When it comes to contracting for a computer service, there is little choice but hoping for the best. Small or mid-size companies, especially those located outside the United States, are betting they’ll never have to go to court – usually one located 11,000km and thousands of dollars in legal fees away. Let’s face it: contracting with a large American company is a jump into the unknown. Agreements are written in an obscure form of English, often presented in PDF format, transparently implying modifications are out of question. Should you consider litigating, be prepared to make your case before a judge located on the West Coast of the United States. The not-so-subliminal reading of such contracts: ‘Sue me…’, with a grin.
The Cloud’s rise to prominence makes things worse. A growing number of companies and individuals handle their data to a remote infrastructure offering little hope of any legal leverage. The Cloud is the ultimate form of the outsourcing cascade. A US-based company rents capacity wherever electric power is cheap, connections reliable, and climate friendly to server farms cooling towers. As world connectivity expands, so do eligible regions. (While doing research for this column, I found Greenland was for served by a 960 Gbps (Gigabit per second) undersea cable linked to Iceland. In turn, the volcano island is linked to the rest of the world via a the huge 5 Tbps “Danice” cable). Datacenters are sprinkled over a number of countries and workload moves from one server farm to another as capacity management dictates. At this point, no company knows for sure where its data reside. This raises further legal hurdles as Cloud operators might be tempted to deploy datacenters in less stable but cheaper countries with even looser contractual protections.
European lawyers are beginning to look at better ways to protect their clients’ interests. A couple of weeks ago, I discussed the legal implications of Cloud Computing with Guillaume Seligmann, the lead tech attorney at the law firm Cotty Vivant Marchisio & Lauzeral. (He is also an associate professor at l’Ecole Centrale a prominent French engineering school). ‘When it comes to Cloud Computing, the relationship between the service provider and the customer is by nature asymmetrical’, he says. ‘The former has thousands if not millions of customers and limited liability; in case of litigation, it will have entire control over elements of proof. As for the customer, he bears the risk of having his service interrupted, his data lost or corrupted — when not retained by the supplier, or accessed by third parties and government agencies)’.
In theory, the contract is the first line of defense. ‘It is, except there is usually little room for negotiation on contracts engineered by expert American attorneys, based on US legislation and destined to be handled by US judges. Our conclusion is that solely relying on contracts is largely insufficient because it may not offer efficient means of sanctioning breaches in the agreement’.
The CVML partner then laid out six critical elements to be implemented in European legislation. These would legally supersede US contractual terms and, as a result, better protect European customers.
1 / Transparency. Guillaume Seligmann suggests a set of standard indicators pertaining to service availability, backup arrangements and pricing – like in the banking industry for instance. In Europe, a bank must provide a borrower with the full extent of his commitments when underwriting a loan. (Some economists say this disposition played a significant role at containing the credit bubble that devastated the US economy).
2 / Incident notifications. Today, unless he is directly affected, the customer learns about outages from specialized medias, rarely though a detailed notification from the service provider. Again, says Seligmann, the Cloud operator should have the obligation to report in greater details all incidents as well as steps taken to contain damage. This would allow the customer to take all measures required to protect his business operations.
3 / Data restitution. On this crucial matter, most contracts remain vague. In many instances, the customer wanting to terminate his contract and to get back his precious data, will get a large dump of raw data, sometimes in the provider’s proprietary format. ‘That’s unacceptable’, says the attorney. ‘The customer should have the absolute guarantee that, at any moment of his choosing, he we have the right to get the latest backed-up version of his data, presented in a standard format immediately useable by another provider. By no means can data be held hostage in the event of a lawsuit’.
4 / Control and certification. Foreign-headquartered companies, themselves renting facilities in other countries, create a chain fraught with serious hazards. The only way to mitigate risks is to give customers the ability to monitor at all times the facility hosting their data. Probably not the easiest to implement for confidentiality and security reasons. At least, says Guillaume Seligmann, any Cloud provider should be certified by a third party entity in the same way many industries (energy, transportation, banking) get certifications and ratings from specialized agencies – think about how critical such provisions are for airlines or nuclear power plants.
5 / Governing laws. The idea is to avoid the usual clause: “For any dispute, the parties consent to personal jurisdiction in, and the exclusive venue of, the courts of Santa Clara County, California”. To many European companies, this sounds like preemptive surrender. According to Seligmann’s proposal, the end-user should have the option to take his case before his own national court and the local judge should have the power to order really effective remedies. This is the only way to make the prospect of litigation a realistic one.
6 / Enforceability. The credibility of the points stated above depends on their ability to supersede and to render ineffective conflicting contractual terms imposed by the service provider. In that respect, the European Union is well armed to impose such constraints, as it already did on personal data protection. In the US, imposing the same rules might be a different story.
The overall issue of regulating the cloud is far from anecdotal. Within a few years, we can bet the bulk of our hard drives – individual as well as collective ones – will be in other people’s large hands: Amazon S3 storage service now stores 339 billion objects – twice last year’s volume.
We’ll gain in terms of convenience and efficiency. We should also gain in security.