Just a decade ago, it would have been hard for all but the most tech-savvy to imagine the extent of cloud computing today. A complex system of data centers worldwide that store, process, and deliver information on demand over the internet, the cloud provides users with resources, applications, and information that they previously would have stored locally. The cloud—what some are calling “the factory of the 21st century”—is run by a network of IT service companies, internet firms, and telecommunications services providers, and it offers services to all of us: from banks and retailers to individuals like you and me. It is both real—requiring traditional inputs such as electricity—and virtual.

Throughout the history of corporate responsibility, a few megatrends have redefined how we think about the ethics of business. The outsourcing of manufacturing to places with low labor costs and lax regulations led to a rise in consciousness about working conditions at supplier facilities. The increasing number of people living at the “base of the pyramid” (the now 2.5 billion people who exist on less than US$2.50 per day) prompted companies to address global poverty while advancing business interests.

We believe cloud computing has the same potential to create profound new sustainability and ethical dilemmas. Addressing these dilemmas calls for an update on how we think about corporate responsibility.

To be clear, cloud services make a positive contribution to sustainability: The cloud encourages important clean-tech applications like smart grids, and it also encourages consumers to use virtual services such as video streaming to replace resource-heavy physical products. The cloud also draws resources to where they are used most efficiently, and its jobs tend to be cleaner and safer than those of more traditional industries.

What follows is an evaluation of how cloud computing will affect two top sustainability issues of our time: climate change and human rights.

The Climate in the Cloud

At the BSR Conference 2011, Autodesk CEO Carl Bass posed a question about the power of what he called “infinite computing,” asking what we can do to harness the unlimited amount of computing to help solve some of today’s most pressing problems.

There is no doubt that the expansive power of computing can help us address sustainability challenges, but this technology also draws from the Earth’s finite environmental stocks and biosphere. Data centers are already responsible for 1 to 2 percent of global electricity use, a level that doubled even during the economic slowdown between 2005 and 2010. There are troubling signs that data center power use will continue to grow substantially.

Against this backdrop, there are several interconnected issues related to the cloud’s impact on climate change: its swelling energy footprint, the fact that location makes all the difference on the carbon footprint, the cloak of secrecy around data center sites, and the challenge of accounting for carbon when collaboration is so complex.

On the first issue, regarding the data centers themselves, there have been breakthroughs in energy efficiency, such as chiller-less servers and pods that use low energy in harsh climates, and there will be more. But with global energy consumption set to rise by around 40 percent by 2030—due to more affluent people desiring more high-tech equipment, and applications growing hungrier for energy—energy demand from data centers is likely to outstrip efficiency gains.

Facility location is another challenge: If all else is equal, data center operators will build facilities where the energy is cheap, and, usually, that means dirty. In the United States, more than half of all top data centers rely on coal for the majority of their energy needs, which means a lot of new data centers are clustered in North Carolina and the Midwest.

Meanwhile, there is a tendency for operators to keep quiet about where their sites are located, which runs against the good practice of making carbon information transparent. Many companies keep certain site locations, such as suppliers, under wraps for competitive reasons, and cloud companies are even more secretive about data center locations due to often legitimate concerns about security. Customers whose personal information is stored at these data centers tend to appreciate this. Nevertheless, transparency about local carbon impacts remains a key element of climate responsibility, and companies will be under increasing pressure to disclose more and, when they can’t disclose, to explain why.

Finally, the cloud’s value chain is more complex than what current accounting and reporting systems can handle. Even the new Greenhouse Gas Protocol’s Scope 3 standard, the authoritative framework for measuring carbon in value chains, offers little guidance. The difficulty lies in the fact that the disparate collection of IT services companies, internet firms, telecommunications, and services providers make it hard to create accountability for carbon performance as a system.

