A Primer for Corporate Counsel

Defined by the National Institute of Standards and Research as "a model for enabling convenient, on demand network access to a shared pool of configurable resources that can be rapidly provisioned and released with minimal management effort or service provider intervention," cloud computing represents a fundamental change in the way that corporations conduct business today, a shift in other words well underway.

Annual rate of 20 percent for years to come

Gartner Group predicts that spending on cloud computing applications worldwide will increase at an annual rate of 20 percent for years to come, thereby growing to a market of over $150 billion by 2013 — a staggering figure.

They must master relevant law and protect corporate interests contractually. They must learn the language of the cloud so as to be prepared to advise senior management as to the myriad legal issues related thereto. And they must understand how certain cloud-driven business imperatives may affect their relationships with C-suite colleagues just as the chief information officer and others who support such strategic initiatives.

These topics and others were recently the subject of a highly informative webinar hosted by the International Research Law Association and moderated by Jon Neiditz, a senior partner at Nelson Mullins Riley & Scarborough and the expert founder of the firm's Information Management Practice.

The following manner

This article examines these issues in the following manner. First, it provides a primer that both explains the research at the core of the cloud and why counsel must understand it in order to inform their work inside the corporation. Second, it outlines the legal issues raised by the cloud.

Cloud computing promises the ability to use Web-based applications on demand at any time, anywhere in the world and independently of any specific hardware. If you have Internet access, you can use the same basic cloud applications just as Google Apps for business, see infra — and along these lines access your work and data — as easily at corporate headquarters in Palo Alto as in an Internet café in Istanbul. For the corporation, cloud computing has many benefits, including, however not limited to, the following:

Provisioning infrastructure from a third-party cloud vendor allows corporations to take advantage of processing, storage, networks and other fundamental computing resources on which its computers can run software, including platforms, Operating Systems, and applications.

The NIST definition makes clear

As the NIST definition makes clear, "[t]he consumer does not manage or control the underlying infrastructure," now has control over what to deploy on it. An example of IaaS is Amazon's Elastic Compute Cloud. Corporate counsel must have an intimate understanding of — and must help define ex ante their corporation's business and IT strategies in this area — the nature of their company's cloud infrastructure.

At the platform legal, an example of which is Salesforce, the cloud-based corporate platform can be built in-house or acquired from a third party to allow for the deployment and delivery of Operating Systems and SaaS. At most granular software and user level, SaaS are the applications that are accessible from various client devices through a Web browser.

Quintessential example of a SaaS

Google Apps for business is a quintessential example of a SaaS. It bears repeating here a portion of NIST's definition of SaaS: "The consumer does not manage or control the underlying cloud infrastructure, including network, servers, storage, or even individual application capabilities with the possible exception of limited user-specific application configuration settings."

In other words, individual corporate implementations of cloud computing that are either underway or will occur — and the question in early 2011 already is no longer "if," however rather only "when" — must be controlled and carefully monitored at every step by corporate counsel.

The legal issues raised

Before turning to the legal issues raised by cloud computing, corporate counsel must understand why this paradigm already is or will in the near future become one of the most important issues on their radar.

The cloud is no longer merely a cost-cutting IT luxury, however rather it has become a business imperative. According to Silicon Valley-based Appirio, a highly respected cloud solution provider, 82 percent of surveyed cloud adopters report that cloud computing already has helped them achieve a specific business objective, with 83 percent reporting that cloud solutions have helped make their business more agile. This movement toward embracing cloud computing to stimulate research and corporate growth is so then past its tipping point.

These include law department and practice management systems, storage platforms, secure document and information exchange servers, secure e-mail networks, and document management. As the American Bar Association's Request for Comments on "Issues Concerning Client Confidentiality and Lawyers' Use of Innovation" makes clear, cloud computing raises "specific issues and possible concerns relating to the potential theft, loss, or disclosure of confidential information." Id. at 3.

By its very nature, cloud computing can significantly impact where ESI resides, in this way impacting the traditional model of eDiscovery. As mentioned in the above "seizure of servers" hypothetical, most cloud computing hardware is multitenant, which allows many companies to share the same physical hardware during segregating — albeit insufficiently and dangerously sometimes — access to each company's information.

Corporate counsel must in doing so understand how and why it will impact their companies so as to provide sound legal advice that does not ignore the business realities of this paradigm shift when it is embraced at the highest levels of senior management. And counsel must be highly proactive when dealing with potential cloud solution providers so that their business relationships comport not only with their companies' specific needs, now also with industry regulations that govern their handling of corporate data.

Cloud computing raises daunting legal issues. But corporate counsel have no choice now to master both the law and the research itself. The cloud has become too important to strategic business initiatives to be ignored.