Cloud Computing

1. Cloud Computing Challenges & Opportunities

2. What is iCloud Backup?

3. What is I-Cloud Backup? • The idea behind iCloud is to be able to access all your stuff no matter what Apple device you're using.  • Every user with an Apple ID gets 5 GB of storage for free to back up apps and settings on their iPhone, iPad, iPod. • The service also syncs your photos, documents, and email with your Mac and mobile devices.  • Whenever your device is plugged in and connected to Wi-Fi, it'll automatically sync your settings, apps, music, photos, etc. to your iCloud account. • If you ever need to restore your device, you just need to log in with your Apple ID and all your stuff will download from iCloud

4. What else? • Apple's operating system for Macs, called Mountain Lion, allows more non-Apple applications to take advantage of Documents in the Cloud. • This will allow text documents, presentations, drawings and more to be uploaded to iCloud.  • Once your documents are saved in iCloud, you can access them from iCloud.com your Mac, or your iPhone and iPad.

5. How to for Macs • NOTE: Requires iO5 device • For Macs • Step 1: • Go to System Preferences, then select iCloud, • Step 2: • Click Manage in the bottom right corner. • This will bring up your saved items including backups, game saves, and documents. You'll get a clear view how much space you  have.

6. How to for IPhone or IPad • Iphoneor iPad: • You can access this same menu by heading to Settings > iCloud> Storage & Backup > Manage Storage. • While inside you can free up space by doing several things: • Delete older backups • Select exactly what you want to back up to the cloud • Remove app backups that are too large or not important to you.

7. Need more than 5GBs? • First 5GB are free. • Apple offers 20 GB for $40 per year or 50GB for $100 per year. • Compared to Google Drive, which gives you 25 GB for $2.50 per month ($30 per year). And Dropbox, gives you 100 GB for $100 per year. • You can purchase more storage online on your Mac in System Preferences or from your iPhone or iPad under iCloud settings.

8. Why does it matter? • First: Cloud term is this idea that we use the Internet as part of or an extension of our computers. So our data can live on the Internet just like it used to on our hard drive. You access it over the Internet, as opposed to going to a folder on your desktop. • And second? Potential for hackers to go after.

9. Why does it matter? • RULE 3-7.1 CONFIDENTIALITY • (a) Scope of Confidentiality. All matters including files, preliminary investigation reports, interoffice memoranda, records of investigations, and the records in trials and other proceedings under these rules, except those disciplinary matters conducted in circuit courts, are property of The Florida Bar. All of those matters shall be confidential and shall not be disclosed except as provided herein. When disclosure is permitted under these rules, it shall be limited to information concerning the status of the proceedings and any information that is part of the public record as defined in these rules.

10. Benefits and Risks of Cloud Computing

11. Benefits of Cloud Computing • Cost • Cost-Effective File Sharing • Lower Software Costs • Secure Data Backup • Flexibility • Increased Storage Capacity • Peace of Mind (no server, software updates) • Lower Overhead (staff, hardware, etc.)

12. Risks of Cloud Computing • Cost • Network Dependence • Security • PRIVACY • HIPAA records • Gramm-Leach-Billey (personally identifiable information) • Regulatory Issues • International, Federal, State • EU vs. USA on Privacy • Constantly Evolving • Liability Exposure from Standard Form Contracts • Vague Service Obligations • Limited Reps & Warranties • No Indemnification

13. Broad assumptions of risk? Source: ABA Journal, February 2013

14. Questions before clouding • What data will be stored in the cloud? • Will this include unencrypted personal information? • Where will data be stored, and will the customer have any control over where data are stored? • Who will be able to access the data, and what rights will the cloud service provider have to the data (or to metadata relating to the stored data)? • When and in what format will data be returned to the customer? • What meaningful commitments is the cloud service provider willing to make with regard to data access, retention, protection, and security? Source: CIO Insight Magazine, June 2011

15. Cloud Computing Options

16. What kind of clouder are you? • Solo Practitioner • Multi-Attorney Office • Multi-Office Practice

17. What the Cloud Can Do • File Backup & Storage • Time & Billing • Office Suites • Document Collaboration • E-Discovery • Law Practice Management (LPM)

18. File Backup & Storage

19. Time & Billing

20. Office Suites & Document Collaboration

21. E-Discovery

22. Law Practice Management

23. History of Committee Opinions • Late 1990s and Early 2000s • Proliferation of personal computers and ease of accessibility began to make electronically stored information (“ESI”) financially attractive. • Many law firms had begun implementing and utilizing ESI systems by mid 2000s. • New issues and concerns arise regarding client confidentiality of electronically stored media. • In response, some states began issuing advisory ethics opinions by the mid 2000s.

