Cloud adoption in UK universities

I spent part of last week at Networkshop47 in Nottingham, a Jisc conference predominantly aimed at networking people within the UK higher and further education communities (UK HE and FE). Networkshop isn’t on my usual list of conferences — I last went in 1987 (to Networkshop15 in Edinburgh I think) and obviously enjoyed it so much I haven’t been back since! — but, to be fair, there was a good line up of speakers and parallel sessions.

My involvement was two-fold: a presentation, “Building the Modern Institution: how Jisc can help your cloud-based digital transformation” on Wednesday morning and a panel debate, “What will the university look like in 2030?” later that afternoon.

My presentation took a familiar approach, namely that cloud isn’t a driver for change in its own right. Rather, it is digital transformation — i.e. the desire to transform the way an organisation does its business through the use of digital technology — that is the real driver. Further, that despite the name, digital transformation is far more about leadership and cultural change than it is about technology and that it therefore needs an approach that brings everyone in the organisation with it, not just the technologists.

Pretty obviously really… but still often overlooked.

Digital transformation will, almost certainly, involve a large-scale shift towards use of the cloud because the kinds of technology one needs to realise any significant digital vision simply aren’t available if you are limited to what can be done on-prem. But cloud itself isn’t the driver for that change — it’s a consequence of it.

My usage of ‘Modern Institution’ is a nod to Microsoft’s use of ‘Modern Workplace’ which, despite being a largely marketing term, I quite like. A Modern Institution is one that embraces all the facets of the modern workplace — flexible working, flatter hierarchy, more collaboration (particularly across teams), greater agility, more innovation — but that does so in order to improve the student experience, enable more flexible delivery of teaching and learning, improve student retention, and deliver better research efficiency. Typically there will be a much greater reliance on data to drive better decision-making — and ultimately the creation of what might be referred to as the intelligent campus.

Here are my slides:

As I say, you could try and realise this kind of transformation through your existing on-prem infrastructure but attempting to do so will be highly likely to fail in my view. Without the benefit of the hyperscale public cloud providers’ platforms (SaaS, PaaS and IaaS), organisations simply won’t have access to a rapidly evolving array of collaboration platforms, compute and storage infrastructure, serverless, containers, ML, AI, big data, IoT and the rest, all of which are needed to facilitate the change. Trying to build and maintain all that in-house is, for me, a complete non-starter.

Unfortunately, one gets the impression that for some universities that is still where their strategic heads are at. The question is, how many are changing? I started my talk by referring to our recent report into cloud adoption in the public sector (PDF) which says, amongst other things:

Universities and public bodies, which are mainly driven by scalability and agility, are the first and second heaviest cloud adopters in the public sector — 36% and 29% of cloud usage, respectively.

I said that I was surprised the 36% figure was so low but a later show of hands seemed to confirm it, as did other sessions at the conference. However, to be fair, the report does go on to state that:

59% of HE institutions are looking to procure Public Cloud in the next 12 months. As results have shown, the sector is quite advanced in cloud technology usage, even though universities are still the biggest users of on-premise datacentres. Despite being ahead in comparison to other sectors when it comes to cloud adoption, just over half (55%) of HE institutions have policies and/or strategies implemented for the use of cloud — it is a low number when compared to their cloud adoption stats, however, they are still the in second place for cloud infrastructure policy

So, maybe a somewhat less negative picture that I am tempted to present here. I didn’t cite that 59% figure in my talk but probably should have done. Of course, “looking to procure Public Cloud in the next 12 months” is open to some interpretation.

One of the delegates I spoke to during the conference outlined some work he was involved in, most of it cloud-based. The conversation went along these lines:

“We’ve built all this in the cloud.”

“Great.”

“Of course, we keep all the data on-prem.”

“Oh, why?”

“Because it’s more secure!”

“Really? You really think your data centre is more secure than one run by Amazon, Microsoft or Google? Nobody thinks that any more do they?”

“Well, yes… and in any case it means that the data stays within our control”.

I was a little taken aback. Partly, I suppose, because of where I’ve come from. At Eduserv, we took the decision to shut our data centres about 18 months or 2 years ago. This was prior to the merger with Jisc. This decision was mainly driven by an external managed service perspective — we saw our public sector customers’ direction of travel towards hyperscale public cloud and took the view that our ‘private cloud’ data centres would no longer be relevant in a few year’s time. In parallel, the OpenAthens team took the decision to move everything to Google Cloud Platform. Following those decisions, everything we did internally went to the cloud as well . Why? Because we had nowhere else to host stuff. Collaboration, HR, finance, pay-roll — you name it, we used the cloud to deliver it. So even though we didn’t have an explicit ‘cloud first’ strategy, we were effectively behaving as though we did. To the point where I don’t believe that anyone in Eduserv would have said, “we have to keep this data on-prem” — doing so simply wouldn’t have made any sense and wouldn’t have fitted with our implicit strategy.

