As we all know, technology (including software, infrastructure, data backup and restore, etc.) is increasingly being made available as a "service" on a trans-border/global "cloud" basis. For some interested buyers, this model raises the spectre of a host of concerns regarding the location of customers' data, the preservation of data, confidentiality/security, the secondary use of data by vendors, and the actual location of vendors' networks and systems.
Coupled with some well-publicized data breaches and the
considerable volatility in the cloud vendor market (with increasing
numbers of bankrupt vendors and market consolidation), many
organizations remain reluctant to go to the cloud.
When I act for prospective purchasers of cloud services, I am
naturally extremely vigilant and carefully scrutinize the cloud
vendor's standard agreements to determine whether they are
sufficient to meet the client's technological, legal, and
compliance requirements. This is particularly true for clients that
are FRE — federally regulated entities including banks, trust
and loan companies, credit associations, insurance companies
— that are subject to OSFI and other guidelines, clients in
the health care space that are health-care custodians or otherwise
handle health information, and government entities.
And of course, our federal privacy commissioner and her provincial
counterparts have issued excellent "Cloud Computing for Small and Medium-sized
Enterprises" guidelines that remind all Canadian
businesses of their ongoing privacy responsibilities if they opt to
use the cloud.
At the same time, I sometimes wonder if certain clients realize the
"do nothing" approach to risk minimization is no longer
an acceptable option, particularly when dealing with older
technology.
Case in point: As hopefully everyone now knows, Microsoft Corp. has
announced that after April 8, it will no longer be providing
technical support for Windows XP. This means Microsoft will no
longer be making automatic updates (bug fixes, patches, or security
updates) available to users.
As Microsoft's web site says, if a user continues to use
Windows XP after support ends, "your computer will still work
but it might become more vulnerable to security risks and viruses.
Also, as more software and hardware manufacturers continue to
optimize for more recent versions of Windows, you can expect to
encounter greater numbers of apps and devices that do not work with
Windows XP."
Also, the old hardware on which Windows XP was running will likely
not support Windows 7 or 8. As a result, upgrading the operating
system will probably mean upgrading hardware as well.
Clearly, this is a case where "if it ain't broke don't
fix it" does not apply. Old simply becomes broken once
it's no longer supported. It no longer makes sense for any
company to continue to use a software program more than 12 years
old and plainly now vulnerable to attack. But change does not come
easily for some, especially law firms apparently.
Interestingly, this popular operating system was still used at an
astonishing 37 per cent of U.S. law firms only a year or so ago,
according to a 2012 survey by the International Legal Technology
Association and as reported in the ABA Journal. To my
mind, this raises a red flag as law firms clearly have ethical
duties to protect client privacy and can be obvious/easy targets
for hackers.
So despite the lack of love for Windows 8, the message for users of
Windows XP clearly has to be: migrate to a newer version of the
product or another operating system by early April or be prepared
to face the repercussions if your company continues to use an
unsupported operating system.
At a bare minimum, one would assume companies that bury their
corporate heads in the sand could be subject to exclusions in their
insurance policies for damages arising from an XP security breach.
As noted in the ABA Journal article, law firms that remain
hold-outs could presumably also be further subject to charges of
violating their ethical duties as well as possibly subject to
disciplinary action.
So while there are risks to migrating to the cloud or in engaging
in any kind of technology refresh, sometimes the bigger risk is to
do nothing.
In addition to having robust contracts, the best solution is often
to choose a robust technology provider with a long-term track
record in the industry. Due diligence is especially required in
connection with the choice of a good cloud vendor.
Those of us who practise IT law should be prepared to have this
discussion with our clients. The better provider may not be the
cheapest option, but you usually get what you pay for (or in some
cases, when your client finds out that his vendor has become
insolvent and has a limited ability to get his data back, you get
nothing at all). And when you are thinking about minimum critical
security requirements and "must haves," consider your
regulatory/business requirements, balanced against what your
organization has been living with all along. In other words, check
your own house.
Previously published in Canadian Lawyer – March 2014
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
