Whose data is stored in the cloud? When I use my Google Apps account to send email, publish my blog, upload pictures to Picasa (now Google Photos), or when my personal documents are synced with Google Drive or Dropbox, do I retain the copyright and ownership of that data? The answer is not so easy.
A brief filed by the U.S. government in the case “United States of America vs. Kim Dotcom, et al.,” in U.S. District Court for the Eastern District of Virginia, states that contracts made with a cloud provider “likely limit any property interest” an individual has in the data they have uploaded.
The government’s brief, filed October 30, 2012, is a response to one filed on behalf of Electronic Frontier Foundation (EFF) client Kyle Godwin, whose data was rendered inaccessible after the US government shut down cloud provider Megaupload earlier this year.
According to a statement from EFF:
The government argues that both the contract between Megaupload and Mr. Goodwin (a standard cloud computing contract) and the contract between Megaupload and the server host, Carpathia (also a standard agreement), ‘likely limit any property interest he may have’ in his data. (Page 4). If the government is right, no provider can both protect itself against sudden losses (like those due to a hurricane) and also promise its customers that their property rights will be maintained when they use the service. Nor can they promise that their property might not suddenly disappear, with no reasonable way to get it back if the government comes in with a warrant. Apparently your property rights ‘become severely limited’ if you allow someone else to host your data under standard cloud computing arrangements.
This should send chills through any enterprise IT exec considering storage in the public cloud. If your company needs more physical space for your old files (I mean paper files), and hires an external storage facility, with a typical lease agreement, those files still belong to the company and nobody disputes that. If your company leases virtual storage for digital files from a standard cloud provider, such as Google or Amazon, your company “may have severely limited any ownership rights” on that data — at least, if the US government’s arguments in this case hold up at trial.
While I can understand that the government, as part of a criminal investigation, should be able to request access to data after obtaining the necessary warrants, until now the ownership of that data has not been in question.
The good news is that some cloud providers are beginning to understand these issues and include provisions in their service agreements that explicitly guarantee your ownership. Google’s Compute Engine Service Agreement, for example, includes the following:
“As between the parties, Customer owns all Intellectual Property Rights in Customer Data and the Application or Project (if applicable) and Google owns all Intellectual Property Rights in the Services and Software.”
However, in case you need to make sure your data is properly identified as yours, and to avoid any possible dispute, the next time you negotiate an agreement with a cloud provider, you’d be wise to include these provisions in the contract:
- Clearly specify the process, duration, and ways the data will be returned to you, at any time in the contract duration.
- Also specify the format your data should be returned, usually the format the data was stored in the first place.
- Establish a limit, usually days, when the data should be fully returned to your organization.
- And, especially, clearly establish your claims of ownership of the data stored, and that you don’t waive any rights on your property or copyright.
Sometimes we just accept service agreements (where we just agree on the conditions set forth by the provider) without realizing the potential problems. I seriously recommend consulting an attorney.Tags: Cloud,Storage,Technology,Virtualization