These four challenges point to some new themes that will soon be considered part of leading climate and corporate responsibility practice for cloud-services providers:

1. Location matters. One of the greatest opportunities for cloud carbon reduction is with siting, since energy makes up such a large share of a data center’s footprint, and the carbon content of electricity is determined by the local grid’s portfolio. This makes alignment among sustainability, operations, and real estate teams crucial for managing carbon performance. Furthermore, those building data centers for customers have a responsibility to educate clients about the carbon impacts and risks that result from where they commission facilities to be built. They also have an opportunity to strengthen relationships by offering better insights and services to help customers get the most out of low-carbon siting.
2. Companies have a role in influencing electricity grids. Because data centers can be large energy customers, an additional point of leverage for developers and operators is to influence local policymakers and utilities to invest in more sustainable energy sources. On first thought, this might seem radical. But savvy companies already negotiate electricity prices with utilities and engage with local governments on a range of policy issues, so this can be an extension of those conversations. Also, power utilities are effectively key suppliers—if not the key one—for energy-intense data centers, and the practice of engaging suppliers on sustainability is a common frame of reference.
3. Transparency will enhance collaboration. Data center operators need to be more proactive about advancing carbon transparency by reporting as much as they can about carbon impacts through the Carbon Disclosure Project, and communicating more earnestly about what can and cannot be disclosed. The more information companies can provide, the more tools researchers, civil society, and service providers will have to establish metrics and public policies that improve incentives for investments in energy and carbon-efficient operations.

The Human Dimension of the Cloud

How much the cloud affects human rights will depend on the range of services it provides; there will be less risk associated with corporate information than personal communications, for example. Some categories of customers (such as civil society organizations) may have more reason to be cautious than others (such as multinational corporations).

We believe cloud-services providers should consider their human rights responsibility in two main dimensions: data center location and their role as gatekeepers of information.

The first responsibility is to integrate human rights factors into decisions about data center location. In addition to price and local energy supply, a key factor in determining the ideal location for a data center is the local jurisdictional context. While some countries have strong privacy and security laws and practices, others do not, and this variation can significantly affect the cloud’s impact on privacy, security, and freedom of expression.

When it comes to siting data centers, companies are understandably nervous about storing data in jurisdictions that may not respect the rights of their users and customers. For this reason, they often choose to locate data centers in places with favorable privacy laws, even if that means storing the data in a country outside the users’ location. Yahoo, for example, chose to locate its services targeted at the Vietnamese market in Singapore. However, governments are becoming wise to this and can retaliate by requiring that data be located in-country if the business is to be licensed to operate there.

The second responsibility of the cloud provider relates to its role as the gatekeeper of user data when law enforcement comes knocking for personal information. In theory, it is often the customer—the bank or the retailer, for example, and not the cloud-services provider—that defines the response to a law-enforcement demand. However, what really happens in a law-enforcement context is shrouded in mystery, and there are various controls and conditions that local government can require as part of the local license to operate that could bypass the customer altogether and go straight to the cloud-services provider. Additionally, and very importantly, when cloud-services companies provide services such as email or file storage to an individual customer, it is clearly the cloud-services company that defines the response to the law-enforcement demand.

This places cloud-service providers in a difficult position: In theory, they exist to provide virtual services to anyone, anywhere, unrestricted by traditional geographical boundaries or physical presence. In reality, the cloud is connected to the ground, and there is a very real ethical question about where to locate its physical presence. And as more business transactions take place in the cloud, cloud-services companies are caught between protecting the rights of their users and abiding by the law-enforcement demands of their regulators.

So what is a responsible company to do? Consider three main ethical dimensions:

1. Location: For both the users and providers of cloud services, it is important to have a siting strategy that fully considers the legal and jurisdictional issues where the data centers and network architecture are located.
2. The role of law enforcement: For the providers of cloud services, it is important to have a clear understanding of how to manage law-enforcement relationships. This may mean insisting on due process, challenging law-enforcement demands that may jeopardize human rights, and promoting good governance and the rule of law. The Global Network Initiative is a good example of a responsible approach that supports greater interaction between companies and governments to enforce laws that protect rights to privacy, security, and freedom of expression.
3. The importance of raising awareness: The providers of cloud-based services—who are by implication the experts in cloud issues—have a responsibility to provide advice and guidance to users who know less about how the cloud affects privacy and freedom of expression.

