Trusting Records in the Cloud

The near ubiquity of “the cloud”—networked storage and infrastructure as well as platforms, software, business intelligence, and other services—may be one of the hallmarks of our daily lives in the twenty-first century. Beyond our personal use of social media, email, and collaborative tools such as Office 365 or G Suite, governments, businesses, and educational institutions have increasingly turned to cloud-based products for cost-savings and efficiencies, with a 2019 report from Gartner, Inc., noting a 17.5 percent increase in spending on public cloud services from 2018, growing from $182 billion to $214 billion.¹ The archives and records management fields have likewise joined in this shift, with organizations taking advantage of cloud storage as well as end-to-end digital preservation solutions (e.g., Preservica and ArchivesDirect) and emerging services such as the Emulation as a Service Infrastructure (EaaSI) project.²

While the benefits of moving archives and records management operations to the cloud may be defined in terms of cost savings to IT budgets and increased technical capacity, the challenges and risks associated with this transition are less clear. How can we collaborate effectively and responsibly with cloud service providers? What steps should we take to ensure the ongoing authenticity and integrity of content stored across remote data centers and directly managed by third parties? How do end-users across sectors—employees and management, researchers and scholars, citizens and public officials—conceive of and rely on records that may comprise data points stored in diverse online systems?

Given these and other questions, the 2019 publication Trusting Records in the Cloud is a timely contribution to the professional literature. Edited by Luciana Duranti and Corinne Rogers with contributions by a diverse array of fifty-three scholars and practitioners from around the globe, the volume's twelve chapters and two appendixes define key terms; identify significant issues and challenges around the adoption of cloud services; outline important strategies to maintain the authenticity, integrity, and reliability of assets stored in the cloud; and highlight the evolution in the education and work responsibilities of archives and records professionals.

At the same time, readers should note that Trusting Records in the Cloud is not an introduction to the cloud or a primer on storage options and other services provided by vendors. Rather, as the editors note in the opening sentence, “This book presents the main finding of InterPARES Trust, the fourth phase of the InterPARES project” (p. 1). Based at the School of Information at the University of British Columbia (UBC), the International Research on Permanent Authentic Records in Electronic Systems (InterPARES) project was launched in 1998 with support from the Social Sciences and Humanities Research Council of Canada (SSHRC). Duranti (chair and professor of archival studies at UBC, director of the Centre for the International Study of Contemporary Records and Archives, and the InterPARES project director since its inception) and Rogers (an adjunct professor at UBC, systems archivist with Artefactual Systems, and the InterPARES project coordinator from 2013 to 2019) have situated Trusting Records in the Cloud within the larger context of InterPARES, and so a brief overview of the project's history may be helpful to better understand the present volume's focus.

In its initial phase (1999–2001), InterPARES “focused on the preservation of the authenticity of electronic records that are no longer needed by the creating body to fulfill its own mandate, mission or purpose.”³ InterPARES 2 (2002–2007) expanded this scope of inquiry “to develop and articulate the concepts, principles, criteria and methods that can ensure the creation and maintenance of accurate and reliable records and the long-term preservation of authentic records in the context of artistic, scientific and government activities.”⁴ In its third phase (2007–2012), the project took the results of its earlier iterations and explored how “to enable public and private archival organizations and programs with limited resources to preserve over the long term authentic records that satisfy the requirements of their stakeholders and society's needs for authentic records” (p. 3). In recognition of the “increasing creation, storage, and/or preservation of data/records in online environments,” the fourth and most recently completed phase of InterPARES (referred to as InterPARES Trust or “ITrust” and active from 2013 to 2018) addressed the crucial question of “trust” as related to records stored and disseminated online. To that end, the project sought to produce “frameworks that would support the development of integrated and consistent local, national and international networks of policies, procedures, regulations, standards and legislation concerning digital records entrusted to the internet” (p. 3). To advance this ambitious goal, the ITrust project relied upon seven regional teams (from North America, Latin America, Europe, Asia, Australasia, and Africa as well as a group of “Transnational Institutions”) to conduct research and testing in five domains (infrastructure, security, control, access, and legal) as well as five cross-domains (policy, social, terminology, education, and resource) (pp. 4–6).

An awareness of this orientation is important; given that my own experience with cloud services is limited to my role as an end-user, I initially approached the book with the hope of learning more about specific cloud offerings and how they could be implemented in a digital preservation program. However, after learning more about the ITrust project and reflecting on the fact that cloud services are rapidly evolving, with general information about them available elsewhere, I now have a greater appreciation for the volume's focus on key functions and issues related to trust that are not tied to any specific platform or technology. Readers who are unfamiliar with the cloud and associated service offerings may thus choose to conduct some preliminary research to reap the full benefits of this volume, but they will also be enlightened by chapter 2 (“The Cloud—Challenges and Issues”), in which Julie McLeod (professor of Records Management in the Northumbria University iSchool) defines “the cloud,” gives a brief overview of service models (e.g., “Infrastructure-as-a-Service” and “Software-as-a-Service”), and calls out “technology and functionality issues” that threaten our collective trust in online records (pp. 13–16).