24. Precursors to Cloud Computing • Virginia Standing Committee on Legal Ethics Opinion 1818 • (September 3, 2005) • Permitted electronic storage of documents without paper retention. • New Jersey Committee on Professional Ethics Opinion 701 • Proposed in late 2005 • (April 24, 2006) • Permitted use of electronic PDF filing of client documents. • State Bar of Arizona Opinion No. 05-04 • July 2005 • Requires competent and reasonable steps to assure that the client’s confidences are not disclosed to third parties.

25. History of Committee Opinions cont. • By mid to late 2000s many industries, including law firms, begin incorporating their electronically stored information into the cloud instead of storing electronic information on-site. • In response, several states issued advisory opinions dealing specifically with the particularized issues associated with cloud computing.

26. First State to Directly Address Cloud Computing • Nevada Standing Committee on Ethics and Professional Responsibility Formal Opinion 33 • (February 9, 2006) • First state advisory opinion dealing specifically with cloud computing. • Permitted electronic storage of documents on a 3rd party server. • Extended and adapted the basic principals underlying the New Jersey and Virginia advisory opinions.

27. Current “State” of Affairs • 13 states total have issued advisory opinions • 10 directly address cloud computing. • 3 others address issues with similar technology like online backups and file storage. • Florida just released a proposed advisory opinion January 25, 2013, and is pending final approval. • Up for consideration 06/28/13

28. Map of States with Advisory Opinions americanbar.org

29. Trend of States • All 14 states, including Florida, have adopted a reasonable care standard. • However, each state has adopted its own particularized set of specific requirements or recommendations.

30. Examples of Reasonableness • Stay abreast of best practices regarding data safeguards. (Alabama 2010-02) • Periodically review security measures. (Arizona 09-04) • Consult an expert if lawyer’s technology expertise is lacking. (California 2010-179)

31. Examples of Reasonableness cont. • Ensure unfettered access to the data when it is needed, including removing it upon termination of the service. (Iowa 11-01) • Follow clients’ express instructions regarding use of cloud technology to store data. (Massachusetts 12-03) • Ensure adequate backup. (Oregon 2011-188)

32. Examples of Reasonableness cont. • Use available technology to guard against foreseeable attempts to infiltrate data. (New Jersey 701, New York 842) • Discuss appropriateness of cloud storage with client if data is especially sensitive. (Vermont 2010-6)

33. Florida’s Approach • Adopted reasonable care approach • Florida committee proposed opinion 12-3 agreed with the advice given by: • Iowa Ethics committee • Opinion 11-01 • New York State committee on professional ethics • Opinion 842

34. Florida’s Adoption of New York Standards • Ensuring that the online data storage provider has an enforceable obligation to preserve confidentiality and security. • Investigatingthe online data storage provider’s security measures. • Must employ available technology to guard against reasonably foreseeable attempts to infiltrate the data that is stored.

35. Florida’s Adoption of Iowa Standards • Firm should consider the reputation of the service provider to be used, and whether its user agreement limits the service provider’s liability. • Whether service provider’s user agreement chooses the law or forum in which any dispute will be decided.

36. Florida’s Adoption of Iowa Standards cont. • Should consider whether the service provider retains the information. • Suggests that the lawyer consider whether the information stored via cloud computing is also stored elsewhere by the lawyer in the event the lawyer cannot access the information.