The Changing Ethics of the Cloud

In our conversations with companies about cloud computing, we’ve encountered objections to some of the views expressed here. We’ve heard it argued that cloud-services companies have no business trying to influence energy policy—that this is the purview of the energy industry. We’ve also heard that cloud providers should stick to their core contribution of “dematerializing” the economy and “enabling solutions.” And we’ve heard it argued that cloud-services companies should avoid engaging in human rights, the rule of law, and good governance in high-risk countries—that governments know best, and the role of business should be simply to follow their laws.

But it’s important to remember the core definition of corporate responsibility (as defined by the European Union, ISO26000, and many others), which emphasizes the role of business in supporting sustainable development. In this regard, cloud computing represents two shifts that are highly relevant. First, its highly networked, decentralized structure blurs jurisdictional lines, raising questions about accountability that effectively have never been asked. Second, today’s version of cloud computing is an embryo for what will be one of the most important industrial revolutions of the 21st century. With significant infrastructure to be built for an industry whose equipment is reinvented every two or three years, decisions made today will establish the architecture, communities, and choices we will have to work with later.

As cloud computing takes hold and changes the profile of business, so, too, will it change notions of business ethics and corporate responsibility. There was once a time when business would argue that suppliers should take sole responsibility for following labor and environmental laws, yet today we see armies of auditors and labor-relations specialists going above and beyond what is legally required. A similar transition will arise with cloud computing, and activities deemed outside the scope of corporate responsibility today—challenging unreasonable law-enforcement demands, meddling in energy policy—will be mainstream tomorrow. Now is the time for today’s most innovative companies to define what that looks like in practice.

First posted at BSR.

As 2011 draws to a close, we have registered a record year for weather disasters following the largest-ever jump in greenhouse gas (GHG) emissions, and the carbon intensity of the world’s fastest-growing economies is only rising. Following the inconclusive end of the UN climate talks in Durban, there is also little reason left to believe that our outmoded international treaty system is going to lead the world away from the ever-worsening state of climate change.

Earlier this month, the Greenhouse Gas Protocol launched its Value Chain (Scope 3) Standard, establishing a common way for companies to define and measure their total greenhouse gas impacts, risks, and opportunities — including those that are beyond the company’s direct operating control but that may represent the most significant impacts on the price and stability of the company’s supplies, customer demand, reputation, and costs.

One of the most important sustainability standards of the decade, it is not a new concept: The idea of Scope 3 (as distinguished from “Scope 1” activities that a company owns or controls, and “Scope 2” electricity purchases) has been around since it was defined in the GHG Protocol’s Corporate Standard in 2001.

In place of a brief subsection, however, the document now runs more than 150 pages, complete with a suite of technical resources, from guidance on supplier engagement to a list of third-party databases on value chain GHG information.

Daunting as this sounds, much remains the same. The definition of Scope 3 has not changed, and the new volume is organized in a similar way as the Corporate Standard, beginning with instructions on defining business goals, then an explanation of the core framework — from accounting principles to boundary-setting to data collection, followed by guidance on optional activities such as providing assurance to reports and tracking emissions over time.

But there are also significant new developments, including some that seasoned practitioners have been expecting and others that may be surprising. What follows are my picks for the most important new features of the updated framework.

Fifteen Authoritative — and Useful — Categories

If Scope 3 has a soul, it is contained in its categories. These 15 categories — everything from capital goods to investments — characterize the greenhouse gas footprints of companies’ value chains, and they set the stage for how, in practice, companies will reduce them.

