Hosted E-mail: What Government Needs to Know

Consumers love hosted e-mail, but governments aren't comfortable with applications they don't fully control.

by / April 19, 2009

Plagued by razor-thin budgets, government IT leaders can't always procure the best technology for providing citizens with 21st-century service delivery. To save money, more agency managers are paying vendors to provide hosted solutions, saving agencies from buying multiple product licenses and the requisite machinery.

This is a growing trend, at least when it comes to hosted e-mail -- in which clients' e-mail exchange technology is housed on vendor servers instead of their own.

The Radicati Group, a market research company, confirmed its rising popularity in an August 2008 report that found there were nearly 1.6 billion worldwide users of hosted e-mail -- between both consumer and business e-mail. The report estimates that there will be 2.2 billion users by 2012, which is a 9 percent annual average growth rate.

"A Web-hosting company literally is the entity that manages most of the daily aspects of your Web site or Web sites. The same is true with e-mail," said James Driscoll, former senior sales representative for LuxSci, an e-mail hosting company. "An e-mail hosting company takes responsibility for the provisioning of your account initially and the management and maintenance of your account on an ongoing basis, so that all you have to do is come into your office in the morning, turn your computer on and up comes an e-mail program."

And even when a host manages the hardware, software and applications associated with an agency's e-mail, users typically see no difference when using a standard front-end tool, like Microsoft Outlook.


E-Mail in the Cloud

Government is no stranger to the world of hosted messaging. For example, Washington, D.C., personnel can use the Gmail that comes with the Google Apps platform of hosted solutions the city has used since spring 2008, which is available on the intranet. Former Chief Technology Officer Vivek Kundra said his office considered deploying a $4 million enterprise intranet solution, but chose instead to pay Google a $475,000 annual fee for the current setup for the district's 38,000 municipal employees.

"The whole notion of work and mobility has changed," Kundra said. "If you look at the ability to access e-mail anytime, anywhere in a mobile domain, a lot of these Web 2.0 platforms are architected for ease in terms of access, whether you're using an iPhone or a low-end connection."

Google hosts e-mail, calendar, video and document-sharing functionality, and Gmail provides the requisite functions of e-mail security, archiving and encryption.

Web 2.0 blurs the line between what people use at home and at work, therefore enhancing comfort and ease of use. "Most of us, as consumers, essentially operate within the cloud, whether it's using photos through Flickr and Picasa and Kodak [Easy]Share, or it's accessing e-mail through Hotmail, Yahoo and Gmail," Kundra said.

According to John Myers, vice president and general manager of the Communication and Solutions Group at Open Text, the fact that e-mail is hosted shouldn't matter to users.

"It should be 100 percent transparent to the people who actually use the system. We're all familiar with e-mail as being sort of a mandatory communication tool these days. We all have one -- probably multiple e-mail addresses -- but where those servers are [is] completely invisible to the end-user," he said. "If you're in a multinational corporation, you might be working in Tokyo and the servers might be in Helsinki [Finland]."

Workers won't be concerned about what happens behind the scenes if they can still e-mail, Myers said. "You don't know where those servers are," he said. "Nobody else knows where those servers are, and nobody really cares. From an end-user perspective, it's completely transparent."

Needless to say, if a hosting company manages the servers, they're likely handling backup, disaster recovery and security issues, like spam filtering. This means agency IT staff doesn't have to worry about these issues and will therefore have more time for everything else in their departments.


Messaging ... and Then Some

Other jurisdictions have also capitalized on the hosted messaging trend.

Oakland County, Mich., offers e-mail subscription service to residents and businesses through its Web site. The county partnered with GovDelivery, a company providing government-to-citizen communication capabilities, in June 2008 to deploy the free subscription and e-mail options. People receive up-to-date alerts from local government on county news and alerts, and the county has sent more than 61,000 messages to more than 21,000 subscribers since then.

The county plans to expand the service to its cities to help them do the same in their jurisdictions. The plan is to increase citizen contact and collaboration with their government and build community across geographic boundaries.

Open Text offers messaging and collaboration software called FirstClass, and the company has sold many deployments in the education sector. One client is Chicago Public Schools, where students and faculty in a district of more than 600 schools benefit from e-mail, document sharing and social networking.

"Students, for example, can be assigned into work groups of four or five," said Robert Runcie, CIO of Chicago Public Schools. "They can be given a conference and workspace -- a virtual workspace with their FirstClass -- and they can share content-information documents to work on a project and can then use the software to interactively present that in the class and have discussions about their work."

