“The companies offering cloud computing services are some of the biggest and best known in the information technology industry: Google offers the Google App Engine, Amazon.com sells Elastic Cloud Compute (EC2), Microsoft released Azure and Windows Live Sky Drive, and AOL provides Xdrive, to name a few. If you’ve ever used MySpace, Facebook, LinkedIn, Picasa, Flickr, Hotmail, or Gmail, then you’ve used cloud computing. A recent survey conducted by Pew Internet showed that 69% of all Americans use cloud-based software to store pictures, videos, emails, calendars and other various data online.”
Log onto any technology blog, attend any technology conference, or open any technology related article and chances are you will find at least one discussion of “cloud computing.” Check any second one, and you will probably find another discussion, but with a different definition of cloud computing.
Despite the confusion over the term “cloud computing,” the consensus seems to be that everyone is doing it. So what is cloud computing? Does it affect my business? If so, what should I do about it?
The potential benefits of cloud computing include many of the traditional benefits of a hosted solution. Regardless of location, a user can access a cloud computing solution as long as they can access the internet. Software is updated and maintained by the provider, decreasing the need for in-house support. Unique to cloud computing, however, is the potential that comes with shifting the infrastructure components to a shared, instead of segregated, model. Using this shared model, cloud computing advertises the possibility of capacity-on-demand, where software and hardware resources can be quickly scaled up or down to meet increased or decreased usage. Because users do not own the physical infrastructure, they only pay for the resources they use. Cloud computing also shifts the burden of ownership, administration, and operation of hardware from the user to the third-party cloud provider. Cloud computing claims to be a solution to the processing and storage capacity challenges faced, at one time or another, by nearly every organization and provides users with tremendous flexibility in their information technology infrastructure.
With the benefits, however, come risks. Cloud computing gives rise to a number of practical and legal concerns, including the following:
Unplanned outages are a reality of any cloud computing solution. The inevitable downtime requires organizations to develop strategies and backup plans for how their business needs will be met during times when their cloud applications, and the data stored and processed by those applications, will be unavailable. A company must consider what sort of redundancies and workarounds are necessary to handle both temporary outages and major breakdowns in its cloud-based environment, and how it will be able to implement those alternatives with assistance from the cloud provider and, if necessary, separate and apart from the cloud provider. Understanding the cloud provider’s disaster recovery and business continuity measures, negotiating strong service level agreements and disaster recovery commitments, and implementing various other stop gap measures, such as off-line software synchronization, will help a company weather outages in its cloud computing solutions.
A major concern with cloud computing is the difficulty of determining where data will be stored, and, thus, what courts have jurisdiction and what law governs the use and treatment of such data (i.e., local, state, federal, foreign, etc.). Information sent or received by an organization or individual using a cloud computing service could be physically located in the United States or any other country in the world. How will a cloud computing customer address situations where one country’s reporting or discovery obligations conflict with the data privacy laws of another county? How will a cloud computing customer protect its intellectual property rights against infringement or other wrongful activity when its cloud-based applications are hosted in a country that does not recognize certain intellectual property protection measures? These and other potential conflicts between the various jurisdictions involved in a cloud computing solution should be resolved from the outset of the arrangement.
Security and Privacy
Licensing and Contractual Issues
Cloud computing requires agreements that provide for a licensing structure and contract terms that fit the cloud computing model of shared resources and web-based computing. Since pricing in cloud computing is typically based on a pay-as-you-go approach, customers need to ensure adequate means for verifying their fee obligations and controls on fee increases. Service levels are key to ensuring that a customer has the needed level of accessibility to its cloud-based IT environment. A customer should carefully consider how it will transition from one cloud provider to another, or away from a cloud computing environment, and what contractual obligations it would need in place to ensure that such a transition occurs smoothly. In addition, any cloud computing agreement should document a comprehensive understanding of each party’s intellectual property rights in the solution, the information stored, the hosted applications, and all developments that result out of the cloud computing arrangement.