Beware of data floating in the clouds

The following article appeared in the August 24, 2009 edition of the Connecticut Law Tribune.

Beware of Data Floating in the Clouds:
Internet-based operating programs can pose headaches for litigators

It seems like every few months lawyers who want to stay on the cutting edge of technology need to learn a new catch phrase. The lawyer in the next office “blogs,” another one spends his day “tweeting,” and a particularly lucky attorney somewhere in Meriden has a “paperless office.” Now some lawyers are even “litigating in the clouds” – and I am not talking about that ponytailed lawyer who wears sandals to court.

What is cloud computing?

The latest hot technology topic for lawyers is “cloud computing.” At its core, cloud computing involves storing information and operating computer programs on the internet instead of on local computers or servers. The technology can be as simple as web-based email and as complex as running programs that required super computers just a few years ago.

As an example of cloud computing, this article was written using a service called GoogleDocs. Instead of using the word processing program on my computer, I opened my internet browser, logged into my Google account, and I typed away. Although the word processing program I used and the file that I saved were located on computer servers somewhere, I never knew where those computers were located. While most of my writing is done at my office, you could say that this article was written in the clouds. You are probably already a cloud computing user yourself. Most web-based email services are an early form of cloud computing as are online banking, auctions websites like ebay, and that online poker tournament that your son just won instead of studying for tomorrow’s math test.

The benefits of cloud computing

In addition to these seemingly trivial applications, more and more companies are shifting to cloud computing because it reduces costs, increases electronic storage capacity, and allows employees to access and use computer resources from any location and with increasingly smaller devices. In some instances, companies have shifted their entire core computing functions to internet based applications. This practice is becoming more common for companies who provide knowledge based services or for sales-based businesses.

Many of those sales-based businesses use a popular cloud computing service that helps users shift their entire sales and marketing program onto the internet, including hosted customer databases and lead generation software. A web browser and an internet connection are all that their salespeople need to do their jobs. So what happens if the leading salesperson from one of these companies continues to use the company’s account after leaving for a competitor or if she exports the firm’s customer relations database to her own account? You guessed it. That company will soon be litigating in the clouds.

Cloud computing and electronic discovery

But cloud computing is not just about trade secrets litigation or the practical challenges that a new technology creates for clients. This trend also creates significant issues for electronic discovery. Many of the electronic discovery challenges that are created by cloud computing, like complying with electronic discovery requests, document retention, and litigation holds, are topics that many trial lawyers have dealt with in the past. Hosting data and applications externally, however, also creates a new set of obstacles and strategic concerns that trial lawyers should consider at the earliest stages of a case.

The first step that you should take when cloud computing is a factor in a case is to assess your client’s use of cloud computing. If your client uses cloud computing applications, you will need to ask about their records management policies and their ability to place litigation holds on externally hosted data. Although larger corporate clients will already have records management policies in place, such policies vary widely based on the sophistication of the client and its regulatory environment.

The second step that you should take is to review the relevant cloud computing service-level agreement. Even if your clients have well crafted records management policies, those policies may become meaningless if the service agreements do not include provisions that effectively implement the company records management policies. For example, if a client’s policies says that emails should be deleted after six years, but those emails are still available “in the cloud,” then you may have an obligation to produce those emails. Some of the service agreements from Google, arguably the leading cloud computing service provider, state that “deleted” data may remain on its backup systems in perpetuity, which makes this much more than an academic concern.

Another problem that may become apparent from reviewing the service agreements is that some agreements do not provide for effective implementation of litigation holds. In some cases, this is by choice and in others instances the provider simply does not have the technical capabilities to implement a hold based on its network infrastructure. Regardless of the reason, critical records may be lost if a company’s decision to host its data online did not include requiring a mechanism for litigation holds. The cost of this decision could be court sanctions or, worse yet, the inability to recover key data that could win your case.

Possession, custody, and control of data in the cloud

An additional issue that this technology raises is the question of who has possession, custody, and control of data stored with a cloud computing service. Although most service agreements make it clear that the client owns and controls the data, this may not apply to server logs, version histories, and other data that may reveal important facts. Many cases could be won or lost if version histories, which are common in many cloud computing applications, show that a critical employee accessed a key file when that employee has otherwise claimed ignorance. Some service providers may try to avoid disclosing such logs or data for internal reasons, but they may not have a choice if that information is subject to a subpoena. Worse yet, if the service agreement does not require that the provider notify clients about subpoenas, this information may be disclosed to opposing counsel or government investigators without your knowledge.

Conclusion

Finally, it is important to remember that discovery of information stored with a cloud computing host applies to the other parties as well as your own client. While you may fear the unseen subpoena or the zombie email that was never really deleted, opposing counsel has the same concerns. But, with a basic understanding of the technology, you can help make sure that the facts that fall from the sky help your case instead of theirs.

This entry was posted in Publications. Bookmark the permalink.

Comments are closed.