Abstract

Cloud Computing is poised to offer tremendous benefits to clients, including inexpensive access to seemingly limitless resources that are available instantly, anywhere. To prepare for the shift from computing environments dependent on dedicated hardware to Cloud Computing, the Federal Rules of Discovery should be amended to provide relevant guidelines and exceptions for particular types of shared data. Meanwhile, clients should ensure that service contracts with Cloud providers include safeguards against inadvertent discoveries and mechanisms for complying with the Rules. Without these adaptations, clients will be either reluctant or unprepared to adopt Cloud Computing services, and forgo their benefits.

Introduction

¶         The conventional use of personal computers is evolving as shared computing becomes mainstream.² A type of shared computing called “Cloud Computing” stores client data and applications in shared data centers around the world³ so that clients can access their data or run applications from any location with an Internet connection.⁴ A Cloud provider can offer access to seemingly unlimited applications, operating systems, and hardware as services of the Cloud.⁵

¶         Cloud Computing is becoming very popular with a broad base of consumers. Websites such as Facebook turn personal computers into portals for clients to access and share images, videos, and text online.⁶ In December 2010, Google unveiled its Cloud-based notebook, and commentators noted “there are several things worth raving about. . . . The machine starts up fast, snaps to life in an instant from sleep mode and has superb battery life. . . . [A]ll your apps, documents, settings and then some will be securely housed in the cloud.”⁷

¶         Cloud Computing is also becoming popular with businesses and public organizations. These entities are beginning to use Cloud Computing because it can reduce the need for IT floor space by 80% and save 60% on power costs, while tripling usage of IT assets.⁸ Cloud Computing also allows clients to penetrate the marketplace with relative ease because it requires less capital than would be invested in traditional location-dependent hardware.⁹ It is also sufficiently flexible to adapt to growth and usage spikes.¹⁰ New business models may emerge where using Cloud Computing is essential to remain competitive in the marketplace.¹¹

¶         The introduction of Cloud Computing to a variety of industries has presented new complexities in the discovery phase of litigation. Pretrial discovery procedures involve delineating the scope of discoverable electronically stored information (ESI) as potentially leading to relevant evidence.¹² In Cloud Computing, shared data centers housing ESI are central to discovery. Although the Federal Rules of Discovery (Rules) were designed with an inherent flexibility and applicability to technological developments in personal computing,¹³ they cannot effectively be adapted to the Cloud Computing context.

¶         Discovering ESI in a Cloud, where clients share resources, is complex for two significant reasons. First, Cloud Computing puts client data under the control of a third-party Cloud provider. Rule 34(a) of the Federal Rules of Civil Procedure state that a party may serve a request to produce ESI in the responding party’s “possession, custody, or control.”¹⁴ These criteria are vague, and as a result of a third party’s control over a client’s data, key evidence residing in a Cloud may be outside the scope of discovery. Second, because Cloud Computing services deal with a large number of clients and may intermingle clients’ resources, isolating or retrieving the physical storage medium of one client’s data in a lawsuit may adversely affect other clients who are not involved in the litigation.

¶         The Rules are not flexible enough to encompass the technological paradigm shift to Cloud Computing. Specifically, the Rules do not provide guidelines for the production, preservation, and spoliation of ESI in a shared environment. This problem may be mitigated through technological means or by changing the Rules. Further, negotiating the terms of a contractual relationship between a Cloud provider and client may provide sufficient protection for both parties. Clients should consider whether their service contracts include sufficient safeguards against inadvertent discoveries of data, accurate indications of costs, and mechanisms for complying with the Rules.

I. The Future of Cloud Computing

A. Technical Features

¶         The phrase “Cloud Computing,” under which the decentralized service is marketed, suggests that it is user-friendly and strips away any semblance of complexity from the minds of consumers.¹⁵ The service, though intangible and novel, is extremely accessible, and the underlying technology of Cloud Computing encompasses several familiar technologies, collectively deployed in new ways.¹⁶

¶         Cloud providers essentially virtualize the same physical resources (such as processors and storage servers) to service multiple dispersed clients.¹⁷ Cloud providers also divide “the tasks of running applications and storing data into small chunks,” and then allocate the chunks among various distributed resources.¹⁸ These resources are dynamically partitioned according to client demand.¹⁹ That is, computing resources are divided according to what clients need, when they need them. Thus, one benefit includes maximizing access to seemingly limitless computing resources.

