State & local taxes: how does one tax a cloud?

• Author: Jensen, Jennifer West

IN A WORLD WHERE THE SKY IS THE LIMIT FOR technological possibilities, it is not surprising that the next frontier is the clouds -- computing clouds, that is. industry experts believe that cloud computing -- a term used to define the latest innovation in web-hosted services -- could revolutionize the information technology (IT) industry. Others are holding back their opinions while assessing the risks associated with migrating data into the "clouds."

State revenue departments face the down-to-earth question of how to tax these clouds. Answering this perplexing question first requires an understanding of exactly what cloud computing is and how it works. This column provides an overview of cloud computing, highlights the benefits and risks surrounding it, and discusses how states are interpreting existing laws and designing new ones to capture the clouds within their tax bases.

[ILLUSTRATION OMITTED]

What Is Cloud Computing?

Providers and purchasers of a cloud service often have a hard time defining exactly what they are selling or buying. Is it tangible personal property or a service? In an attempt to assist the industry and provide some consistency, the National Institute of Standards and Technology (NIST) has issued a draft definition in which cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models. (1)

Cloud Characteristics

The five essential characteristics of cloud computing, according to the NIST, are:

* On-demand self-service: "A consumer can unilaterally obtain computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service's provider."

* Broad network access: "Cloud capabilities are available over a network and can be accessed through standard mechanisms that promote use by [multiple] client platforms (e.g., mobile phones, laptops, and PDAs [personal digital assistants])."

* Resource pooling: One of the great strengths oicloud computing is that the provider is able to pool computing resources -- "such as storage, processing, memory, network bandwidth, and virtual machines" -- to serve multiple consumers with "different physical and virtual resources dynamically assigned and reassigned according to consumer demand." The subscriber generally has no control over or knowledge of the exact location of the provided resources.

* Rapid elasticity: IT capabilities can be "rapidly and elastically provisioned, in some cases automatically," according to the scale required. "To the consumer, the capabilities available ... often appear to be unlimited and can be purchased in any quantity at any time."

* Measured service: "Cloud systems automatically control and optimize resource use" by metering service appropriately by its type. Resource use is "monitored, controlled, and reported, providing transparency for both the provider and consumer of the service." (2)

An example demonstrates the power of these characteristics. In 2007, New York Times blogger Derek Gottfrid described how the newspaper converted 11 million scanned and archived documents stored as images into portable document format (PDF) files to make them available through its website's search engine. (3) Rather than tackle the project in-house (an IT nightmare), the Times deployed 100 servers in the Amazon Web Services Elastic Compute Cloud (Amazon EC2) to convert data nonstop. Within 24 hours, all 11 million images were converted and stored on Amazon's Simple Storage Service (Amazon S3) at a cost far less than if they had been converted in-house.

Other potential benefits for many companies over using internal IT resources include agility, location independence, scalability, and reliability. The cloud allows its customers to be more agile, since they no longer need to build an IT infrastructure or have as many IT professionals to tackle a project. Overall costs are greatly reduced, lowering barriers to entry. Location independence allows customers to access systems using a web browser anywhere and at any time, from whatever device they use to access the internet. The cloud is scalable on demand, meaning a customer no longer has to engineer its systems for peak load levels or maintain systems that are only 10-20% used in nonpeak hours. The cloud allows customers to enhance data security through centralizing it, to increase their security resources, and to improve reliability through the use of multiple redundant sites.

Service Models

The NIST defines cloud computing as using three service models:

Software as a Service (SaaS): This model allows "the consumer to use a provider's applications running on a cloud infrastructure." The applications can be accessed "from various client devices through a 'thin' client interface" such as web-based e-mail. "The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings." (4)

Platform as a Service (PaaS): PaaS allows the consumer "to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations." (5)

Infrastructure as a Service (laaS): This model allows the consumer to obtain "processing, storage, networks, and other fundamental computing resources" and be "able to deploy and run" a range of software. "The consumer does not manage or control the underlying cloud infrastructure" but controls "operating systems, storage and deployed applications" and may have "limited control of select networking components (e.g., host firewalls)." (6)

These three categories appeal to distinct user groups. Businesses that want complete control over data will migrate toward the IaaS model. Programmers, developers, and web designers will reach toward PaaS. Home or business users looking for low-cost alternatives to traditional software will gravitate to SaaS models.

Choosing an Infrastructure

The NIST sets out four cloud infrastructures:

Private cloud: Operated solely...