Cloud Computing Law

Discoverability of social networking profiles in Federal court

Friday, August 6, 2010 by Chris Stephen

Gather 'round kids, this one is interesting. The decision actually came out in May, 2010, and I regret that I haven't had a chance to blog on it until now, but it is still a very interesting order that should have implications to privacy litigation, and litigation in general. In EEOC v. Simply Storage Management, LLC, Docket No. 09-CV-01223, the Southern District of Indiana was faced with the issue of discovery of social networking profiles of two individuals that claimed sexual harrassment by a supervisor. In its discovery, the Company requested "electronic copies of ********'s complete profile on Facebook and MySpace (including all updates, changes, or modifications to *******'s profile) and all status updates, message, wall comments, causes joined, groups joined, activity streams, blog entries, details, blurbs, comments, and applications (including, but not limited to "How well do you know me" and the "Naughty Application").. . . . " The EEOC went to the Court for guidance and the Court entered an order giving general guidelines, but determining that relevant portions of the social networking profiles were discoverable. Interestingly, the Court did not really address any privacy issues implicit in this request other than to reliance on two Canadian cases to establish that setting your profile to "private" is not a shield from discovery. The Court went on to provide the guidance that (1) any profiles, postings, or messages and applications are fair game; (2) third-party communications to the individuals must be produced if they place the claimants' own communications in context; (3) their photos and videos are fair game, but photos in which they are "tagged" are less likely relevant.

This is a very interesting case because it highlights the battle that is going to rage for years to come between the American jurisprudence viewpoint of discovery and the interest in privacy of what you post on the 'Net. "How much is too much in terms of what I post on a social networking site?" v. "If someone is posting it for everyone (or at least select everyone) to see, why can't I use it to prosecute or defend my lawsuit?" I wish I had the answer, but I think as privacy litigation and cloud computing law continue to evolve, these questions are going to become more prevalent.

Overall, I think Magistrate Lynch took a very reasoned approach to this problem. The issues raised in this case involve emotional distress, and the two claimants at issue both indicated that they had additional mental health traumas, above and beyond what one might "normally" expect in this type of case. Thus, if the question is "could the information shed some light on some aspect of this litigation" (which is always the question in discovery), then I think the answer has to be "Yes, it could be relevant to address those issues." It would be akin to a man claiming to have back pain arguing that photos of him water-skiing after the event in question aren't relevant. The simple fact is that our mental health and where we are emotionally is often evident in what we put on our social networking sites (as an aside, I will say that this is more true for some than others. Some people just need to stop posting things; but I digress). The items posted that show these claimants mental states are relevant. Now, the question of how relevant is still to be answered. If I'm the EEOC at this trial, I'm arguing that nobody posts things like "Today I was assaulted." or "I'm really depressed today because my supervisor assaulted me". For the most part, we sterilize (or most of us do) what we put into the 'Net. Thus, your social network profile is not an accurate snapshot of your emotional well-being.

To me, the more interesting question raised here is what happens when cloud computing law meets American discovery rules in the head-on, no-holds barred, death match that is coming. Things will be in the Cloud and there will be some passing relevance to an issue and then the fight will be on. The question in those cases, which I think is a question in this case as well, but that was not addressed by Judge Lynch, is the logistics of it all. Getting information back out of the Cloud, particularly archival information requires the cooperation of third-party entities and can be very burdensome and costly. Discovery is not meant to burdensome or overly complicated. Thus, we are going to be faced with issues of logistics that will need to be addressed. On top of that you add those pesky privacy litigation issue.

Of course, to bring this post to an actual close, this type of order is why I love these emerging legal questions that are derived from the advent and advancement of technology. There are so many facets to these issues and they strike at the heart of what we have always considered to be the core principles of litigation. But so long as you have parties either wanting money or wanting to avoid paying money, you will have zealous advocates turning over every stone to find the nuggets that make their case a win. And as the legal world polices itself, you will have these debates and conflicts over what is best for the individual case and what is best for the system overall. I think Judge Lynch's order alludes to and addresses both of those overarching concerns.

Cloud Computing: German data police say "Nein!"

Thursday, June 24, 2010 by Chris Stephen

This is one of those great posts that gets to combine cloud computing law with privacy law with political intrigue. Before I get too far in, I want to set out my own caveat. In my opinion, there is a data war brewing between the United States, EU, and China and everyone if vying for the top dog spot. The basis of this is the fact that each faction views the protection of data very differently and they each want to be the best. To just give you a surface level scratch of the differences I'll simplify (which is one of the things I do best): US is pro-capitalism / free market and free flow of information, even private data; EU is much more pro-individual and retention of private data, even at the detriment of businesses; China is much more pro-state and focuses on keeping data managed. Each entity thinks that they are completely right and they are trying to work together (except for China, who doesn't seem to care what anyone else thinks), but really they each have an ultimate goal of obtaining dominance of their position. Interestingly, I believe that the EU is seeking its dominance by applying economic pressures (something we've used for generations), and is having the most luck. Business are being forced to comply and are doing so in order to maintain market share. It is, nevertheless, very much a "cold war" between US and EU on the data protection front. And, as was anticipated, it is now entering into the realm of cloud computing law.