¶         Familiar computer applications are making their way into the Cloud, arguably increasing the productivity of their users. Early email services relied on applications residing on storage devices contained in personal computers, but localized email is increasingly migrating to webmail.²⁰ Webmail resides in remote data centers shared by clients, and is accessible from anywhere, over the Internet.²¹ Productivity software, such as Microsoft Office, is also shifting into the Cloud.²² Pushing its Office suite into the Cloud allowed Microsoft to compete with Google Docs, which was released in 2007 and has always resided in the Cloud.²³

¶         Cloud services make it possible to share resources located throughout the world.²⁴ For example, Microsoft, Sun Microsystems, and Google have contemplated placing data centers in Siberia, abandoned coalmines, and on ships at sea, respectively.²⁵ Interestingly, Google acquired a patent for placing data centers on ships to obtain power from the “natural motion of the water” and to use seawater to carry heat away.²⁶ Placing data centers in unusual locations may make Cloud Computing even more appealing because of the technical benefits of using the natural environment to power the data centers and to control their temperatures.

B. Economic Benefits

¶         Analysts predict that 9% of all IT consumer spending will be for Cloud Computing services by 2012, which reflects a doubling of demand from 2008.²⁷ Cloud Computing offers businesses lower costs and accommodates growth with dynamic access to resources and flexible purchasing plans.²⁸ The cost benefit of outsourcing while maintaining instant and seemingly unlimited access to computing resources will provide businesses with a competitive edge.²⁹ Cloud providers, such as Amazon, Google, and Microsoft, only charge about $0.10 per hour for basic processing requests.³⁰ Some analysts predict that these costs will soon decline by 5% to 20%.³¹ These benefits allow businesses to “be competitive and to react faster to the market demands.”³²

C. The Legal Implications

¶         Although sharing resources produces positive externalities, it also gives rise to many legal issues. For example, the data in data centers may be subject to foreign laws or no laws at all.³³ Cloud providers may also limit the control a business has over data it places in a Cloud.³⁴ These factors will complicate a client’s effort to defend itself against discovery requests.

¶         Attorneys recommend that their clients “have [a] clear understanding of what [a] cloud provider will do in response to legal requests for information” and “[n]egotiate roles for response to [electronic] discovery requests.”³⁵ Clients should “[u]nderstand and negotiate where [their] data will be stored, what law controls and possible restrictions on cross-border transfers.”³⁶ Unfortunately, such advice may fail to reach the masses of inexperienced clients using Cloud services, who do not know what to anticipate during litigation.

II. An Overview of Electronic Discovery

¶         Electronic discovery is “any process in which electronic data is sought, located, [and] secured, with the intent of using it as evidence in a civil or criminal legal case.”³⁷

A. Electronically Stored Information

¶         The Rules state that “a party must . . . provide to other parties . . . a copy of, or a description by category and location of, all documents, electronically stored information, and tangible things that are in the possession, custody, or control of the party and that the disclosing party may use to support its claims or defenses.”³⁸ A party may request the production of ESI “in the responding party’s possession, custody, or control . . . stored in any medium from which information can be obtained.”³⁹ A party does not have to provide discovery of ESI “from sources that the party identifies as not reasonably accessible because of undue burden or cost.”⁴⁰ The use of the phrase “electronically stored information” was “intended to be broad enough to cover all current types of computer-based information, and flexible enough to encompass future changes and developments.”⁴¹

B. Discovery of Metadata

¶         Metadata is a type of discoverable ESI.⁴² Metadata is information attached to the data it describes, which may include a user name, comments, document versions, the names of servers storing saved data, and the like.⁴³ Another form of metadata is “tagging, which gives you the ability to identify and reference people in photos, videos and notes.”⁴⁴ The Rules state that metadata “may be among the topics discussed in the Rule 26(f) [pretrial] conference,”⁴⁵ but the Rules Advisory Committee’s description of metadata does not offer much guidance for targeting such information through discovery:

