*Will you place your documents in the cloud?*
*Publication Date:* November 2009
*Volume:* 45-3
*Author:* Richard Schenkar
*Categories:* Practical resources, Computers, Internet, Security

Cloud computing is getting a lot of buzz because it offers a way for you
to lower costs and access resources with mobile devices that lawyers are
starting to carry as frequently as they used to carry briefcases. Like
most innovations, there are concerns arising out of cloud computing and
how lawmakers and regulators are responding to it.

Forrester Research defines cloud computing as “a pool of abstracted,
highly scalable, and managed computing infrastructure capable of hosting
end customer applications and billed by consumption.” If you have used
Google Apps (or Applications), or Amazon.com, you have used cloud
computing. As of September, 2008, ComScore Media Metric counted 4.4
million users for Google Docs (or Documents).

Among the critics of cloud computing, you will find the Electronic
Privacy Information Center (EPIC) (http://www.epic.org). In March, 2009,
EPIC filed a petition with the Federal Trade Commission (FTC) to
investigate the privacy and security of Google Apps, Gmail, and
Picasa parts of the Google cloud application suite. EPIC also filed an
FTC petition against Microsoft's Passport application. Another EPIC
filing concerned Choicepoint business practices after a 2005 security
breach. The Choicepoint filing resulted in fines totaling $15 million.

*What to Consider*

If you are considering using cloud computing suites, ask yourself these
questions:

*What will you put in the cloud?* You can place your datafiles,
letters, other materials or program applications like word processors or
spreadsheets in the cloud. This is not a revolutionary idea--when I first
learned online research, I was using a Texas Instruments Silent 700
terminal and a dial-up connection. The terminal had no memory and the
only record one had of the interaction was a long strip of thermal
paper. The brains driving the interaction were mine (with the
information generated from a documentation search that built the search
strategy) and the Lockheed computers I was accessing on which the Dialog
Information Retrieval System was running. You do the same thing now when
you search Google.

*Do you have permission* to put the data or application in the cloud? Do
you have appropriate licenses?

*Must you comply with a relevant statute?*

*Do the data you have raise issues* that would include such requirements
as those specified by contract, by privacy considerations, or electronic
discovery?

*How much service will your use of data in the cloud require?* Such
considerations as expenses of licensing for application software,
encryption, storage, training, and backup are worthy of addition to the
budget.

*What level of security will you require?* Lawyers must keep the
confidences and secrets of their clients secure. That infers the use of
encryption software and the use of reasonably secure ways to pass
encryption keys (the character strings used to unlock documents that are
encrypted) to people entitled to see the documents you have encrypted.
It also infers your use of procedures to strip the metadata out of
documents you store in the cloud.

*Are you billed in a way that allows for easy accounting? *Can you
separate amounts for the purpose of charge back or auditing?

*What liability is there for the loss of data?* Who is responsible for
maintaining the integrity of data in the cloud?

*If either party wants to end the agreement, who does what?* How do we
know the agreement is over and what happens then?

*What is the long-term stability of the service provider?* Is
it planning to be around to serve you in the future?

For more information about security issues, take a look at “Security
Guidance for Critical Areas of Focus in Cloud Computing” online at
http://www.cloudsecurityalliance.org/csaguide.pdf.