Before I delve into the ruling, I need to explain some concepts that I haven't put out here before. First, is that each member country of the EU has their own Data Protection Administration (DPA) that governs and rules over the access and permission to access private, individual data. In 1998, EU issued the European Directive on Data Protection that, among other things, prohibits the transfer of personal data to non-EU countries unless they haven't met the EU "adequacy" standards to protect the data. This directive actually causes great consternation in business as well as the litigation arena, privacy litigation or otherwise, because it limits what a U.S. defendant can legitimately produce. In a country where discovery in a lawsuit is often viewed as a fishing expedition in which one drains the lake and simply picks the fish up off the bottom, this limitation on access to data has caused and is causing businesses sleepless nights and making lawyers rich. Enter the U.S. Safe Harbor framework. This is essentially a compliance mechanism devised (supposedly) through joint efforts between the U.S. and EU that businesses can opt into by self-certifying that they comply. The main areas of focus are transfer of data, notice to the data holder, transfer to third-parties, access to data, security measures, and data integrity. If a business properly complies with this self-certification they will be deemed "adequate".

I know you've read all of this and said "What does any of this have to do with cloud computing law, you dolt!". To which I would reply, "ouch" and then go on to explain that yesterday, Germany's DPA made a ruling on the use of cloud computing and the implications to the European Directive. Most importantly, the DPA determined that clouds located outside the EU are per se unlawful, even if the EU has issued an adequacy decision in favor of the foreign country. Thus, if your cloud is based anywhere other than the EU, it is unlawful to store private EU data there (and in case your curious, everything is private data in the EU's eyes). Of course, the decision goes on to state that you can avoid this result if you apply German rules on data processing and using the EU-approved model contract for controller-processor data transfers. Basically, if you want to follow our rules and use our contract, you can do it.

What is even more interesting is that the DPA determined that the U.S. Safe Harbor is not adequate to protect information in the cloud. Thus, these companies that go through the self-certification process, still can't host cloud data (sorry Google). The reasoning is that even though one entity may have self-certified, the inherent nature of the cloud is that data is accessible to third-parties and those parties are not adequate.

This leaves the ultimate question of "what does this mean for cloud computing" The obvious answer is that it will force companies that want to utilize the cloud to either (a) adopt the EU rules and contracts or (b) enter a binding corporate rule that complies with the EU rules (which is another option the German DPA suggested). This will, ultimately, increase the costs associated with using the cloud and will likely have a cooling effect on pushes on that front. OF course, the developments that I will be watching from the cheap seats as an technology lawyer is what response the U.S. takes. Will it rely on businesses to police themselves and comply as they choose or will it try to enforce rules to keep the Safe Harbor alive. And, if Germany makes this type of ruling on the cloud now, essentially obliterating the Safe Harbor Framework, can Safe Harbor survive? Or more importantly, should Safe Harbor survive?

Imposing the long-arm of the law over the Internet

Wednesday, June 23, 2010 by Chris Stephen

Your friendly neighborhood technology counsel here: A couple of recent state court decisions are going to start personal injury attorneys frothing at the mouth, and might render some sleepless nights for defense attorneys. Both Ohio and Florida recently issued opinions in which they applied their state's respective long-arm statutes to garner personal jurisdiction over an out-of-state resident for tortious conduct that transpired over the Internet.

First, you need to know what a long-arm statute is. Essentially, it is a mechanism by which a state can obtain jurisdiction over an out-of-state resident for activities or actions undertaken that are related to an in-state resident or citizen. Without boring you with the legal details, they stem from the concepts of full faith and credit and due process and require a minimum amount of contact within the state to trigger. And, they have posed a pickle in Internet litigation because the Web allows access from out-of-state residents without actual presence or contact. At least that was the case until recently.

