Cloudy with a chance of confusion
Cloud computing and its challenges are changing quickly
One of the most confusing aspects of modern technology can be dealing with the “cloud,” that amorphous sounding digital land where the bits and bytes of your records go to await your beck and call.
The Florida Courts Technology Committee has stepped into this fast-changing landscape with changes to something called the Integration and Interoperability Document, which basically governs ways the court system’s computers operate, interact, and exchange information. Most of those changes, according to Jannet Lewis, chair of the FCTC Technical Standards Subcommittee, deal with cloud computing.
There’s some information that could be useful for lawyers, as well as the clerks of court and courts governed by the document.
Cloud service originally started mostly as a way to store data; now actual programs and other services are available. It’s attractive because it can save money but is not without risks.
“There have been some good experiences with the cloud and some bad experiences with the cloud,” Lewis said. “We wanted to take all of that into consideration with some standards.”
Most of the standards are general, with some specifics as needed.
One is where the actual data is to be kept. The standards require that the important records be kept on cloud servers in Florida, although backup copies can be on servers elsewhere in the U.S.
“Most government cloud [services]. . . one of the things they do is keep things in the United States,” Lewis said. “Because if you have problems getting to your data and you get into some sort of legal challenge or legal disagreement, you don’t want to deal with the laws of another country. It’s complicated enough with things here in the United States.”
Critical and essential court data, such as case files and records identified in Rule of Judicial Administration 2.420(b)(1), fall under that requirement and must be encrypted when they are sent to and from cloud storage and while residing in storage.
Less critical information, such as computer activity logs and temporary information, can be stored outside of the country as long as that does not cause any delays in duplicating those records.
The standards also require that when courts or clerks decide to use the cloud for storage or services, before that transfer the FCTC must get a plan on how that transfer will happen including a letter signed by the local chief judge approving that change.
Another recommendation, according to the plan, is making sure that records and information are returned to the courts and clerks in the same format they were sent and in a timely manner. Checks must be made to ensure the security of information during transfer and while held in storage.
“One of the lessons learned with the cloud is sometimes it took longer than expected to get the data back,” Lewis said.
Another suggested practice is to carefully read any updates to the service. Just as when software is upgraded for smart phones, tablets, and computers, providers often modify the terms of service and other promises as part of those changes and many people accept them without review.
“When you’re with the cloud system, you may want your legal [office] to review those things more carefully so you’re not undoing some of those safeguards you’ve put in place and not realizing you’re agreeing to undo some of those things,” Lewis said.
FCTC member and Sarasota Clerk of Court Karen Rushing asked Lewis, “It makes me nervous that every time I ask an IT person, ‘Who is the cloud? What is the cloud? Where is the person I’m doing business with?’ I don’t get very straight answers. So I don’t have a contract with a real person to ensure that none of the data is going to be compromised in any way. I see those are the principles, but who am I contracting with to do that?”
“A lot of the big companies are Microsoft, Amazon, and Google; those are probably the big three in the U.S.,” Lewis replied. “You can have it in the contract where things reside; you can even have dedicated servers.”
She added a cautionary tale: “Some law enforcement agencies went with the cheapest vendor and it was out of country. Then that company got bought out, and that new company said, ‘Oh, we’re the new owners, and if you want to see your data, that will be $10,000.’ That has already happened.
“We want to warn people before they’re proceeding. They want to know where their data is residing, and make sure all the bases covered.”
The FCTC approved the changes to the Integration and Interoperability Document, including the extensive revisions to the cloud computing section.
While the FCTC action is intended to help courts and clerks, The Florida Bar has published information to guide lawyers in their dealings with the cloud.
The Bar has issued Professional Ethics Opinion 12-3, which says that attorneys can hire cloud services “if they take reasonable precautions to ensure that confidentiality of client information is maintained, that the service provider maintains adequate security, and that the lawyer has adequate access to the information stored remotely. The lawyer should research the service provider to be used.”
The full opinion can be found on the Bar’s website.