

Here's a writer in need of some serious fact-checking. While the great debate rages over whether it's better to keep your data onsite or in the cloud, the author makes stupid remarks about GroupWise, having made no effort at all to see whatever became of it. All he had to do was to do a Google search to realize that, "hey, what do you know -- GroupWise is not only alive and well, but GroupWise 2012 is just about to be released!" Flint and Stone? Seriously? Having had some familiarity with the case of the City of LA and LAPD's GroupWise system, this is yet another one of those "Never mind the facts, I want to switch off of GroupWise" emotional decisions. Once Microsoft had thoroughly alienated the powers that be in LA, what were they left with as an alternative? Especially when the IT folks were pretty vocal about not wanting to switch. It took a serious amount of 2+2=5 type charts on the part of those who were pushing for the change to get it done, especially when GroupWise itself continued to function there with little, if any, maintenance. Was the city saving money? Maybe if 2+2 really did equal 5. When true costs were added up, it was yet another one of those pet project expensive boondoggles by people who just wanted to make a big name for themselves, regardless of the fallout.

Wed, Dec 21, 2011 Bryan

Some concise and interesting comments here. The most interesting is "That paradigm is over, and anyone who is afraid of the future (now pretty much the present) and keeps insisting on running their own systems ...". Sorry, but that's just not reality. The vast majority of large organisations do, and probably will always, run their operations internally. Some of these organisations have data centres that dwarf even the largest cloud providers .. and applications that simply don't work well in the virtual cloud world. Why would they ever move to a hosted, external solution? Instead, I work with them to deliver flexibility, rapid provisioning, an simplified management for their internal infrastructure. This is what they need and want. They have no interest in an external solution, but they do want to maximize their IT investment, which means bringing some of the cloud capabilities in-house. This is reality. As for the issues with LA and Google, it seems everyone made mistakes .. no surprise that the competitors are making the most of it. That's how the system works. When your competitor makes a mistake, you shout about it. But I bet Microsoft will be much quieter when their own cloud issues surface. :)

Mon, Dec 19, 2011 Ford

The author's argument against GroupWise / Novell is more akin to "Don't buy FORD, once they made the Model T."

Sun, Dec 18, 2011 Jay

Wow, what a lame hatchet job. You're blaming Google for the city adding additional requirements? It's Googles fault that the cities data policy is outdated and requires that their data must remain on site? The really sad part of this is that the city will NEVER be able to afford network security professionals capable of securing their data where as google could. The cities outdated rules virtually guarantee that their data will be breached. Once again political turf battles block inovation and progress. What's worse is that YOU are reveling in their stupidity for no better reason than the fact that Google won the contract instead of Microsoft. Had it been Microsoft 365 I'm sure you'd have been singing a different tune. Lame.

Sat, Dec 17, 2011 Randy Bellevue, WA

Lots of good comments here. The article would have been better had the author researched the publicly available information on the problems. Yes, there was an internal political battle between the City and LAPD. The city failed to take into considerations the requirements of all their divisions. That anyone would fail to understand why a police department needs more security than the average user is frankly amazing, and frankly ANYONE following cloud computing should have seen the very public failures in security - to say nothing of operational deficiencies within google. The 'flint and stone' comment was clearly directed at the concept of internal physical servers, not Groupwise itself. The comment also betrays a certain youthful naiveté common in IT where the latest fad is the only worthwhile option, where historic lessons are unlearned at the speed of light (or promotion). Sadly IT does not hire the best and brightest, merely the adequate. Lee does not quite fall into the trap, but misses it only by a whisker. Security takes time. Evaluating security takes longer. Ensuring a system is secure is an ongoing process that takes longest of all. Cloud computing is just the latest fad in IT, a field driven by fads like sheep by wolves. Yes, it has it's place but like every other IT fad it will achieve a certain market penetration as the limits of it's utility are reached and then pundits will jump on the next technical bandwagon that is sure to become a universal panacea. The problem is not with the technology, which has it's place but with the IT industry's inability to understand risk, reward and how that applies to business. 'Cloud computing' is nothing more than rapid provisioning of hosted solutions. When economies of scale can be achieved it may be compelling. Add sufficient competition and the cost MAY be competitive with an internal solution. But the scale is offset by additional monitoring, business overhead and the eventual security and guarantees necessary to satisfy all requirements. And all that equipment that has to be paid for and replaced on the same cycle as your internal cycle. Once those costs are added in the solution may not be as compelling, and it certainly will not be under all conditions. Keep your eye on the cloud, but don't be blinded by it.