In Internet Solutions Corporation v. Marshall, the Florida Supreme Court, addressing a certified question from the Eleventh Circuit, determined that exercising jurisdiction over an out-of-state resident under Florida's long-arm statute did not violate due process. The basic facts are that Marshall ran a website based out of Washington, where she is a resident. She had no contact with Florida other than a short business related trip several years ago. However, she wrote a blog about a Florida based company and then she and some other posters trashed them online in the comment section. The Florida-based company sued for defamation in federal court under a diversity action (action between two citizens of different states). The district court found no personal jurisdiction and the Eleventh Circuit certified the question to the Florida Supreme Court. The Florida Supreme Court looked at two main analysis points: (1) whether the complaint alleged sufficient jurisdictional facts to being the action within the ambit of the statute, and (2) whether sufficient minimum contacts are demonstrated to satisfy due process requirements. The Court determined that both were satisfied. An interesting analysis point is that the Court reasoned that the long-arm statute had been applied to telephonic, electronic or written communications in the past and that the Internet is an extension of those rulings. Overall, it is a well-reasoned opinion applying a standard long-arm statute to the Internet.

Similarly, in Kauffman Racing Equipment, LLC v. Roberts, the Ohio Court of Appeals reached a similar conclusion when determining if an out-of-state residents comments over an Internet blog about an in-state plaintiff can be grounds for jurisdiction over the out-of-state resident in a defamation action. The Court utilized the same general analysis as in Marshall.

The obvious implications to Internet litigation of these opinions are pretty substantial. Until now, suing for tortious actions done over the Internet has been difficult because of those pesky due process minimum contacts, but that is slowly changing. These cases are a framework for an enterprising personal injury lawyer to sue someone that has never set foot in their state for tortious activities on the Web. And, right now we are only talking about defamation, but why wouldn't it extend to other torts. What about tortious interference with a business relationship, intentional infliction of emotion distress, and assault, to name a few. This is going to change the face of Internet litigation. We are going to see more lawsuits based on this. And, further, you, as a business owner, will need to be aware of what you are putting out on the cyberspace. You may be inadvertently exposing yourself.

And think of the other areas of technology litigation that this can be tied into. Two of the most predominant to me are privacy litigation and cloud computing law. Imagine that I have posted private information about you on the Internet in contravention to the law. We've never met and I've never been in your state, but the Internet has. Under these holdings, I can be hauled into the courtroom to address my actions. Or I've placed something into the cloud that doesn't belong. I've now exposed myself to multiple jurisdictions depending on to whom I have shown the material.

The ramifications are mind-numbing, but we'll see what other states start jumping on board. As I've always said, technology litigation and Internet litigation is in its infancy and we are going to see wide-spread changes from court's making decisions at the federal and state court level. It should be fun.

Social Networking and the Web - So much more than ambulance-chasing

Thursday, June 17, 2010 by Chris Stephen

Be prepared: I'm going to get on a bit of a soapbox. I read a recent article at WSJ.com entitled "Using Social Networking as Legal Tool" (Linked Below). There is nothing wrong with this article. It very succinctly and pleasantly explains how certain law firms are using social networking and the Web to find clients for high-value plaintiff cases. And I don't disagree with that approach. As an attorney posting on a blog, I too hope to use social networking to get business, and would be foolish to argue otherwise. Thus, I cannot fault the firms employing such tactics. And I am glad that a more "mainstream" press outlet would pick up a story of this nature; highlighting the use of technology by lawyers.

The fault that I find, and what, frankly, irks me, is that this article gives no credence to the more innovative aspects of technological use that are gaining hold in the legal community. The article highlights the practice of "ambulance chasing" for the 21st Century. But there is so much more happening in the cyberworld. Legal scholars like Eric Goldman are posting daily with the new and interesting ways that technology litigation and cyberlaw are being explored. Courts are posting their opinions on-line to further the pursuit of knowledge by the populace. Courts and communities are moving to on-line activity such as filing and case work to speed up the legal process and reduce our environmental impact. Technology legal counsel throughout the world are espousing the virtues and pitfalls of cyberlaw. Property rights are being generated in virtual worlds. Privacy litigation is defining what can and cannot be exposed in the real and virtual worlds. Software litigation is defining what can and cannot be done with these wonderful bits and bytes of information. Cloud computing law is going to dominate the future courtrooms of the world as more and more data is put into the cloud. All of these things are happening now.

Our world is becoming a smaller place as we all become more connected, and lawyers are at the forefront of those debates and discussions. Yes, I think it is very interesting that Law Firm X has 25 people on staff twittering and establishing domain names so that sufferers of acute hypersensitivity can find a law firm willing to represent them. PLEASE don't misunderstand me because I believe that allowing those people to easily find representation IS IMPORTANT. But it is not the only thing that is happening out there in the cyber-ether. Instead of focusing on the new and novel way that lawyers are getting business, let's shine light on how those in the legal community are using the Web to define, explain and expand our world.

