International In-house Counsel Journal Vol. 4, No. 14, Winter 2011, 1 Head in the Clouds: Navigating the Legal Cloud Nebula JOSEPH J BAMBARA In-House Counsel, UCNY, Inc., USA Table of Contents Head in the Clouds: Navigating the Legal Cloud Nebula Technology and the Cloud Review of Cloud Computing technology and types Benefits of Cloud Computing Surprise benefit of Cloud Computing technology: Security Risk / Rewards of Cloud Computing Risks of Cloud Computing Deeper Look at Risks associated with Cloud Computing Evidence control and the Cloud Danger of Cloud Computing technology: Lost Data Danger of Cloud Computing technology: Privacy Conclusion In the world of computing and technology much has happened in a short time. This is especially true with respect to the new (sort of) technology known as “cloud computing”. This article will provide a brief review of cloud computing technology. After which, we will we continue a "deep dive“ treatment of cloud computing and the law with the objective of preparing the practicing attorney to navigate through this nebulous topic. The article (in two parts) will touch upon everything from updated privacy rights to enhanced deployment models as well as liability and contingency plans for the inevitable downtime. Review of Cloud Computing technology Legal considerations for businesses considering cloud computing. Identify legal risks of placing assets, such as data or key computing resources, in the hands of people who do not own them Review Intellectual property issues concerning ownership of and rights in information and services placed “in the cloud.” Some guidelines into what and whose law governs certain cloud services and the data they manage Some E-Discovery guidelines into possession, custody or control over data in the cloud that is sought in litigation Technology and the Cloud Review the “Timeline” diagram (see figure 1) to get an idea of emerging technology and the rapid evolution thereof. It is important to note that in 2010, there are 4 billion Mobile International In-house Counsel Journal ISSN 1754-0607 print/ISSN 1754-0607 online 2 Joseph J Bambara phone subscribers (67% of world population) and 1.8 billion Internet users: (26.6% of world population). See See http://www.internetworldstats.com/stats.htm. The table has been set for the emergence in 2005 of a new paradigm “cloud computing (see figure 2). Figure 1 Figure 2 Cloud computing is a paradigm of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure in the "cloud" that supports them. The term “cloud” is used as a metaphor for the Internet, based on how the Internet is depicted in computer network diagrams and is an abstraction for the complex infrastructure it conceals. See http://en.wikipedia.org/wiki/Cloud_computing Although cloud computing seems new, the underlying concept of multiple users sharing computer resources is not new. In 1969, the U.S. Department of Defense's Advance Research Projects Agency (ARPA net) sought to expand the distances over which Cloud Computing 3 computers could reliably communicate. The ARPAnet project sought to create a platform that would allow distributed users to share their valuable computing resources and collaborate on documents. Using the ARPAnet, a user could access a computer located elsewhere on the network and function as a local user at the remote site. The ARPAnet mainly linked government agencies and universities( see figure3) , but it was out of the ARPAnet that what we now know as the Internet was originally developed. See, figure 4. Figure 3 Figure 4 With the development of the operating system, stand-alone computers could perform multiple functions simultaneously for the first time. This opened the door for a single central server or computing device supporting several stand-alone personal computers or 4 Joseph J Bambara dumb terminals (keyboards and computer screens) housed in the same physical location. The terminals would connect to the central server, which would do the terminal's actual processing. Cloud Computing is an evolution from these previous efforts at shared computing. As prices for processing power and storage have fallen and high-speed internet connections have become ubiquitous, cloud computing has become an increasingly attractive option for many individuals and businesses Figure 5 Cloud computing (figures 5 #1,#2,#3,#4) refers to data, processing power, or software stored on remote servers made accessible by the Internet as opposed to client computers. The term "the cloud" #3 comes from computer network diagrams which, because the individual computers #4 that formed its components were too numerous to show Cloud Computing 5 individually, depicted the Internet as a vast cloud at the top of the network chain. One of the key features of cloud computing is that the client does not own the technology they are using. All the hardware and software is owned by a cloud computing service, See #4 The user/client simply rents time or space. See #1 At the same