Fri, Dec 16, 2011 dzanre Colorado

I'm afraid the most recent "unnamed" commenter is assuming that there are no options other than the cloud, and that the cloud is a panacea for all that plagues IT. It is not, and the vast majority of my customers are not yet ready or comfortable with the idea of their proprietary data out in "the cloud". This isn't head-in-the-sand talk. This is simply customers feeling a need to control their data. Customers have the option of state-of-the-art modern in-house systems as well as cloud computing, and the cloud is not an inevitability. At least not yet.

Fri, Dec 16, 2011

Most of the comments keep pointing out that the GroupWise mention in the article wouldn't be relevant if the CITY had just upgraded their version of GW and, if necessary, upgrade aging server hardware. What these comments ignore is that this is precisely the problem (and cost) that the cloud solves. No need to think about the old "flint and stone" concept of updating software, and no need to keep upgrading server hardware. That paradigm is over, and anyone who is afraid of the future (now pretty much the present) and keeps insisting on running their own systems is akin to the person who still refuses to upgrade IE6 or yearns for the days of Windows 95 still being supported... or worse, Windows 3.1.

Fri, Dec 16, 2011 Rob Louisiana

The most obvious problem in this story is the CITY. I am the Network Manager for a fair sized municipality. We purchase our Novell products through a Master License Agreement - MLA. The MLA provides all product upgrades at NO ADDITIONAL COST over the annual support costs. That being said, we have upgraded our GroupWise system many times here at my city, we are on the most current revision - running on linux - and are planning to implement GW2012. If my city, which is no where near the size of the City of LA, can keep products upgraded to current revisions, what is the problem in LA? Manpower? As I said, we are a fair sized city, and for the last 10 years we've only had 2 network managers, and I am the only one who managed the GW system. That IS one of the advantages of GW - it is easy to maintain.

Fri, Dec 16, 2011 Den Kansas City

The crux of the matter for me is that the new LAPD requirements were issued after the contract was signed. That's what I'd call a major case of feature creep, on the part of the client. As someone who works for an engineering firm, I've seen this a lot over the years. The client wants something that was never covered in the scope of work, and when we point out that it will need to be paid for via an addendum, there's a lot of finger-pointing and disagreement, but sooner or later we get things ironed out. Perhaps Google didn't do their due diligence, but it sounds like the LAPD is more at fault here. Anyway, I'm sure this isn't the last controversy we'll see as more business functions move into the cloud.

Fri, Dec 16, 2011 Gert Netherlands

GroupWise is to a great collaboration system with a) Mobility for all mobile devices, BlackBerry / RIM has its BES server app for GW, b) has no Patch Tuesday, way less admins than Exchange, c) keeps updating its user interface (which is NO outlook, but GroupWise), sod) just respect the fact that people appreciate a collaboration soluton that is NOT what you know, yet GW is still worthy for #millions of users, so IMO you are the one who does NOT know what he[s talking about, since IMO you lost your interest in GW. we dont and I certainly will not stand to have someone blame GW cause thats all they can think of. wish you well and next time talk better than you dd this time for an editor. GW runs on Linux, on Windows, on Mac and on OES (NetWare to be continued), and more people should first think twice before pointing a finger at something they didnt mind finding info out and expecting the rest of us just to accept that. '

Fri, Dec 16, 2011 jmmarton Illinois

The only "flint and stone" is the ancient version of GW that the City & LAPD was using. That would be the same thing as calling Exchange "an e-mail system that actually used flint and stone" just because someone was still on Exchange 5.5. Sure, that version is may seem prehistoric compared to what's available today but that's also remedied by upgrading. All the City & LAPD needed to do was upgrade to current versions of GW and, if necessary, upgrade aging server hardware.

Fri, Dec 16, 2011 Dzanre Colorado

I'd like to point out that your '98 Corolla comment actually shows that while you harangue the City and Google for their choices and lack of proper planning and due diligence, you suffer from the same problem. The CITY had not upgraded their Novell GroupWise system, but that doesn't mean upgrades weren't available to the City. If you don't "remember what GroupWise was like" then you probably also don't know that Novell GroupWise 2012 will ship next month, and continues to be developed and improved.

Add Your Comments Now:

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Comment:
Please type the letters/numbers you see above