Computer programs may retain draft language, editorial comments, and other deleted matter (sometimes referred to as “embedded data” or “embedded edits”) in an electronic file but not make them apparent to the reader. Information describing the history, tracking, or management of an electronic file (sometimes called “metadata”) is usually not apparent to the reader viewing a hard copy or a screen image.⁴⁶

¶         The lack of direction from the Rules is troubling because computer programs routinely generate metadata and such data may be crucial in litigation.⁴⁷ Operating systems “enrich files with metadata” to improve search and organization capabilities,⁴⁸ and metadata has already proven to serve as key evidence in some trials.⁴⁹

¶         Although the Rules suggest the production of metadata absent an affirmative showing of need should be denied,⁵⁰ federal courts have attempted to devise frameworks for compelling its production.⁵¹ In Williams v. Sprint/United Management, a federal district judge interpreted the phrase “[a] party must produce documents as they are kept in the usual course of business” in Rule 34(b)⁵² to mean electronic files “with their metadata intact.”⁵³ It was further ruled that metadata is to be produced even if it is not explicitly part of a request for production.⁵⁴

¶         Transient data, including metadata, may constitute discoverable ESI. For example, in Columbia Pictures, Inc. v. Bunnell, the court ruled that data stored on RAM constitutes ESI.⁵⁵ The court held that RAM data is “‘stored’ [information] under the plain meaning of the unambiguous language of Rule 34.”⁵⁶ Therefore, even metadata that is temporarily stored may constitute ESI.

C. The Duty to Preserve

¶         There is generally no duty to preserve documents, but a “preservation obligation may arise from many sources, including common law, statutes, regulations, or a court order . . . in the case.”⁵⁷ A “litigation hold” is a notice to a party that triggers the preservation of ESI by requiring “intervention in the routine operation of an information system” to suspend the normal destruction of material.⁵⁸ The duty to preserve may also arise without notice when litigation is “reasonably anticipated.”⁵⁹

¶         Under a good faith requirement, a party is “not permitted to exploit the routine operation of an information system to thwart discovery obligations by allowing that operation to continue in order to destroy specific stored information that it is required to preserve.”⁶⁰ Litigants may separate out ESI (by transferring ESI to another storage device) to comply with the retention and access requirements of discovery and to avoid sanctions for spoliation.

D. Spoliation

¶         Spoliation is the deliberate or inadvertent loss, modification, or destruction of evidence by a party on notice of litigation who failed to take appropriate steps to preserve data.⁶¹ A popular test applied by federal courts to determine when sanctions for spoliation should apply requires showing that a spoliator had a duty to preserve, a culpable state of mind, and that the destroyed evidence was relevant to a party’s claims or defenses.⁶² The required level of culpability varies between courts.⁶³ For example, the Eighth and Tenth Circuits require intentional misconduct or bad faith, but the Second Circuit held that “neither bad faith nor intentional misconduct is required.”⁶⁴ Some scholars claim that imposing sanctions for spoliation is necessary because failing to preserve evidence not only “prevents a party from adequately proving or defending a claim at trial” but also “undermines the efficacy of the adversarial system.”⁶⁵

¶         Applying these spoliation tests to Cloud Computing may prove to be difficult, and therefore must be adapted to this new context. Notably, the Rules state, “the ordinary operation of computer systems creates a risk that a party may lose potentially discoverable information without culpable conduct on its part.”⁶⁶ Further, “absent exceptional circumstances, sanctions cannot be imposed for loss of electronically stored information resulting from the routine, good-faith operation of an electronic information system.”⁶⁷ Thus, litigants may be unsure how they are supposed to harmonize the Rules with federal appellate court tests.

