get your head in the clouds: the use of cloud computing in the practice of law

Canadian Legal Technology Forum St. Andrew’s Club and Conference Centre | Toronto

September 23, 2014

GET YOUR HEAD IN THE CLOUDS! THE USE OF CLOUD COMPUTING IN THE PRACTICE OF LAW

2

Prepared for

Canadian Legal Technology Forum St. Andrew’s Club and Conference Centre | Toronto

September 23, 2014

3

Prepared by

Davis LLP is a full-service business law firm that delivers cost-effective

advice and efficient service in over 50 practice areas.

www.davis.ca

SkyLaw is a boutique corporate law firm offering

sophisticated legal and strategic advice to public and private companies.

www.skylaw.ca

•  Kevin West is the founder of SkyLaw, an innovative boutique corporate law firm in Toronto.

•  After clerking for Justice Binnie at the Supreme Court of Canada, Kevin practiced with Sullivan & Cromwell in New York and Australia and as a partner at Davies in Toronto.

•  Kevin obtained his LLB from Dalhousie University in 1998.

4

Presented by

Kevin R. West Founder, SkyLaw Professional Corporation

5

Kevin R. West

Timeline

•  Acquisition of Corriente Resources Inc. by Tongling Nonferrous Metals Group Holdings Co. Ltd and China Railway Construction Corporation Limited for $679 million.

•  Acquisition of Northern Peru Copper Corp. by China Minmetals Nonferrous Co. Inc. and Jiangxi Copper Company for $455 million.

•  Xstrata plc hostile take-over of Falconbridge Limited for $24 billion. •  Acquisition of PetroKazakhstan Inc. by China National Petroleum

Corporation for $4.2 billion. •  Royal Bank of Canada’s acquisition of Centura Banks, Inc. for $2.3 billion.

6

Kevin R. West

Selected Transactions List

•  Kelly Friedman is a partner in Davis LLP’s Toronto office.

•  Kelly is an experienced litigator with unique expertise in electronic information issues, including electronic discovery (e-discovery), data security and privacy.

•  Kelly is known for her efficient, no-nonsense approach to problem solving and dispute resolution.

•  In 2011, Kelly was named as one of Canadian Lawyer's "Top 25 Most Influential Lawyers in Canada".

7

Presented by

Kelly Friedman Partner, Davis LLP

8

Kelly Friedman

Kelly is a recognized leader in electronic discovery and data management issues: •  She is an expert advisor to Standards Council of Canada, Canada’s

member body in the International Organization for Standardization (ISO) network, advising and negotiating with respect to international standards on information technology security and e-discovery.

•  She is the co-editor of ISO 27050-3, Code of practice for

electronic discovery, being part 3 of a developing international electronic discovery standard.

9

Kelly Friedman (cont.)

•  From 2010 to 2014, Kelly acted as Chair of the Canadian working group of the non-profit think-tank “The Sedona Conference®” (Sedona Canada) which developed national electronic discovery principles. Kelly continues to be an active member of the Steering Committee of Sedona Canada, as well as an active member of The Sedona Conference Working Group on International Electronic Information Management, Discovery and Disclosure.

•  Kelly is a member of Ontario’s E-Discovery Implementation Committee (EIC), which prepares model documents to guide litigators and the judiciary in Ontario, and she is Vice-Chair of the EIC’s Conference Planning Subcommittee.

10

TOPICS

I.  What is Cloud Computing?

II.  Advantages of Cloud Computing

III.  Disadvantages of Cloud Computing

IV.  Legal Concerns

V.  Perspectives of Law Societies

VI.  Practice Management Tips

Image Credit: ITS Sheffield <www.its-‐sheffield.com/service>

•  Cloud computing is a powerful tool for today’s law practice

•  Consider the nature of your practice and your clients to determine the best solution for your firm

•  Choose reputable service providers Examples: Microsoft Office 365, ShareFile, LinkedIn, Evernote, Asana, etc.

KEY POINTS

11

KEY POINTS (cont.)

•  Always consider your professional obligation to

maintain client confidentiality •  Change passwords frequently •  Ensure all information is securely backed up off site

12

13

WHAT IS CLOUD COMPUTING?

14

WHAT IS CLOUD COMPUTING?

Image Credit: Fletcher, David. CloudTweaks.com. <www.cloudtweaks.com/2012/10/the-‐lighter-‐side-‐of-‐the-‐cloud-‐obscurity>

I. What is Cloud Computing?

WHAT IS CLOUD COMPUTING? (cont.)

•  Cloud computing is the practice of using a network of remote servers hosted on the internet to store, manage and process data

•  Access to data and applications occurs online rather than through a local device Examples: �  Email services like Gmail and Outlook.com �  Data services like iCloud and ShareFile

15


•  SaaS is software that is accessed through websites rather than directly through computers Examples: �  Online office services like Microsoft Office 365

and Google Docs �  Online creative suites like Adobe Creative Cloud

16

WHAT IS SOFTWARE AS A SERVICE (SaaS)?