Weirdly, I don’t think we explicitly set out to change the organisation culturally through that process. But that is what happened. We became more open, more collaborative and much more flexible. I can’t claim that the technology was solely responsible for that change — but it was a part of it.

This issue of control also came up in the cloud session in the morning with one person saying that their university’s experience of the reliability of Office 365 was very poor — that’s not my experience by the way — and that the fact that they no longer ‘controlled’ the service somehow made that worse.

My view is that these things are always a balance and that you have to trade off benefits against downsides. Functionality, reliability, scalability, performance, security, cost, etc. And ‘control’ I guess — though I’m not totally sure I fully understand what other people mean when they say that.

I totally accept that there are reasons why you would want to keep data and services on-prem… I’m just not convinced that security is one of them any longer. For me, any ‘control’ issues become centred on the control features that my chosen public cloud vendor provides me with that allow me to control my data (and services) in the cloud — encryption, firewalls, monitoring, access control, resilience, integrity-checking, etc.

Back in 2003, I recall running a session at one of the HE ‘leadership’ conferences with the then Eduserv CEO, Stephen Butcher — IT : Strategy, management and DIY in HE. We asked delegates, who were all heads of university administration, to think about areas where outsourcing had been attempted, where it was successful and where it had failed or been decided against. (Note that this wasn’t a specifically ‘cloud’ discussion). We ranked a number of issues as being likely to encourage outsourcing through to likely to discourage it. Here are the results:

In my remarks on the session I noted the following:

• There was a perception that HE is somehow a ‘special case’ (compared with other sectors) but not clear if this is correct.
• In particular, ‘confidentiality’ and ‘mission criticality’ were both given as reasons to DIY
• However, in discussion it was noted that: a) other very sensitive sectors don’t see things that way b) most universities will have procedures and infrastructures that are less audited and accredited than those of their third party suppliers.

It would be interesting to know how attitudes have changed.

The closing session on Wednesday was a panel debate asking “What will the university look like in 2030?”. Christ… I don’t have a clue to be honest. I made the point that I went to university in 1989 and that when my eldest daughter went approximately 30 years later our experiences were more similar than different. We both studied for 3 years. We both sat in lecture theatres quite a lot. We both went as least as much for the ‘student experience’ and the qualification stepping-stone at the end as we did for the ‘learning’ on offer. And as an easy way of leaving home! My daughter’s course probably focused more heavily on the so-called ‘soft’ skills (actually anything but soft in reality) than mine had done — group work, collaboration, presentation skills, etc. Clearly, there were differences — not least the way our funding worked — but the major technological changes in our experiences probably came more from outside the sector, notably Facebook, than from inside. On the basis of so little fundamental change in universities over that 30 year period, I said I didn’t see much reason to assume they’d change that much in the next 10. I was possibly somewhat more blunt than I should have been — it was a panel session after all. Surely I can’t work for Jisc without drinking the Education 4.0 cool-aid?

This tweet from the BBC Archive shows how easy it is to make ridiculous long term predictions:

Unfortunately, I made the mistake of referring to myself as a grumpy old man at the start of the session, a label which then got re-used by everyone else (about me!). I was sat at one end of the panel and so became, the “grumpy old man at the end”. After the session, Ian Cooper of the University of Cambridge tweeted me to say I needed a new Twitter handle — which I duly set up that evening. (@grumpy_at). I’m not intending to use it much :-)

For me, part of the problem here is that I’m not sure we are seeing that many ‘cloud first’ strategies coming out of the sector? Where is the university in the UK that has a true cloud first commitment with a target date for closing down its data centres? At the conference meal, I was told that there are now US universities beginning to make those kinds of statements. Is that true? I said that part of the reason that universities won’t change is because they are too reluctant to move their thinking outside of their own data centres. Maybe I’m being unfair?

At the end of the panel session, someone asked what one thing universities could do now to change things for the better. I really like that question, not least because I find being asked to think about a 10-year time span too intimidating. Thinking about what we can do now feels much more pragmatic.

My answer? Sort out your data (because data is going to underpin everything in the future).

In thinking about this blog post I began to wonder if what I should have said was, “Sort out your data and associated data-related skill-sets (because data is going to underpin everything in the future) and start using hyperscale public cloud (because that train left the station some time ago and you are already going to have to run like hell to catch it)”.

But that would have been a pretty weird statement to make given that I’d started the day by saying that universities need to embrace digital transformation first and foremost — and that while cloud adoption might naturally follow, it isn’t a driver in its own right.

So, are UK universities lagging behind other sectors in terms of their digital transformation and cloud adoption rates? I still don’t really know the answer to that to be honest. And, I don’t actually know that it matters. Clearly, universities in general have historically made a massive commitment to building their own infrastructure — to suggest that they just lose that investment would not be credible. As vendors transition to SaaS delivery models — which they almost inevitably will — cloud adoption will increasingly become the norm anyway. Which brings me back to my original position… universities need to focus on understanding whether, why and how they want to digitally transform themselves. Cloud adoption will likely follow.