Previously, the GHG Protocol called these categories an “indicative list.” Now, each category is carefully described, with the minimum boundary explained, and rigorous calculation options that have been refined with input from hundreds of professionals across sectors. Each Scope 3 category is classified as either upstream or downstream. (For comparison, here are the old and new depictions.)

One way to keep track of these categories is to think of them in terms of the activities companies will focus on to manage them:

• Collaborative energy management: Seven categories represent areas where the path to GHG reduction most likely involves working with partners to reduce energy use together. These opportunities occur in the purchasing of goods and services, upstream leasing, downstream leasing, franchises, the processing of sold products, capital goods, and investments.
• Logistics: Four categories address the movement of people and goods (business travel, employee commuting, and both upstream and downstream transportation/distribution).
• Products and byproducts: With three categories, design and engineering would be put to use to address waste generated in operations, end-of-use treatment of products, and product use.
• Upstream energy: The final category looks into the supply chain of Scope 1 and 2 energy sources that companies are already reporting on.

A Simpler Conversation

The most revolutionary feature is the introduction of a new standard that significantly simplifies companies’ conversations with stakeholders. Now, investors, customers, and partners can ask whether a company does or does not conform to the Scope 3 standard, and, if not, when it will do so. This is a major advancement over the Corporate Standard, which had declared Scope 3 reporting optional and offered little instruction on how to do it. This development is poised to change the norms of GHG footprinting for a few reasons.

The most obvious is that it sets a common bar. Although the standard isn’t designed to allow straight comparisons of actual GHG data between companies in a given category, it creates a way for one to compare the depth of understanding, investment, and overall seriousness of companies on value chain GHG management. In turn, Scope 3 may spark new ways to score and index companies against one another.

This will also change things because the new standard is stringent enough to separate leaders from the pack by requiring, among other things, reporting on all 15 categories with transparent calculations. While more than half of Global 500 companies reported information about Scope 3 in their 2011 responses to the Carbon Disclosure Project, only 20 percent reported on more than two categories, and only 5 percent reported on more than five. There’s a big gap between that and the 15 categories Scope 3 requires. Watch for the 30 companies (PDF) that road-tested the standard to set the pace.

Finally, Scope 3 forces a more careful evaluation of GHG priorities. As leaders begin to demonstrate what’s possible, investors are likely to ask more questions. For example, if a company is not reporting on a category, is that because it’s not material, or because the company isn’t paying attention? It will therefore become more important for all companies to consider the merits of Scope 3 conformance, and establish KPIs that lead them in the right direction.

Gears and Levers for All

Another major accomplishment of the new standard is that it will help drive greater consistency — and hence comparability — in methodologies for calculation and allocation of GHG emissions.

The standard provides calculation guidance for each category. While specifics vary for each category, they follow the same pattern: The company obtains “activity data” (fuel bills or financial information) and multiplies that by a published emissions factor to produce a GHG inventory. Then, when relevant, the company applies another calculation to determine its allocated share. Within each category, there is typically a choice between at least two methods: One that relies on more internally accessible information to provide a rough estimate, and another that uses more site-specific measurements to produce a more precise reading.

Not every company will find the calculation options perfect for its needs, and the methods will undoubtedly improve in the future. But this is the first time there is agreement on such a grand scale about what basically works across industries. Companies now have clear rules for measuring value chain emissions, which should give them the confidence to broadly account and report on emissions in their value chains. At the same time, these new “gears and levers” point the way for tool-builders, from software providers to multi-company working groups, to more effectively account for emissions in a way that is understandable outside of expert or industry circles.

A Bonus Tool for Products

Scope 3 comes with an extension: the Product Standard. Developed in coordination with Scope 3, the Product Standard provides a framework for measuring products’ lifecycle GHG impacts. This is related to Scope 3 but quite different: While Scope 3 provides information that applies to the whole organization broadly, the Product Standard deeply examines information for individual products from the perspective of the end user.