III. Discovery in the Cloud

¶         The Rules require litigants to “discuss any issues about preserving discoverable information[] and develop a proposed discovery plan” during a pretrial conference.⁶⁸ Litigants must discuss discovery issues unique to Cloud Computing to “reduce prices and resolve potential complications early in litigation.”⁶⁹ These requirements create “an affirmative duty on outside counsel to investigate the document retention policies of their clients during the earliest stages of representation”⁷⁰ and place “a high burden of technical knowledge on attorneys.”⁷¹

¶         Clients rightfully fear adverse discovery of their ESI.⁷² For example, if third parties get access to trade secret information stored in a Cloud through discovery, “that could destroy the legal protection of trade secrets.”⁷³ The Rules are “expansive and include[] any type of information that is stored electronically.”⁷⁴

¶         Discovering ESI in the Cloud may also create liabilities for clients of the Cloud by inadvertently retrieving ESI belonging to other clients. For example, a sector isolated from a shared storage medium may contain data from other Cloud clients. This data shared among clients of a Cloud is discoverable because it is “fixed in a tangible form” and “stored in a medium from which it can be retrieved and examined.”⁷⁵ Although major Cloud providers may include safeguards to ensure security and privacy, an increasing demand for Cloud services may spawn discount providers offering fewer safeguards against the unintentional disclosure of other clients’ data.

¶         Storing ESI in the Cloud may also provide litigants with loopholes to avoid divulging certain information. Multiple layers of data are generated by various clients and managed by Cloud providers, and such ESI may not be in the possession, custody or control of the litigant.⁷⁶ The data layers may include client-specific data, client-specific metadata, and metadata common to several clients,⁷⁷ which may be unique to an application, generated by multiple clients, or stored in a shared repository.⁷⁸ Common metadata may be maintained in repositories shared between clients, which makes it a “major problem” to “isolate [that] data and maintain the security.”⁷⁹ Therefore, that data may not be in the possession, custody or control of a litigant, and thus not subject to discovery. Consequently, applying the Rules to a Cloud may create liabilities for clients of a Cloud and loopholes for litigants.

A. Sharing Resources and Metadata

¶         Inadvertently producing or preserving ESI belonging to other clients of a Cloud is likely to have significant repercussions. For example, “in many jurisdictions, inadvertent production of privileged data constitutes a waiver of privilege.”⁸⁰ In Marrero-Hernandez v. Esso Standard Oil Co., an “errant mouse click” led to the inadvertent production of “approximately 1500 potentially privileged documents” that merged with unprivileged documents.⁸¹ Although the defendant claimed the documents were privileged,⁸² the court stated that if parties “opt to use technological resources to store privileged information, they should also provide the necessary protection for precisely that information.”⁸³

¶         Further, allowing parties to discover common metadata in a Cloud is problematic. The Williams v. Sprint/United Management Co. court held that “the producing party should produce the electronic documents with their metadata intact.”⁸⁴ A party may move for a protective order when asked to produce metadata if it is “not reasonably accessible” and will result in “undue burden and cost.”⁸⁵ However, common metadata may be readily accessible without undue burden or cost because it is stored in a common repository, yet its discovery may harm other clients.⁸⁶ If, however, courts grant protective orders to protect those other parties, they may incentivize clients to “hide” their information as common metadata in the Cloud. If courts do not grant protective orders, then discovery will reveal the common metadata, possibly disclosing private information about third parties.

¶         Requiring the production of metadata attached to documents is particularly troubling because Cloud metadata is increasingly inseparable among clients.⁸⁷ Multiple Cloud providers may share metadata in an architecture optimized for interoperability and portability.⁸⁸ Interoperability is the ability to exchange and use client data between different Cloud providers, and portability is the ability to deliver data anywhere on demand.⁸⁹ If Cloud providers were forced to change their delivery and security policies to maintain these two functions, then clients may lose metadata or lose control over copies of metadata residing in multiple data centers.⁹⁰ For example, metadata generated by one Cloud provider may be inadvertently lost when a client accesses the same metadata through a second provider.⁹¹

B. Preserving Client Data

¶         The duty to preserve ESI under an ongoing litigation hold conflicts with the “real advantage” of Cloud Computing, which is to increase “flexibility and responsiveness” of shared resources among clients.⁹² For example, Cloud Computing dynamically allocates virtual storage volumes to clients, which may comprise multiple physical storage volumes partitioned according to client demand.⁹³ ESI from a single client can therefore be stored across multiple physical storage volumes, wherever there is available capacity.⁹⁴ Thus, preserving (or saving) ESI detracts from the elasticity of resources for other clients who may have a demand for the same resources.⁹⁵

