Recent Contributions

Keywords:Legal Issues, Cloud Computing
Authors: Janine Bowen, Stephen Sorett and Jason Silverman from McKenna Long & Aldridge LLP.

Stephen M. Sorett is an attorney in the Washington, DC office of McKenna Long & Aldridge LLP focusing on all phases of government contracting with an emphasis on outsourcing, privatization, and project finance transactions. For many years he has dealt with all aspects of the public contracting process at the federal, state, and local levels of government. Mr. Sorett has more than 30 years of acquisition experience in all phases of government contracting, having worked in government first at the U.S. General Accounting Office and then as an Assistant General Counsel at the U.S. Environmental Protection Agency. In addition, Mr. Sorett headed up the legal department for an aerospace and defense firm with responsibilities that included the IP protection program in a classified environment. He also served as VP of Contracts for a major government contractor that included providing IT support to major federal agencies and was the Director of Curriculum of George Washington Law School's Government Contracts Program which covered courses on all aspects of the procurement process including IT, secrecy, and protection of confidential data. Mr. Sorett is listed in Who's Who in America, Who's Who in American Law and Who's Who in American Education.

Janine Bowen is an attorney in the Atlanta office of McKenna Long & Aldridge LLP where her practice focuses on strategic commercial transactions involving technology and intellectual property.  Such transactions include licensing and acquisition of technology; issues surrounding the protection and exploitation of Internet-based assets; privacy and information security; and technology export compliance.   Janine counsels clients on general technology and intellectual property matters, negotiates and drafts a wide range of technology agreements, and handles technology disputes.  She also serves as technology counsel on M&A transactions and has significant general contracting experience. Janine is also a Certified Information Privacy Professional (CIPP).  This credential certifies her expertise in a broad range of corporate privacy issues including laws and concepts in the U.S., E.U. and the Asia Pacific region, and includes workplace privacy, information security, web privacy, security, and data sharing and transfer.
Abstract:
This presentation will highlight opportunities and associated legal risks inherent in cloud computing and will address some implementation methods for minimizing or mitigating those risks. It will also identify considerations for adopting successful business models involving cloud computing. This presentation will be aimed at those looking to develop businesses or purchase services from businesses in the cloud computing space. No specialized legal knowledge is necessary, however it will also be informative to those with backgrounds in law and compliance.

Placing assets, such as data or key computing resources, in the hands of people who do not own them opens the door to numerous legal risks. Companies that maintain data on behalf of others risk liability in the event that that data is lost, damaged, or compromised. Companies that host applications for the use of others risk liability if those applications become unavailable. And, of course, there are intellectual property questions concerning ownership of and rights in information and services placed “in the cloud.”
Key legal considerations for anyone that is considering either providing or using services “in the cloud” will be discussed. For example, typical license agreements will be replaced by service agreements where key contract terms like payment, warranty, liability protection, and infringement will differ from licensing models. Additionally, there are numerous privacy and security implications, for example, how one must treat international data capture, storage and maintenance and compliance with data protection and data breach laws across the country and internationally. Because cloud computing is by definition ‘locationally irrelevant’ - meaning one doesn’t know (or necessarily think to ask) where data is being stored -complex jurisdictional issues (i.e. where a lawsuit can be filed and tried) can arise in the event of a dispute. Obviously intellectual property issues are tantamount, especially in this era of user-generated content, lower respect for proprietary rights among the consuming public generally, and use of social networks as potentially unauthorized distribution models. Finally, and quite importantly, there are a number of commercial considerations. These considerations include assurances regarding data integrity and ability to access data 24/7 and in a disaster recovery scenario, the proliferation of encryption technologies, the long term commercial viability of the service provider, and backup plans (in both the disaster recovery and commercial viability contexts) when using the cloud for mission critical applications.
Potential areas of opportunity and legal risk beyond those present in business arrangements between private parties will also be addressed. Federal, state and local governments are spending increasing resources on information technology, including on privatizing certain historically governmental functions. In this evolving environment, government contractors may use cloud computing in conducting their work for the government. For example, the Department of Defense has discussed requiring, as a condition of being awarded federal government contracts, that defense contractors in the nation’s critical industrial base have plans to ensure continuity of operations in the event of a catastrophic occurrence. Cloud computing would have a clear connection to any such requirement. Contractors may also assist with implementing various direct government uses of cloud computing. For instance, agencies may shift their existing internal information technology structures to those employing cloud computing. Also, agencies -- particularly those tasked with defense, homeland security, and emergency response -- are looking increasingly to distributed storage of their own data in order to provide continuity and redundancy in the event of catastrophic events. Agencies are also planning to computerize data relating to users of their services. The federal government has already announced its plan to computerize healthcare records, an initiative that is likely to be repeated in other contexts. Cloud computing is also relevant to the implementation of the Department of Defense’s Net-centric Warfare doctrine. In all such applications, distributed storage of data and software presents the same legal issues -- data security, privacy, interruption risks, and intellectual property -- as in the private sector, but with an overlay of legal issues peculiar to government contracting. Contractors will need to be familiar with government procurement laws and regulations, contract security requirements, and export controls, among others, and to understand the risks of non-compliance.