The Product Standard thus provides a useful tool for taking further steps when inventories of the Scope 3 “product use” category reveal products that are particularly impactful — whether through the direct use of energy (through the use of energy or fuel) or from activities required to maintain them (the use of energy-drawing equipment to clean) or use them (from mixing with hot water).

While all types of companies should find the Product Standard useful, consumer products companies, whose customers (and investors) are interested in learning about lifecycle impacts, will be most interested. It is also applicable to those selling energy-using solutions, such as information and communications technology manufacturers, where demand for energy-efficient equipment is likely to grow as the cost of energy rises. Nonetheless, most large companies should be looking at the Product Standard, which synthesizes a huge amount of useful information, to at least understand the mechanics of how GHG flows through the lifecycles of their products.

Answers to Tough Questions

Anyone who has been working on value chain GHG management for any length of time knows that the area is rife with challenges. One of the best features of the Scope 3 standard is that it answers some of these.

Some difficult questions relate to managing data quality and uncertainty. As one manager once told me, with value chain GHG footprinting, it is often that the “error bars” exceed the “mean.” In plain English: It’s frequently not much better than a guess. The Scope 3 standard helps by breaking down the sources of uncertainty into specific types that will help clarify what is — and what is not — known, which can help companies understand where they need to be most careful.

Other questions relate to the treatment of avoided emissions from the use of sold products — that is, what can a company say about the emissions that were reduced from customers buying its high-efficiency electronic device. This is a hot topic in industries that produce energy-using appliances, information and communications technology services, and energy-management solutions, where companies have been looking for guidance on how to most accurately account for their current and planned work.

Last but not least, the new standard provides some welcome direction on what the accounting and reporting is all about: making actual investments in GHG reduction. The guide provides examples of actual initiatives, by category, from using raw materials that emit fewer emissions, to reducing the distance between supplier and customer, to shifting to lower-emitting fuel sources.

First posted at Greenbiz.

Consider the following three developments:

In the Arctic, the Northwest Passage is growing in size every year, creating new competition for faster shipping and resource exploration, and new engineering and safety challenges.

In California, the number of seniors dying from heat-related issues is set to rise sharply in coming decades, creating new challenges for health-care companies and insurance-providers alike.

Across the globe, the increase in temperature spikes and storm surges is making it harder for electric utility providers to offer uninterrupted power as profitably as they have in the past.

Although it’s difficult to attribute a single storm or season to climate change, it is fair to say that we’ll see more of these events as climate change sets in. For business managers who are focused on reducing greenhouse gas emissions as a key element of addressing climate change, these examples show that business must adapt to volatile and uncertain future weather to achieve sustainability.

To better understand what the private sector is and should be doing, BSR examined more than 500 company responses to the Carbon Disclosure Project, which represents more than 80 percent of Global 500 companies.

We considered three things in our research:

• Company disclosures on the risks and opportunities of climate change
• What companies are doing about it, and
• Opportunities for innovation based on current gaps.

Our research yielded briefs on several different industries, available at www.bsr.org/adaptation.

We identified four steps companies should consider as they develop climate change adaptation strategies:

1. Create value by understanding and addressing new customer needs. All companies need to evaluate how a changing and uncertain climate will affect customers, and consider how to better serve current and new markets.

Hydration, energy management, micro-insurance, advanced weather prediction, better science and technology for agriculture, and real estate and building solutions are just a few areas in which companies can provide new products and services to address growing needs.

2. Protect value by securing assets, operations, and supplies. Most companies will also be well served by taking action now to mitigate their operating risks. Companies that have operations or depend on suppliers near coasts, at flood plains, and in deserts will find that more extreme and frequent weather events can compromise infrastructure and disrupt suppliers.

A number of sustainability approaches — such as local procurement, green building, and dialogue with communities — can help address these risks by diversifying assets and establishing redundant systems.

