An idea for returning to personal control of data while maintaining the benefits of Web 2.0 connectivity

1. The Virtual Personal Cloud
Background
Computing has gone through a complete cycle:
First, we had large, centralized and reliable mainframes/minicomputers with
no personal access or control
Then we progressed to the PC era with total control and access to one’s
personal data but very poor connectivity and reliability
Now, we live in the browser + web walled garden era with centralized data,
some control and access, great connectivity and reliability (Facebook,
Google, etc)
This paper explores whether it might be possible to return to a world with more
control and access for the individual while still retaining the benefits of Web 2.0
connectivity and reliability. It presumes the continuation of exponential cost
reductions in processing and storage, advances in virtualization technology and
generous amounts of bandwidth.
The Value Proposition
Imagine if everyone had a “virtual personal cloud" (VPC) holding all of their media
and personal, financial, business, health and lifestreaming data (pictures,
microblog/blog entries, sensor data, geotraces, etc, etc). Consumers and small
businesses would control access to their data and could grant it to anyone or any
app they chose. This VPC service is something people would pay for much as they
pay for other service subscriptions today (ISP, cell phone, Xbox Live, etc), with
plans based on usage, bandwidth/speed, storage, etc. The VPC is not a backup
service or safety deposit box – it’s a live, transactional data store where your online
life happens.
How would this work?
Rather than SaaS apps like Facebook, Twitter and Gmail scaling huge services and
databases that accommodate tens or hundreds of millions of users inside them, the
VPC service industry uses on-demand virtualization to run hundreds of millions of
instances of VPC's in a highly distributed way. The system could leverage the
existing DNS system to resolve the location of any VPC – think a new top level
domain called .vpc. So a typical HTML5 or AIR client application doesn't connect to
www.gmail.com or mail.sbcglobal.net to get at my mail, it connects to the VPC at
geraldhuff.vpc, which could be hosted by IBM, Cisco, Verizon, WellsFargo or
wherever I choose, or on my own server if it's always on, which could give LAN-like
data performance. For mail, as an example, that VPC instance would host both an
SMTP server and POP server to accept and deliver email.
If you are in my social network, my VPC pushes my status updates to your VPC in a
server-to-server version of a P2P network with no "middle man" like Facebook or
Twitter, using open standards like Activity Streams. If I want my financial data
updated nightly, I can install an app on my VPC which uses credentials securely
stored in the VPC to access financial institution data on my behalf. This service and

2. others might cost money. VPC service providers would have a billing system just
like cell phone companies, so I get a consolidated bill that includes all my services.
Personal Benefits
- You can send me email forever at mail@myusername.vpc, which I can read
with many different clients while remaining untethered from an ISP or any
other entity
- I can move my VPC at any time to another provider with a simple "DNS"
change and copy operation
- Because of extreme portability, my costs for VPC service will go down with
technology cost curves because it will be very competitive
- I can also change any client (social network, personal finance, email, etc) at
any time, because they all conform to the VPC open standards
- In fact, my friend Joe can view my profile data and his social graph with a
social network client that he prefers while I view his profile and maintain my
own with a different client
- When I want to try a new website, I don’t have to register, I just grant it
access to store things in (and maybe read certain things from) my VPC. In
this way, the open standards and API’s at the front edge of the VPC become
“the platform”.
- I never have to give my personal and credit card info to a web site I use and
find value in because I can get a consolidated bill from my trusted VPC
provider
- I can make a backup of and easily restore all my data at any time because
it's stored in a single "capsule" I can grab a hold of - a major problem in
today's world where "my" data is spread out over dozens of web sites.
- I can grant and revoke access to my data at any time (needs legal
restrictions on 3rd parties making copies of what they read over API’s)
- This is just like having data on my own personal hard disk, but better than
my hard disk, my VPC is available to me (and other VPC’s) 24/7 from
anywhere and any device, auto-backup, etc.
Industry Benefits
- A huge new recurring revenue stream that simply doesn’t exist today, like
the first time cable TV appeared and people started paying for TV content or
consumers started paying for internet access
- New web startups can scale incredibly without any infrastructure, unleashing
tremendously low cost innovation for everyone. That’s because they never
store anything. In fact, with AIR and AJAX clients the typical startup could
support millions of users storing only, say, 100K of code on a single server.
In this model, the client runs in the browser and accesses everyone’s VPC
directly. Or, the code could be posted to a central VPC app store, so a startup
could support a million users without even a web site. And with VPC-provider
billing, all they do is collect checks. So, this is very much like iPhone
apps/app store today, but untethered from any device and capable of storing
lots of data in VPC’s.
- Development is also incredibly easy, because I can run multiple VPC’s on my
desktop computer and so my development environment is my deployment

3. environment. I don’t need to worry about “what happens to this query when
I get a million users?” because very VPC is for a single user. It’s the most
productive development environment possible, just like single user desktop
software used to be!
Downsides
Such a scheme of highly distributed personal data makes mass public user
contribution to a central searchable site a la Flickr or Delicious problematic. People
could of course opt in to pushing their status updates or bookmarks to services like
that, which could aggregate them. In fact, it would be relatively painless to
syndicate ones bookmarks or pictures or other content to multiple aggregation
sites.
As a counter-argument to the “unleashed innovation” above, some might argue
that rapid innovation will be stifled by the reliance on open standards that move
slowly. What if an innovator wanted to connect a new kind of content to the nodes
in your social graph? To avoid this, it will need to be easy for applications to store
proprietary information in the VPC until it can be standardized.
Obstacles
Of course there are many obstacles to something revolutionary like this, e.g.
- All the big centralized SaaS players like google, facebook, twitter, etc. who
have a vested interest in the centralized status quo and currently hoard the
data
- Consumers/small businesses would have to pay for some things they get for
free today
- A whole host of technical issues around scaling the virtual machines required
for hundreds of millions of individual VPC’s, running 3rd party app code safely
inside them, etc.
- User experience challenges for people managing their own information and
access control schemes (they don’t do this explicitly today, they just “use
apps”)
- The difficulty of creating the many open standards required
- Chicken and egg issues – what application provider will write to a VPC back
end when they don’t exist, and who wants a VPC with no apps?
- The landgrab issue for usernames in the .vpc space and the difficulty of
getting a new TLD established
- …Just for starters
Technical Thought Starters
The basic stack of a VPC would have a storage backend like MySQL, a robust data
API layer controlled by OpenID/OAuth that implements various open standard data
protocols (SMTP/POP/Atom/Activity Stream/Open Social/etc) and a code container
that can run sandboxed 3rd party code. The VPC server system would ideally be an
open source project. There would be standard VPC host services for billing and
account management, including host-to-host protocols like “move account X from
you to me”.

4. An idea not in a vacuum
Inspired by slide 32 of this presentation by Jyri Engeström
Note that there is a seed of this idea in
http://en.wikipedia.org/wiki/Vendor_Relationship_Management (Personal
Data Stores)
Various bloggers like Om Malik have also talked about breaking down the
data silos of Facebook and others
The entire Open Stack movement (OpenID, OAuth, OpenSocial) is headed
down this path, but still trying to stitch together various highly centralized
services
Apple’s mobile.me is somewhat like this, except it’s locked into Apple and
more about syncing
There are "Personal Data Vault" products today, but they are like safe
deposit boxes and are not live and transactional
Opera’s recent “turn your computer into a web server” effort