Trusting Records in the Cloud goes on to offer practitioners and scholars much in regard to the expectations and behaviors of user communities as well as important considerations that are widely applicable to archives in various sectors. Chapters 3 (“Open Government,” edited by Elizabeth Shepherd, professor at University College London) and 4 (“Citizen Engagement,” edited by Fiorella Foscarini, associate professor in the Faculty of Information at the University of Toronto) were of particular interest; while they address citizen interaction with government records, the underlying issues and themes are broadly applicable. Insight into concerns about the accuracy and authenticity of aggregated data, safeguarding individual privacy in publicly available records, engaging with users through social media, and employing user analytics to appraise websites are likewise relevant to archivists and records managers in a broad range of institutions. Chapter 10 (“Cultural Heritage—Indigenous Perspectives,” edited by Gillian Oliver, associate professor of Information Management at Monash University) also addresses areas of concern for professionals engaged in community archives and the archival profession more broadly as societies grapple with long-standing questions of systemic racism and white privilege. The juxtaposition of studies related to Canada and New Zealand, with background on the development (or lack thereof) of trust between governments and Indigenous communities, illustrate how this plays out in the representation of diverse perspectives in online collections.

Practical guidance offered to archivists and records managers in regard to managing and preserving content in cloud environments nicely complement these in-depth studies of users. Chapters 5 through 9 (edited, in order, by Basma Makhlouf Shabou, professor at the Geneva School of Business Administration; author and InterPARES researcher Patricia Franks; Hrvoje Stani, professor at the University of Zagreb; Giovanni Michetti, associate professor at Sapienza University of Rome; and independent consultant Adrian Cunningham, formerly of the National Archives of Australia) examine specific aspects of our interactions with records. Topics include general approaches to information governance, implementing retention schedules and disposition strategies, verifying content authenticity, establishing intellectual control (via arrangement and description as well as metadata schema), and key considerations for a cloud-based digital preservation program. The expert contributors provide clearly understandable recommendations on policy development, collaborating with cloud service providers, and requirements to arrange, describe, and preserve cloud-based content over the longterm. There are a few instances where research subjects may not be directly transferable to daily practice (e.g., a blockchain solution dubbed TrustChain that would be “maintained by an international alliance of archival institutions” [p. 149] and used to track file checksums), but even these have value by pushing the boundaries of archival and digital preservation research.

The final two chapters, “The Role of the Records Professional” (edited by Tove Engvall, adjunct lecturer at Mid-Sweden University) and “Education” (by Victoria Lemieux, associate professor at UBC; and Darra Hofman, a PhD candidate at UBC) look to the future of the archives and records management professions by exploring core responsibilities and essential competencies as related to cloud-based preservation environments. The former chapter highlights the evolution of the records profession and presents an ontology documenting nine high-level functions (e.g., governance, monitoring and auditing, appraisal, preservation, etc.) and 105 associated subfunctions (p. 227). While the text emphasizes continuity with traditional archives and records management practices, there are also exhortations to include records professionals in system development and a catalog of required competencies and skills. The final chapter extends this exploration to make the case that “the education of records professionals requires an updated educational framework that draws upon diverse sources of knowledge and recognizes that the application of archival knowledge will take place in an increasingly broad range of professional contexts” (p. 245). By analyzing the reports from other ITrust studies, the authors seek to identify specific archival competencies and underlying educational models to better understand how future archives and records professionals can be prepared for careers. Taken together, these chapters may be especially useful to managers and archival administrators as they seek to evaluate their institutions' capacity to address cloud-based records and assess their workforce needs.

Archivists and records managers face significant challenges as they seek to maintain the authenticity, integrity, and reliability of important administrative and historical records stored in the cloud. While existing digital preservation tools and strategies will no doubt play a role in these efforts, new policies and approaches to collaborating with service providers will be required, as will a more nuanced understanding of the needs and expectations of users. While a number of relatively recent journal articles and conference presentations have addressed the topic of digital preservation in the cloud,⁵ they have largely focused on costs and examples of implementations. Trusting Records in the Cloud thus fills an important gap in the professional literature by directly addressing questions of how to establish and maintain trust in records and systems. Along with the individual studies and reports produced by the ITrust initiative, this volume will do much to prepare institutions for the hurdles we will inevitably face in coming years.