time, cloud computing also creates dependency. The emergence of cloud computing services is structured around a re-imagining of the relationship between technology and end users. The client #1 must rely on the cloud service provider (#2,#3,#4) to ensure that data is kept secure and reliably accessible. They must also depend on the telecommunications infrastructure (between #1 and #2) that will act as the delivery and retrieval pathways for the flow of data to and from the cloud. In addition, once a client adopts a cloud computing arrangement it will be difficult to move back to a local computing platform. Review of Cloud Computing technology and types Figure 6 There are three basic types (service models) of Cloud Computing Services (see figure 6): 1. Software as a Service (SaaS) is the most common and widely known type of cloud computing. SaaS applications provide the function of software that would normally have been installed and run on the user's desktop. With SaaS, however, the application is stored on the cloud computing service provider's servers and run through the user's web browser over the Internet. Examples of SaaS include: Gmail, Google Apps, and Salesforce. 2. Platform as a Service (PaaS) cloud computing provides a place for developers to develop and publish new web applications stored on the servers of the PaaS provider. Customers use the Internet to access the platform and create applications using the PaaS provider's API, web portal, or gateway software. Examples of PaaS include: Saleforce's Force.com, Google App Engine, Zoho Creator. 3. Infrastructure as a Service (IaaS) seeks to obviate the need for customers to have their own data centers. IaaS providers sell customers access to web storage space, servers, and 6 Joseph J Bambara Internet connections. The IaaS provider owns and maintains the hardware and customers rent space according to their current needs. An example of IaaS is Amazon Web Services. IaaS is also known as utility computing. So for new users considering the “cloud”, the fundamental issue is how do you maintain control of data. Data that is essential for you, your business, your clients must be controlled so that no failure cause loss of access or the data itself. Some facts and observations about data in the “cloud” include: When users place their data and applications on centralized servers, they lose the ability to maintain complete control of that information. With the rise of cloud computing, critical and sometimes sensitive information that was once safely stored on the businesses local computers now resides on the remote servers of the service provider. One of the biggest risks of storing data in the cloud is the possibility that this data will be accessed by unwanted third parties. For example, many email providers allow secondary advertising uses for e-mail communications. Legal rights and regulatory authority for the protection of the privacy of cloud computing users are not well defined. Data stored in the cloud may be subject to less stringent legal protection than data stored on a local computer. For example, under the U.S. Electronic Communications Privacy Act, data stored in the cloud may be subject to a lesser standard for law enforcement to gain access to it than if the data were stored on a personal computer. Health information services that store user medical information may not be subject to the privacy protections of the U.S.. Health Insurance Portability Protection Act (HIPPA). Even where it is clear that user data is protected, cloud computer service providers often limit their liability to the user as a condition of providing the service, leaving users with limited recourse should their data be exposed or lost. Storing data in the cloud means that access to that data is subject to the cloud computing service provider's terms. Often the terms of service allow the cloud computing service provider to terminate the service at any time. Imagine a data hostage scenario where a user needs to gain access to online information, but the data holder refuses that access without first receiving a payment or other compensation. Benefits of Cloud Computing So if there are issues and risks then what are the pervasive benefits of Cloud Computing technology? The benefits include the following: Cloud Computing 7 Ability to work from anywhere, i.e. , device and location independence which enable users to access systems using a web browser regardless of their location or what device they are using (e.g., PC, mobile). Multi-tenancy enables sharing of resources and costs across a large pool of users thus allowing for: Centralization of infrastructure in locations with lower costs (such as real estate, electricity, etc.) Peak-load capacity increases (users need not engineer for highest possible load-levels) The bottom line benefit of Cloud Computing technology is the Return on Investment (“ROI”) Utilization and efficiency improvements for systems that are often only 10– 20% utilized.