3. Strengthen long-term geographic strategies. In addition to present-day weather events, climate change produces longer-term changes to physical geographies.

Companies in the mining, transportation, travel, exploration, and buildings sectors should prepare for completely different physical landscapes and related business models. For those in farming, tourism, and health care, temperature changes will lead to migrations of people, plants, animals, and ecosystems services, changing the locations of the ingredients necessary for effective operations.

Adjusting to this will take time, which means action is required now.

4. Invest in vulnerable communities. All of these challenges will disproportionately affect poor and disenfranchised people by exacerbating issues such as water scarcity, high food prices, and the loss of insurance coverage.

Companies should look for ways to help these vulnerable populations by offering the infrastructure, products, and services that increase their resilience. While doing so, they should also consider whether their operations might exacerbate challenges people are already facing due to changing weather patterns.

If your company is new to the concept of climate change adaptation, the first step is to assemble personnel with strategic and executive responsibilities and identify the most important issues.

In doing so, consider potential “hot spots” in your company’s markets, operations, and plans (see sidebar for a selected list), and evaluate how more volatile and uncertain weather is like to affect your company.

Then identify the top questions that need to be answered, and establish responsibility for understanding the situation better, ensuring an ongoing review, and investing sufficiently in solutions.

First posted at Greenbiz.

Though hopes for Cancun are modest, we are in a phase of climate progress. Recently, all major emitting countries updated their emissions-reductions commitments through the Copenhagen Accord, and rich nations have pledged US$30 billion for long-term finance. China is coming around, finally acknowledging that it is the number one emitter of greenhouse gasses, and saying that it has no problem with transparency mechanisms. Meanwhile, there are more ways than ever for China and the United States to work together.

But perhaps most significantly, the climate talks are undergoing an overdue test, and no matter what the results will be, the onus is on business to play a greater role in global climate action. Consider these developments:
The relevance of the talks themselves is being examined. Most of the progress made this past year linked to the Copenhagen Accord, which is actually a rogue organization. While the Accord—a tally of opt-in pledges for emissions reductions—may seem innocent enough, it subverts the traditional UN process that requires unanimous agreement to move forward. The Accord—an eleventh-hour effort—was the only solution that broke the stalemate that resulted when objections from a handful of negotiators brought the talks among 200 countries to a halt. Initially controversial, this development created an impetus for a growing acceptance that, as Coca-Cola’s Chief Executive Officer Muhtar Kent has said, the world needs more than a single agreement to this vast, heterogeneous problem.

The UN climate talks are designed primarily for governments to work together, and they permit civil society representatives to attend. Yet, they exclude direct involvement by business organizations, even though business is uniquely informed and capable of contributing solutions for technology, finance, and managing climate risks—and arguably the real hope for fixing the climate problem in general. The need, and opportunity, for business to lead is why the UN’s former Climate Chief Yvo de Boer says he left the agency to work for KPMG. In turn, governments themselves are calling on business to take on a larger role.

Finally, there is growing appreciation that an international agreement is not a prerequisite to action, and that those motivated to solve the problem should look for ways to drive innovation, efficiency, mobilization, and collaboration without waiting. Business offers some of the best tools for this, and is well positioned to meet some of the grander calls for efforts such as starting a grassroots, networked, and distributed movement to transform the way we organize around the climate issue. Additionally, the indefinitely delayed U.S. legislation makes the opportunities for business to stand out greater than ever before.

The UN climate agency currently faces a new test—triggered by a shift in consciousness that a solution will require a different approach—that includes calls for business to be more involved. It also raises the stakes: Growing frustration with governments means that more attention is on businesses that aren’t taking action. Also, private-sector leaders will need to engage on public policy and partner with governments—and this comes with a tall order of expectations that efforts are transparent and accountable.

Overall, business now has what it has so often asked for: the opportunity to lead ahead of governments on a great global, social challenge.

First posted at BSR.