Thursday, August 6, 2009

Cloud Computing & The Forgotten Legal Aspects

With all the hype (technical & marketing) around cloud computing the business risks of the cloud often get overlooked - especially the legal aspects. We've heard about the big benefits:
- access from anywhere with an internet connection
- minimizes capital investment (hardware, facilities, etc.)
- potential for quick scalability (if applications are capable)
- temporary computing capacity (staging, development, DR, migrations)

Most of us in the industry also know about some of the security risks (CIA) associated with cloud computing too. An example of the availability risk recently occurred on August 6th, 2009 when Twitter, YouTube, and LiveJournal were all impacted by a DDoS attack (see NYTimes article). Unlike some of these areas, the legal implications of the cloud are still "To Be Determined" (TBD).
What are some of the legal areas that need to be considered when you begin to seriously consider Cloud Computing for your enterprise?

Jurisdiction:
How do you determine where the data is being stored? This is important because it will determine what courts have jurisdiction and what law governs the use and treatment of that data.

Privacy: What legal access rights do law enforcement organizations have over personal information stored in the cloud? Remember that privacy laws vary considerably between countries and also between states within the US.

Licensing and Contractual Issues: What controls are in place for fee increases and service levels. How do you transfer from one cloud provider to another? (Are you locked in to a technology if your utilizing Microsoft's Azure or Google's App Engine?) What intellectual property protections are in place for the solution, the stored information, the hosted applications, etc.

I'm not suggesting these legal issues are important to everyone, or even enough of a reason to avoid the cloud in it's current state. What I am suggesting is, you want to be sure and consider these areas and understand the risks involved for your organization before you decide to jump on the cloud computing bandwagon.

Don't be Another Statistic!