ADVERTISEMENTS

Mainstream adoption of cloud computing is a relatively new phenomenon, as is the introduction of cloud computing products into the legal marketplace.

Most legal cloud computing vendors are start-up companies that haven?t been in the business of providing legal cloud computing products for more than two years.

Also noteworthy is the fact that most of the owners of those companies are software developers, not lawyers. The products that have been created undoubtedly are useful and most certainly will aid lawyers in simplifying their practices. The vast majority of cloud computing services, however, were created by software developers with lawyers? work flow in mind, rather than lawyers? ethical obligations to keep client data safe, secure and confidential.

Therein lies the problem with many cloud computing products currently available: They simply do not provide the security measures lawyers require in order to meet their ethical obligations.

It?s not just small scale cloud computing products that have that problem. Until very recently, even Google didn?t provide its enterprise customers with geo-redundancy ? a practice by which data is backed up frequently on servers located in different geographic regions.

Fortunately, the North Carolina State Bar recently issued a proposed formal ethics opinion (proposed 2010 FEO 7), which may assist lawyers in assessing the risks of using a particular cloud computing product in a law practice.

The opinion offered a broadly framed, elastic standard that permits individual attorneys to make careful choices about the technologies that best fit their individual practices. I submitted a letter to the NCSB as an interested party supporting just such a standard, so when the NCSB notified me of its proposed opin- ion, I was very happy indeed.

In the opinion, the NCSB offers lawyers a detailed list of ques- tions to ask Software-as-a-Service vendors, suggesting that satis- factory answers may reduce risk to confidentiality and security of client data:

• What is the history of the SaaS vendor? Where does it derive funding? How stable is it financially?
• Has the lawyer read the user or license agreement terms, including the security policy, and does he or she understand the meaning of the terms?
• Does the SaaS vendor?s Terms of Service or Service Level Agreement address confidentiality? If not, would the vendor be willing to sign a confidentiality agreement in keeping with the lawyer?s professional responsibilities? Would the ven- dor be willing to include a provision stating the employees at the vendor?s data center are agents of the law firm and have a fiduciary responsibility to protect client information?
• How does the SaaS vendor, or any third-party data hosting company, safeguard the physical and electronic security and confidentiality of stored data? Has there been an evaluation of the vendor?s security measures, including firewalls, encryption techniques, socket security features and intrusion-detection systems?
• Has the lawyer requested copies of the SaaS ven- dor?s security audits?
• Where is data hosted? Is it in a country with less rigorous protections against unlawful search and seizure?
• Who has access to the data besides the lawyer?
• Who owns the data ? the lawyer or the SaaS vendor?
• If the lawyer terminates use of the SaaS product, or the service otherwise has a break in continuity, how does the lawyer retrieve the data and what happens to the data hosted by the service provider?
• If the SaaS vendor goes out of business, will the lawyer have access to the data and the software or source code?
• Can the lawyer retrieve data off of the servers for his or her own offline useful backup?
• If the lawyer decides to cancel the subscription to SaaS, will he or she get the data? Is data supplied in a non-proprietary format compatible with other software?
• How often is the user?s data backed up? Does the vendor back up data in multiple data centers in different geographic locations to safeguard against natural disaster?
• If clients have access to shared documents, are they aware of the confidentiality risks of showing the information to others?
• Does the law firm have a back-up for shared document software in case something goes wrong, such as an outside server going down?

All in all, the NCSB?s opinion is very helpful for lawyers con-sidering using a cloud computing products in their practice. It allows them the flexibility to determine the technologies that best fit their individual law practices while providing much- needed guidance

Make no mistake about it ? cloud computing undoubtedly is the wave of the future, but ample room remains for improvement. As lawyers learn more, they?ll begin to ask more compelling questions of SaaS vendors.

Cloud computing providers who wish to succeed in the legal marketplace will need to ensure a number of security measures are in place in order to make their products palatable to their target market. The NCSB?s list of questions is a very good place to start.

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.