In general, cloud computing describes technologies that allow applications and data to be hosted on a computer external to a business’s own computing resources and firewall (i.e. a “remote computer”). From a personal perspective, it means that an individual can have access to convenient solutions for little or no cost, for example, to host family photos or videos. One of the promises of cloud computing is the end user doesn’t really need to know how it works, or where the data resides; it just works, and will be available when you need it, wherever you need it. This promise has also resulted in profound misunderstandings of what cloud computing actually involves, and what it means from a litigation perspective.

Cloud computing services provide computing resources on an as-needed basis; this is why cloud computing was sometimes referred to as utility computing, a term that certainly did not have the marketing cachet of cloud computing. Cloud computing solutions generally require a reasonable periodic service fee and little additional hardware cost to access a computing solution. The reduction of costly IT assets, avoidance of software license costs, and removal of software maintenance tasks provide an attractive economic model; the end user is given a turnkey solution supported and maintained by the service provider, and hosted at a remote location. Cloud computing is enabled by rapid, reliable Internet and mobile data communications, which means that applications and data are available “everywhere,” simultaneously, and transparently. The convenience and financial benefits of cloud solutions are changing business models fundamentally and have resulted in mass migration of data to the cloud. Much of this data, of course, would be of interest to parties during criminal proceedings or civil litigation.

A key issue from a legal perspective is that an investigator or litigant cannot access data held in the cloud through traditional discovery techniques. Discovery of data within a cloud computing solution likely falls under the restrictions of the Electronic Communications Privacy Act of 1986 (ECPA), ¹ and specifically, Title II of the ECPA, which is called the Stored Communications Act (SCA).² Under the SCA, third parties that provide communication services or remote computing services to the public are generally prohibited from releasing the data; the SCA defines a series of procedures for the government to access the data. This law, now almost 30 years old, is the primary law that regulates disclosure of such data. It was written at a time when telephones actually rang, when e-mail was considered a novel new technology for computer geeks, and when conversations on portable phones could be intercepted with a standard FM radio. Today, judges use this law to rule on cases involving data created and stored by devices that would have been considered magic (or certainly at least in the realm of science fiction) in 1986.

This book is our attempt to briefly explain the way that data held by a third-party provider (i.e., in a cloud computing solution) potentially affects legal proceedings and discovery of electronic information. This work is divided into three topical sections:

Section One explains the basics of cloud computing technologies, how data is stored, and (at a high level) the technical aspects of hosted solutions that can affect production of data. This is intended to be a technical guide for non-technicians, offering a brief glimpse behind the technological curtain.

Section Two describes the SCA as well as the prior laws that protected technological communications of the day. This will hopefully provide the reader with insights into legal concepts that still shape cases today, and the common themes of privacy issues. We also describe some of the limitations of the current laws in interpreting modern systems and devices.

Section Three surveys many of the precedent-setting cases involving interpretation of hosted data and access of such data by litigants or the government. Many of these cases are still active and may be modified on appeal. Rapid technological advancements mean that issues may arise that have not been previously considered by the courts in the current context, and interpretation in those situations can widely vary.

The issues presented here often walk hand-in-hand with privacy issues. However, we limit this discussion primarily to litigation settings. Recent revelations of widespread government surveillance programs are well beyond the scope of this work. We sincerely hope this book provides practical insight into the current world of hosted data and its potential impact on legal proceedings, and wish you the best as you encounter these issues in the future.

James P. Martin
Harry Cendrowski
May 2014