Photo: Robert Runcie, CIO, Chicago Public Schools

Like the District of Columbia, Chicago Public Schools' e-mail tool is one component of a broader range of hosted services. The selling point for Runcie and his colleagues was the ability to use FirstClass for instruction and e-mail. The district began a pilot rollout in spring 2007 in some high schools, but has since implemented the software in the majority of its schools. Chicago Public Schools has 25,000 teachers and more than 400,000 students.

Although these hosted functions serve Chicago Public Schools well, the number of users is too large for FirstClass or the district to manage their e-mail and other capabilities simply, so the district helped integrate personnel- and student-management applications to the hosted e-mail solution during the implementation.

"We've had to build the integration and help Open Text manage the security and other infrastructure challenges that we presented because we're its largest customer," Runcie said. "We played a fairly significant role on the front side. During the implementation, we did invest quite a bit of time, money and resources to building appropriate integration to our systems."

The FirstClass solution was integrated with Chicago Public Schools' existing student information system, which now automatically uploads registration and enrollee information to FirstClass. The district is too large for personnel to manually update data for such a large body of students and staff. On the faculty side, FirstClass is integrated with the district's PeopleSoft tool so that up-to-date hiring, firing or other related information is automatically updated in the messaging platform.


Points to Consider

But even with hosted e-mail's advantages, employees may see some big negatives, like job security. When the vendors handle so many duties, sometimes employees' responsibilities are taken away. Kundra had to eliminate positions in the district because Google Apps hosted so many services that government employees would have handled otherwise.

"The biggest resistance to deploying this platform actually came not from the end-users, but from IT folks within my own organization. They resisted it. They didn't think it was a good idea initially," he said. "They're the ones who said, 'You know, we should stick with the traditional model.' And that's understandable, given that they've spent a career, a lifetime, building up those skill sets, but the market and the macroeconomic forces are changing so fast."

And what about maintaining the integrity of government data? It's a given that e-mail hosting companies claim they ensure topnotch security -- that's one reason clients seek them out. But when insider e-mails are managed by a third party, what's to stop those third parties from taking unauthorized peeks?

"If the system's being run in a different city or a different country by people who know nothing about your business, they're much less likely to have a context for which they might be able to do something inappropriate with their access to the data," Myers said. He knows of many cases where sabotage was performed by an organization's employees as opposed to the host's employees.

He said an organization's employees will know much better than third-party employees which information is valuable. And he's right that insider sabotage has been identified as a prime threat to government security. In 2007, the National Association of State Chief Information Officers (NASCIO) released a report, Insider Security Threats: State CIOs Take Action Now!, which identified malicious employees as a top threat.

But do insider security threats exclude contractors, like e-mail hosting companies? Probably not. Of the report's top five insider threats, contractors and outsourced services were listed third.

"Everything ultimately, perhaps initially, comes down to level-of-trust issues," said LuxSci's Driscoll. "You have to be comfortable enough with your provider, if your service is outsourced, that no one's going to look at your e-mail."

He said LuxSci offers clients the option to restrict the host's employees from viewing the content of e-mails. In FirstClass' case, Myers said the vetting is thorough.

According to Myers, most FirstClass government clients require that people involved with the operation or deployment of a system have no criminal record, but they don't require national security clearance. However, he thinks many government agencies would require security clearances for people handling their hosted e-mail solutions.

"I could well imagine that, with some types of organizations, they might actually go that extra route and look at the security credentials of individuals who may have access to their system," he said.

NASCIO recommends that states perform their own background checks on contractors and ensure they have proper security training. States should also ensure contracts include IT security-related provisions.


The Future of E-Mail?

With all the benefits -- cost savings, freeing up IT staff for other tasks, and in some cases, Web 2.0 convenience -- hosted e-mail seems to have a lot going for it. Vendors believe the playing field will be wide open for the foreseeable future.

"If you consider the growth rate of software-as-a-service companies over the next two to three years, it's something you have to look at," said Timothy Eades, CEO of e-mail host "It has to be part of your strategic plan, just like virtualization has to be part of your strategic plan."

There are real benefits in having some IT infrastructure outsourced, Myers added. "Ten years from now, [you'll] really see every company -- small, medium, large -- having IT staff who are all trying to solve the same problem, sort of figure out what e-mail system to buy, how to run it and how to keep it current against viruses."

Hilton Collins

Hilton Collins is a former staff writer for Government Technology and Emergency Management magazines.

Platforms & Programs