¶         Implementing preservation techniques may require isolating Cloud resources, which can cause performance degradation for other clients because they are forbidden access to the same resources.⁹⁶ Further, a Cloud provider may isolate physical resources, rather than virtual ones, to ensure full compliance with the Rules. Isolating a physical resource may preserve data belonging to multiple clients who share that same physical resource; the data may have otherwise been routinely deleted at the request of clients who are not parties to a litigation hold. The subsequent release of the physical resource from the litigation hold may frustrate the routine business operations of other clients because their data will remain preserved. These problems are further complicated when multiple Cloud providers service the same clients.

C. Identifying Who Controls Data

¶         The Rules require that a client produce ESI in its possession, custody, or control. In Cloud Computing, it is a client’s “control” that is most difficult to define because Cloud providers are custodians of the ESI they hold in data centers.⁹⁷ A client is deemed to have control over ESI “so long as the party has the legal right or ability to obtain the documents from another source upon demand.”⁹⁸ Thus, clients may not have legal or actual control over common metadata that serves as key evidence.⁹⁹

¶         The requirements imposed on Cloud providers under the Rules are ambiguous at best. The Stored Communications Act (SCA) provides safeguards for clients against compelled disclosures imposed on Cloud providers.¹⁰⁰ A client, however, will only benefit from the SCA “when a cloud provider expressly limits its access” to client data “for the purposes of providing computer storage or processing functions.”¹⁰¹ Inexperienced clients who allow Cloud providers access to their data “without specifying the limits of that authority” are generally not protected by the SCA.¹⁰² For example, clients of Gmail are probably not protected because Google reviews emails to provide client-specific contextual advertising.¹⁰³ More generally, Cloud Computing clients may be disqualified from “seeking refuge from disclosure under the Act” when Cloud providers use a “service of retrieval” function “for using applications or data stored with the cloud provider” because this function permits Cloud providers to access client data content.¹⁰⁴

D. Increased Legal Risks

¶         Cloud Computing poses new challenges for litigants to avoid sanctions.¹⁰⁵ The inadvertent deletion of ESI, under a litigation hold, by a routine operation of a Cloud provider or through actions from clients of the same provider may result in spoliation claims.¹⁰⁶ It is unclear if the safe harbor provision¹⁰⁷ of the Rules will apply when clients share operations of computer systems. Even basic litigation holds may impose undue burdens and costs on a litigant or on multiple clients of a Cloud not associated with the matter.

IV. Solutions for Discovery in the Cloud

A. Contractual Relationships

¶         One key to mitigating risks associated with discovery in a Cloud is negotiating the terms of a service contract to define the legal rights of a provider and client. Of course, this solution assumes equal bargaining power between a Cloud provider and client.¹⁰⁸ While powerful entities may successfully negotiate favorable terms of a contract, smaller or inexperienced clients may be subject to one-sided agreements.¹⁰⁹ For example, the city of Los Angeles negotiated a contract with Google to provide an email system for city employees.¹¹⁰ The contract included provisions where Google would “compensate the city in the event that the Google system was breached and city data exposed or stolen.”¹¹¹ In contrast, the standard Gmail service contract with individual customers allows Google to access client information and email; it also notes that Google “processes personal information” on servers in the U.S. and in other countries.¹¹²

¶         Clients should also be cautious about using the services of smaller, less-expensive, competing Cloud providers who might lack the resources to properly accommodate discovery requests. However, clients may have more bargaining power with smaller Cloud providers. Still, clients ought to be aware that the providers will probably offer fewer reliable service features.