HOW WE USE IT

17 Image Credit: RaO-‐report.com <raO-‐report.com/region-‐global/cloud-‐compuRng-‐companies-‐the-‐next-‐new-‐business-‐fronRer/aTachment/new-‐business-‐cloud-‐compuRng-‐diagram-‐small>


HOW IT WORKS

18

•  A cloud service provider stores information on its own physical server

•  Consumers access the server through online websites or applications as needed

•  It functions much like an electricity grid

Image Credit: Cubeelite.com <www.fingertecblog.com/2013/12/cloud-‐compuRng-‐myths-‐oh-‐please.html>


19

ADVANTAGES OF CLOUD COMPUTING

KEY ADVANTAGES

•  Decreased Costs •  Accessibility •  Collaborative Platforms •  All-in-one Practice Management Services •  Email Archiving •  Disaster Recovery Services •  Saves Paper & Space

II. Advantages of Cloud Computing

✓ 20

DECREASED COSTS

•  Used only on an ‘as needed’ basis •  No upfront outlays •  No ongoing maintenance or upgrades •  IT services are often included •  No extra cost for use from multiple computers •  Many services are free

21


ACCESSIBILITY

•  Access from almost anywhere on almost any computer or device

•  24/7 services •  Accessible by multiple people

22


COLLABORATIVE PLATFORMS

•  Easily share documents, data and services •  Allow colleagues, clients and other parties to work

on the same project in an easy and functional manner

•  Only one version of the document exists even with multiple contributors

Examples: �  Microsoft Office 365 (SharePoint)

23


ALL-IN-ONE PRACTICE

MANAGEMENT SERVICES

•  Reduce redundancy •  Work more efficiently •  Create consistency

24


EMAIL ARCHIVING

•  Store and locate data and communications quickly and easily

•  Central repository •  Synchronization •  Automatic filtering, filing and organizing •  Access from almost any computer or browser

25


DISASTER RECOVERY SERVICES

•  Significantly faster recovery times •  Cost effective recovery •  Disaster recovery is often included as a free service

26


SAVES PAPER & SPACE

•  An effective virtual filing system •  Maintain the physical records of executed originals

and material correspondence only •  Hard copies of documents can be produced on an

as needed basis •  Virtual data rooms give instant access without the

cost of printing

27


28

DISADVANTAGES OF CLOUD COMPUTING

KEY DISADVANTAGES

•  Risk of Technical Failures

•  Loss of Control

•  Lack of Transparency

•  Privacy & Security Risks

III. Disadvantages of Cloud Computing

29

RISKS OF TECHNICAL FAILURES

•  Access failures �  Telecommunications connection �  Cloud server �  General computer malfunction

•  Data loss and corruption

30


LOSS OF CONTROL

Big picture concerns about loss of control:

•  “Cloud computing is the style of computing in which the users can rent infrastructure, platform or software services from other vendors without requiring the physical access to them. It divides the responsibilities of managing technologies between two different stakeholders who can be geographically situated in different corners of the world.”

31

Karthick Ramachandran, Thomas Margoni, Mark Perry, “Clarifying Privacy in the Clouds”, CYBERLAWS 2011: The Second InternaRonal Conference on Technical and Legal Aspects of the e-‐Society, p. 3& 4, IARIA, 2011


LOSS OF CONTROL (cont.)

•  The “[c]loud computing paradigm requires

disturbing levels of trust by users in the servers that hold their information. Unless there is some means of totally obfuscating the data, the user needs to trust that the data stored by the CSP will be used by them only for the purposes for which it is intended to be used.”

32

Karthick Ramachandran, Thomas Margoni, Mark Perry, “Clarifying Privacy in the Clouds”, CYBERLAWS 2011: The Second InternaRonal Conference on Technical and Legal Aspects of the e-‐Society, p. 3& 4, IARIA, 2011


LACK OF TRANSPARENCY

•  Lack of transparency with respect to cloud service

provider processes, procedures and practices, including whether or not cloud service providers sub-contract any of the processing

•  Lack of transparency makes it difficult to conduct a proper risk assessment and to enforce rules (regarding privacy, RIM, etc.)

33


LACK OF TRANSPARENCY (cont.)

•  Cost drivers

�  Cloud customers are under great pressure to reduce costs

�  Cloud service providers are under great pressure to capitalize investment costs

�  To keep prices low, cloud service providers are more likely to offer standard terms

34


PRIVACY & SECURITY RISKS

35

•  Breaches of cloud service provider security •  Internet connection breaches

�  Denial of service attacks �  Eavesdropping �  DNS spoofing


36

LEGAL CONCERNS

KEY LEGAL CONCERNS

•  Privacy Compliance in the Cloud

•  Security Breaches in the Cloud

IV. Legal Concerns

Image Credit: www.ecominfotech.biz/images/cloud-‐7.jpg 37

PRIVACY COMPLIANCE IN THE CLOUD

38

IV. Legal Concerns

Image Credit: hTp://mscorp.blob.core.windows.net/mscorpmedia/2014/05/ProtecRng-‐Data-‐and-‐Privacy-‐in-‐the-‐Cloud.jpg

Do you know where your personal information is?

