Google defends Google Apps security

Glotzbach yesterday contended that the concerns have been raised as part of an effort by some rivals and others to spread fear, uncertainty and doubt about the company's cloud computing service.

"There seems to be this sentiment that this was some secret, backroom kind of process," Glotzbach said. Instead, Google won the contract over 15 rival bidders largely because of the security and privacy controls in Google Apps, he added. In fact, as city officials reviewed the contract over the past eight months, Google engineers have worked with the city's technology team and police department representatives to understand and address security and privacy concerns, he said.

Glotzbach claimed that Google Apps will offer better data protection than is currently available for the city's applications for a number of reasons. For instance, having Google host and manage the applications means that the city won't have to worry about installing new security patches -- and that it won't have to expend the resources needed to implement them. Similarly, it's typically harder for hackers to launch attacks on hosted software because they don't know which server or data center is hosting the data, he said.

In addition, he said that all sensitive data will be encrypted while in transit and storage, and that the only way users will be able access Google Apps applications is by first authenticating themselves to the city's primary authentication server.

Glotzbach rejected suggestions that the hosted Gmail e-mail application would weaken current security protections. For example, he said that current transmission rules, such a the police department's edict that prevents certain information from being included in e-mail messages, will not change.

Randi Levin, the city's chief technology officer and general manager of the ITA, said that the project has received tentative approval from the California State Department of Justice after a review of city's plans for addressing security and privacy concerns. In addition, the ITA has met with the police department, the city attorney's and Google to discuss enhanced encryption methods that will be used to protect highly sensitive data, she said.

During the planning phase of the project, the ITA must demonstrate that its plan for security controls will work as promised, said Kevin Crawford, assistant general manager of the ITA. "To say or infer that we have not worked with the [California Department of Justice] ... is not correct. We have worked extensively with the DOJ, and they have approved the plan and now need to see it functioning as described in an operational manner to provide final approval," he said.

The final decision by the Justice Department will likely be a crucial factor in determining whether the police department agrees to use Google Apps.

Juan Bustamante, a spokesman for Mayor Villaraigosa's office, said the contract right now is in the hands of the city's technology council. After review by the council it will be put up for approval by the city council. At that point, the project will move ahead as planned, he said.

Read more about saas in Computerworld's SaaS Knowledge Center.