Microsoft to Congress: Time to seed cloud computing

The administration and Congress must revise out-of-date statutes and lay new legislative groundwork to keep pace with technology as more computing work is being processed globally over the Internet, a senior Microsoft official said this week.

Brad Smith, Microsoft’s senior vice president and general counsel, speaking at a policy forum at the Brookings Institution Jan. 20, raised the concern that without a greater national effort to clarify various law enforcement, liability and privacy rules, the transformative potential of cloud-based computing could be undermined.

The differences between how the United States and Europe handle personally identifiable information, he said, is but one example of the kind of challenges that cloud-computing users and providers are likely to face as data moves increasingly in and out of third-party computing centers across the globe.

“The computing experience is undergoing a powerful transformation,” Smith said. “For information technology, the cloud represents a major extension of computing models. Cloud computing, properly implemented, provides users with greater flexibility, portability and choice in their computing options,” and “offers new benefits for almost every part of society.”

However, cloud computing also presents a host of new questions and concerns that Smith argued require the government’s attention.

Smith called for Congress to consider a “Cloud Computing Advancement Act that will promote innovation, protect consumers and provide the executive branch with the new tools needed for a new technology era." He also recommended updating the Electronic Communications Privacy Act, and the Computer Fraud and Abuse Act. And he advocated the establishment of “truth in cloud computing” principles and asked for the government's help in aligning international rules for the use of data.

“We need Congress and the administration to address three issues in particular: privacy, security and international sovereignty,” he said.

“The protection of privacy has long been a fundamental American right,” Smith said, noting that the privacy protection afforded to U.S. consumers was “a hallmark of the personal computer revolution” in the 1980s.

“In contrast, one obvious attribute of the cloud is that information typically is stored on a server computer that is controlled by a third party.  This makes it all the more important for service providers to be thoughtful and clear in deciding and communicating what they will do with this information,” he said.
 
“Equally important, we need government action to ensure that as information moves from the desktop to the cloud, we retain the traditional balance of individual privacy vis-à-vis the state,” he said. “The courts have cast doubt on whether the Fourth Amendment to the Constitution, which provides this protection, applies to information that is transferred to a third party for storage or use,” he said.

Changes in communication technology have led to this type of situation before, Smith said. He cited Congress’ move in the 1980s to adopt the Electronic Communications Privacy Act to address legal gaps that otherwise failed to protect the privacy of electronic and stored communications, and which clarified when and how law enforcement agents can access such data. But ECPA was enacted before the popularization of the Internet and has become increasingly antiquated as a result, Smith argued.

Michael Nelson, visiting professor at Georgetown University, and former special assistant for information technology at the White House Office of Science and Technology Policy during the Clinton administration, agreed with Smith.

“We definitely need to update and clarify some of the existing laws on law enforcement’s access to information, whether it is e-mail or information stored in the cloud,” Nelson said. The question that needs to be addressed, he said, is, “How does the Fourth Amendment apply when the data that once was on your desktop are now in the cloud?”

Smith also emphasized that “as we develop new cloud services, we need to continue to … implement new security standards, such as those from the International Standards Organization and under the Federal Information Security Management Act.”

“Government enforcement will play a critical role in stopping and deterring attacks on the cloud, but only if Congress adapts the law to new security challenges,” he said.

Smith proposed that Congress should modernize and strengthen the Computer Fraud and Abuse Act to help law enforcement officials address security in the cloud and to “strengthen the legal ability of cloud service providers to pursue their own civil claims against security violators.”

He also urged the creation of new “truth in cloud computing” principles “so consumers and businesses have full knowledge of how their information will be accessed and used by service providers and how it will be stored online.” 

At the same time, one of the emerging concerns raised at the Brookings Institution forum, Nelson said, is what kind of liability protections cloud-computing providers can expect in the future.

“It was the consensus [of industry and legal experts attending the forum] that we can’t hold a cloud provider liable [for] everything that happens with a users’ data,” Nelson said. "But they should be held liable if they don’t live up to their commitments.”

Smith concluded by urging Congress and the administration to address “a global thicket of competing and sometimes conflicting laws impacting cloud computing.”
 
Smith cited recent cases in Belgium, Brazil, and Italy where each “sought to impose their laws on U.S. service providers even for data stored in the United States.  These types of cases increasingly have raised the prospect of civil and even criminal penalties for service providers. This is creating a catch-22 situation for the cloud,” he said, “where a decision to comply with a lawful demand for user data in one jurisdiction may place a provider at risk of violating laws elsewhere.”

The text of Smith’s speech was released on Microsoft’s news site.