Cloudy With a Chance of Disaster

Apple introduced iCloud to the world of consumer computing. The service promises to provide access to files, such as music and photos, from multiple devices. A radio advertisement touts the benefits of an online payroll system that can be accessed from anywhere in the world, and is so easy to use that even a boy operating a lemonade stand can use it. The concept behind iCloud and software that is accessible anywhere is not new, but is part of a rapidly growing technology platform called the cloud or cloud computing. Cloud computing gives both consumers and businesses the ability to use software applications and input and access data on any number of devices anywhere in the world.

Cloud computing is generally the ability to remotely access software and data from off-site servers and other hardware through the Internet. It is divided between public and private clouds. A public cloud services multiple clients and customers, and a private cloud, similar to traditional outsourcing that is controlled by the user, services only one or a limited number of clients and customers. Application software offered in the cloud, or software as a service (SaaS), runs on servers located off-site or in a remote location--the software does not reside on the desktop or local computer or server. Netbook computers are designed to operate SaaS because they don't need a hard drive, but instead merely need access to a browser and the Internet to operate the SaaS application.

Many of us are already in the cloud with Google's Gmail, Yahoo mail, Facebook, Flickr, and Google docs. The number of business applications is rising rapidly. The economic and other benefits cannot be ignored, particularly in stressed economic times. There are several potential drawbacks, especially for business applications, however, that need to be addressed before fully embracing and launching the concept.

Some of the advantages of a public cloud are the sharing of costs, infrastructure, and resources, but the advantages of a private cloud are control and security. Because cloud services are operated on servers not owned or operated by the user, there are significant cost savings available. Users do not need to support upfront capital investment to purchase the same level of hardware and software required for internal networks. With access through the Internet, information may be inputted and accessed from any location in the world where there is Internet access, and because the cloud is not tied to a specific location or device, the information may be accessed by multiple and diverse devices. Cloud services are scalable, again without significant cost increases.

Unfortunately, there are also several potential landmines that cannot be ignored, and many cloud providers have developed boilerplate terms of service that are non- or minimally negotiable. In many cases, the terms of service may be modified by the service provider simply by providing notice online. As a result, it may not be possible to negotiate several of the critical terms that impact use of the cloud.

Some unavoidable concerns are security and privacy, because both are out of the control of the user. The level of care exercised by the cloud service provider may not rise to the same level that the user might maintain. These security/privacy concerns are particularly relevant for financial institutions under GLBA and health care providers and business associates under HIPAA. Backing up data, business continuity, continuous access to data, backwards compatibility, and location of servers for purposes of US and international law regarding privacy are a few other examples of issues that need to be addressed.

Cloud computing is on the rise, and provides some incredible benefits, but it is not for everyone ... yet. No business should use the cloud without first fully assessing its needs and the downside, both legal and business, of failure to meet those needs. Any due diligence or assessment of cloud computing also should include a careful review of the terms of use.

Over time, many of the concerns with cloud computing will likely diminish, but for now, users must walk carefully through the minefield of potential disasters.

ABOUT JOHN H. REES
John is a business lawyer working with clients to develop strategies and solutions for complex legal challenges and managing legal risk, particularly for matters involving software and database licensing and SaaS, doing business in an online environment, building value in brands and protecting trademarks, appropriate use, licensing, and protection of copyrights, and complex business transactions, including corporate and real estate lending. John is a frequent lecturer and enjoys educating and training clients on how to solve their legal problems. Follow John at jhrees.com.