PRIVACY COMPLIANCE IN THE CLOUD (cont.)

39

•  Key privacy obligations at risk in the cloud �  Consent �  Retention �  Accuracy �  Individual Access �  Safeguard [Security] �  Notification �  Jurisdiction (Legislation / guidelines prohibiting extra-provincial

transfer and triggering obligations in multiple jurisdictions)

IV. Legal Concerns

PRIVACY COMPLIANCE IN THE CLOUD (cont.)

40

IV. Legal Concerns

The Canada.com case:

“Assistant Commissioner emphasizes the importance of organizations assessing the risks that could jeopardize the security and confidentiality of customer personal information when it is transferred to foreign-based third-party service providers. It is essential that organizations using third-party service providers outside Canada use contractual or other means to provide a comparable level of protection while the information is being processed by the third party.”

[Findings under the Personal Information Protection and Electronic Documents Act (PIPEDA), PIPEDA Case Summary #2008-394, available at http://www.priv.gc.ca/cf-dc/2008/394_20080807_e.asp

SECURITY BREACHES IN THE CLOUD

41

IV. Legal Concerns

Image Credit: Burg, Jason. Blog.ViewpointCS.com. <hTp://blog.viewpointcs.com/category/cloud-‐compuRng/>

SECURITY BREACHES IN THE CLOUD (cont.)

42

•  Liability arising from security breaches •  Individual and class actions •  Service providers using the cloud have to rely on

the security of each of the cloud participants receiving personal information

•  How do you do due diligence in the cloud to ensure adequate security is in place?

IV. Legal Concerns

43

PERSPECTIVES OF LAW SOCIETIES

PERSPECTIVES OF LAW SOCIETIES

•  “A lawyer is not expected to anticipate the criminal activity or theft of solicitor-client communications on the Internet any more than mail theft.”

(Federation of Law Societies of Canada, Nov. 1999)

•  No law society has prohibited the use of cloud computing

•  Lawyers should consider whether cloud computing could be a useful tool to discharge professional responsibilities

44

V. Perspectives of Law Societies

45

PRACTICE MANAGEMENT TIPS

SELECTING A CLOUD SERVICE PROVIDER

•  Consider service provider’s reputation •  Review security and storage methods •  Evaluate business structure and risks •  Document your evaluation of the provider •  Perform ongoing reviews of your provider

46

VI. Practice Management Tips

QUESTIONS FOR YOUR SERVICE PROVIDER

•  Can I get my data back in a format I am able to use if you go bankrupt or terminate your service, for example for non-payment?

•  Can I easily migrate my data to a new platform? •  How much downtime is there for maintenance?

47


QUESTIONS FOR YOUR SERVICE PROVIDER (cont.)

•  How do you ensure my data is secure? Note: Always use a secure site starting with “https:”

•  Will you permanently delete my data upon request? •  Can you maintain privilege? •  Will I be notified in the event of a security breach?

48



•  Am I able to access my data on demand? •  Who has access to my data and for what purposes? •  How do you backup data? •  Do you mine my data for personal information?

49



•  Do you allow me to maintain ownership over my data?

•  Do you archive my data? •  What remedies are permitted for non-compliance?

50


LOCATION OF DATA

•  Consider both the likelihood and gravity of access by government agencies or other third parties

•  Review the availability of remedies, such as an injunction to prevent disclosure

•  Evaluate law pertaining to privacy, privilege and data storage

51


LOCATION OF DATA (cont.)

52

•  Decide appropriateness on a case-by-case basis •  Consider client’s own obligations

Example: Public sector in NS and BC cannot store data outside its jurisdiction

Image Credit: Trigon Technology <www.trigon.com/cloud-‐services>


RETAINER AGREEMENTS & CONSENT

•  Informed client consent •  Sample engagement letter language:

“Your confidential information may be stored in electronic format on servers that are controlled by third parties and that may be located in jurisdictions outside Canada. You consent to the offsite storage of electronic data on such servers and to communication of your confidential information with third parties for this purpose.”

•  Privacy policy

53


BACKING UP & PASSWORDS

54 Image Credit: Channelpro-‐SMB. <hTp://www.channelprosmb.com/playbook/cloud_security>

•  Perform regular backups •  Store backups in a fire safe, safety deposit box •  Maintain physical records of originals, material correspondence and accounRng data, especially trust account ledgers

•  Change passwords frequently


QUESTIONS OR COMMENTS?

Please Contact Us

55

Kevin West Founder, SkyLaw Professional CorporaRon Tel: 416.644.3190 E-‐mail: [email protected] LinkedIn: www.linkedin.com/in/kevinrobertwest

Kelly Friedman Partner, Davis LLP Tel: 416.369.5263 E-‐mail: [email protected] LinkedIn: www.linkedin.com/pub/kelly-‐friedman/2a/950/589

get your head in the clouds: the use of cloud computing in the practice of law

Law

kelly friedman kelly

adobe creative cloud

electronic information

todays law practice

kevin west

conference centre toronto

data services

code of practice