37. Pertinent Quotes from Florida Opinion 12-3 • “lawyers have an obligation to remain current not only in developments in the law, but also developments in technology that affect the practice of law. Florida Ethics Opinion 10-2.” • “this Committee believes that the lawyer should consider whether the lawyer should use the outside service provider or use additional security in specific matters in which the lawyer has proprietary client information”

38. Summary of Florida’s Approach • Must use reasonable precautions to ensure that confidentiality of client information is maintained. • The lawyer should extensively research the service provider to be used. • The Lawyer must ensure that the service provider maintains adequate security.

39. Summary of Florida’s Approach Cont. • Should ensure that the lawyer has adequate access to the information stored remotely at all times. • Should consider backing up the data elsewhere as a precaution. • Florida adopted a reasonable care approach while incorporating many Iowa and New York recommendations and standards

40. Possible Problems with Florida’s Approach • Constantly changing and evolving standard of what constitutes reasonable care. • Could open up firms and attorneys to malpractice claims if they do not actively educate and re-educate themselves on evolving protective measures. • Opinion suggests considering backing up data elsewhere. • May reduce or eliminate the benefits that cloud computing provides.

41. Possible Problems with Florida’s Approach cont. • Failure to get client’s consent to use the cloud could result in malpractice! • Opinion suggests additional security or obtaining client’s consent in specific matters where client’s information is particularly sensitive. • Virtually all client information could be considered particularly sensitive, thus requiring client’s consent.

42. Possible Problems with Florida’s Approach cont. 3 • Terms of service conditions can change on a random and frequent basis. • Thus each change in the terms of service can render use of that particular cloud or SaaS provider unreasonable. • “ ‘Apple may post on our website and/or will send an email to the primary address associated with your Account to provide notice of any material changes to the Service.’ That word ‘may’ is a killer.” • Have Attorneys Read the iCloud Terms and Conditions? • By Sharon D. Nelson and John W. Simek • Law Practice Today April 2012 • http://www.americanbar.org/publications/law_practice_today_home/law_practice_today_archive/april12/have-attorneys-read-the-icloud-terms-and-conditions.html • Accessed 02/08/13

43. Possible Problems with Florida’s Approach cont. 4 • When the “Terms & Conditions” do change, firms and attorneys are forced with a tough decision. • Transfer data to another provider and incur a delay; or • Take a possibly unreasonable risk. • Additionally, a lack of technology expertise may result in a misunderstanding of what risks are present in the “Terms & Conditions”. • Each time the “Terms and Conditions” changes is another exposure to the risk of malpractice.

44. Possible Problems with Florida’s Approach cont. 5 • “One of the more disturbing provisions states that Apple will give your datato any law enforcement authority, government official or third party if they feel it appropriate, necessary or legally required”. • Have Attorneys Read the iCloud Terms and Conditions? • By Sharon D. Nelson and John W. Simek • Law Practice Today April 2012 • http://www.americanbar.org/publications/law_practice_today_home/law_practice_today_archive/april12/have-attorneys-read-the-icloud-terms-and-conditions.html • Accessed 02/08/13 • This is letting Apple or another cloud or SaaS provider substitute their professional judgment for yours.

45. Ethics and the Cloud

46. The Standard, Applied • So we know Florida is a reasonable care state. Now what? • Model Rules • Reasonable and other vague words • How do I do that thing I need to do?

47. Model Rules Rule • Model Rule 4-1.6 • “Consent Required to Reveal Information” • Requires informed consent of the client • “Florida lawyers must take reasonable steps to protect confidential information in all types of documents and information that leave the lawyers’ offices, including electronic documents and electronic communications…”

48. Model Rules Rule • Model Rule 4-4.4 • Duties of a lawyer when sending/receiving an electronic document • Affirmative duty to take reasonable steps to safeguard the confidentiality of all communications sent by electronic means…

49. Model Rules Rule • Model Rule 4-5.3 • Your employees: • Any work done by the inquiring attorney’s nonlawyer employees must be supervised by the attorney

50. Working with the Rules • 4-1.6: lawyers must ensure confidentiality by taking reasonable steps under lawyer’s control to prevent exposure of information. • 4-1.1: competence requires staying abreast of changes in technology. • 4-5.3: supervision of employees also means by using the cloud, you are taking on a third-party you must supervise.