¶         A service contract should provide safeguards to protect clients from the inadvertent discovery of ESI and include procedural guidelines to facilitate the discovery process. Provisions should delineate the types and amount of metadata routinely preserved in a designated repository and define client rights to access that metadata. Provisions should ensure that clients remain protected under the SCA by preventing Cloud providers from unilaterally accessing, viewing, or providing client ESI to government agencies or other parties.¹¹³ A contract should, at least, require Cloud providers to notify clients in advance of accessing client ESI, which would allow clients time to secure privileged information.¹¹⁴ The contract should also impose restrictions on the location of data centers storing client ESI because the laws in some countries may trump U.S. security and privacy provisions.¹¹⁵

B. Technical Solutions

¶         In addition to negotiating the terms of Cloud Computing services, there are several possible technical solutions. First, a client may adopt a hybrid approach to storing data by which the majority of data is stored in a public Cloud and sensitive ESI is stored in a private Cloud.¹¹⁶ Of course, this requires private infrastructure and remains limited to clients with greater financial resources. A hybrid approach may also require redundant applications stored in different types of Clouds or require indexing and channeling of sensitive metadata into a private Cloud.

¶         Second, Cloud providers may consider developing an application that automatically isolates specified ESI and associated metadata when there is a litigation hold. Cloud providers may then offer the application as an added service to clients. A client may try to avoid sanctions by using this software program because its use demonstrates a good faith attempt to comply with the Rules.

¶         Third, Cloud providers may track metadata, especially when considering the possibility of replicating, moving, or losing metadata as clients migrate between Clouds to access ESI from remote locations, and through different devices.

¶         Finally, another solution may be to encrypt all ESI and metadata with client-specific keys such that the ESI, and metadata, remain indecipherable by other clients in case of an inadvertent production.

C. Revising the Rules

¶         While negotiated contracts and technical changes may help individual clients, a universal solution requires amending the Rules. The test for “possession, custody, or control”¹¹⁷ in the Rules requires a clarification of what degree of control distinguishes data subject to discovery in a shared environment. “Control” should be limited to ESI, including metadata, over which a party has exclusive or substantial control. If “control” is not given such a circumscribed meaning, exceptions to the current liberal definition should exist to avoid the inadvertent production or destruction of ESI shared with other parties. Further, the Rules should not allow discovery of physical storage volumes in a shared environment, or they should limit discovery only to virtual volumes. If physical storage volumes remain discoverable, then Cloud providers should be required to provide fair notice to clients who may share the same resources.

¶         The Rules should provide better guidelines for distinguishing different types of ESI (e.g., user-specific and common metadata) and define the scope of production and preservation owed by parties in a Cloud. The Rules should consider that clients may have limited control over key ESI and that Cloud providers control common metadata. Furthermore, safeguards to prevent the risk of inadvertently preserving ESI belonging to other Cloud clients should be addressed by the Rules. That is, they should provide for more procedural mechanisms than the mere ability to move for a protective order when clients are asked to produce metadata that is not reasonably accessible or results in undue burden and cost. There should be exceptions for reasonably accessible shared metadata that may unduly burden other clients.

D. Immediate Measures

¶         Until the above remedies become commonplace and the Rules are amended, Cloud providers should devise procedural and usage guidelines to protect clients. The guidelines should aid clients to demonstrate a good faith effort to comply with the Rules and facilitate the discovery process. They should provide safeguards for clients and mitigate risks of sanctions by preventing the destruction of ESI after a litigation hold issues. To avoid claims of spoliation, a Cloud provider should provide a mechanism for gathering data fragmented across multiple data centers, isolating relevant data, and migrating that data to a repository where it will remain intact. Cloud providers should understand their roles as custodians of ESI they possess and outline instructions for their staff to respond to litigation holds.

V. Conclusion

¶         The Federal Rules of Discovery do not effectively apply to clients of a Cloud. The shared nature of Cloud Computing requires limiting discovery to data in exclusive or substantial control by a client or whose discovery will not unduly harm other clients. In anticipation of the universal adoption of Cloud Computing, the Rules should provide guidance and exceptions for particular types of shared ESI. Meanwhile, clients should consider whether their service contracts include safeguards against inadvertent discoveries of data, indicate the costs for ongoing preservation, and provide mechanisms for complying with the duty to preserve and for securely applying and releasing litigation holds.¹¹⁸ Inaction will stifle the adoption of Cloud Computing and deny the public its positive network effects.

Footnotes