WSJ article: (online.wsj.com/article/SB10001424052748704324304575306581598351428.html

Who are Alerding Castor Hewitt LLP

Friday, June 11, 2010 by Chris Stephen

Every once in awhile, I have the inkling to make a blog post that is not about developments in privacy litigation or technology litigation or cloud computing law or foreclosures or any of the other endless stream of ideas and legal thoughts that pass across my desk. This is one of those times. Because, while I think it is important for our readers to know that Mexico passed a new data privacy law or that litigation related to CAN SPAM is likely a rising field, I think it is equally important for our readers and clients to gain insight into the psyche of Alerding Castor Hewitt, LLP as it is viewed through the eyes of this humble writer. Thus the question: Who are Alerding Castor Hewitt, LLP.

First, I must note that I intentionally chose the plural tense in that question because, although I agree that Alerding Castor Hewitt, LLP is an entity that could be viewed as a singular, I fully believe that we are made of the people that permeate this place. Thus, we are a plural. Second, if what you are looking for is our resumes and the curriculum vitae of these Indiana technology counsel, you can check them out on our webpage.

Rather, I intend to discuss who we are in such a way that our readers and clients can relate to the ideals for which we stand. We are the rogues. We are the fighters. We are the fixers. We are the counselors. To a person, the attorneys at ACH are products of years of experience. We have all trudged through the mud of the legal profession in other locales before coming to this place. Which, inevitably, leads to the question of "why here?"

The answer to that simple question is that because here we can be what our clients need. We can be entrepreneurs. We can be fighters. We can truly embody the idea of counselor that so many of us sought when we went to law school in the first place.

Does that mean that I always give my clients the advise that they want to hear? No. My job, and the job of any great attorney, is to give the advise that is warranted in the situation. ACH not only gives its attorneys the ability to do that, but rather encourages it. I can honestly say that I have practiced from the biggest of big to the smallest of small, in the private sector and the public sector, and there is no place that I would rather practice law. I have told colleagues that ask me about ACH that I practice law in a way that every attorney wants to practice when they are honest with themselves as to what they want out of their profession.

This place is filled to the brim with spirit, humor, knowledge, and skill. And I think there are two quotes that best answer the question of Who are Alerding Castor Hewitt, LLP. The first is from Ulysses S. Grant. In a speech in London, Grant stated "Although a soldier by profession, I have never felt any sort of fondness for war, and I have never advocated it, except as a means of peace." The second is from Ode by Arthur William Edgar O'Shaughnessy, but was made famous (in my opinion) by Gene Wilder in Willy Wonka and the Chocolate Factory: "We are the music makers, And we are the dreamers of dreams."

China Issues its First E-Commerce Regulation

Thursday, June 10, 2010 by Chris Stephen

China has enacted the "Interim Administrative Measures on Internet-based Transactions of Goods and Related Services" that will take effect on July 1, 2010. This regulations should have a significant impact on e-commerce in China. One can only assume that it will also impact Software Service Level Agreements, SaaS law, and cloud computing law. The regulations appear to be focused on Business - to-Consumer issues and consumer-to-consumer activities, but the actual language of the regulation is pretty broad. There are quite a few requirements related to form, contracts, issuing receipts, collection and treatment of information, record retention, etc.

The main thrust of the regulation is to aimed at C2C platforms like taobao and E-Bay. These platforms will need to verify vendor information as being a real name with real contact details. It also push individuals to establish companies and obtain business licenses.

The impact that this regulation is likely to have on U.S. e-commerce or U.S. Business in general is likely nominal. However, it does illustrate a trend toward regulation. Luckily for me, more regulation means more work for yours truly.

Mexico Passes New Data Protection and Privacy Law

Tuesday, June 8, 2010 by Chris Stephen

Your friendly neighborhood technology counsel here: So, Mexico recently passed a new data protection law. On April 27, 2010, Mexico passed the Federal Law for the Protection of Personal data, which is likely to be signed into law by the President in the near future. This law not only allows for a mind-boggling $1.5 million penalty for violation, but it also applies to the private sector. Private and public entities will need to protect themselves from privacy litigation.

This law is much akin to the EU's data privacy laws. Meaning, among other things, that scope of the law is extremely broad. Additionally, all data is included, but certain types of data are given greater protection. This Sensitive Personal Data includes: "In particular, consider those that may reveal sensitive issues such as racial or ethnic origin, health status, present and future, genetic information, religious, philosophical and moral, union membership, political views, sexual preference." (translated from the Bill). The dissemination of any information that contains this sensitive data will require written consent from the owner of the data, the individual.

Now the $1.5 million question: What does this mean for my business? The simple answer is: Potentially alot. In the world of e-discovery and privacy litigation,this issue has already begun to rear its head in the context of the EU's data privacy law. With the number of American manufacturers and companies with a presence and facilities in Mexico, this type of broad legislation could result in the expenditure of millions of compliance dollars to craft protocols and document retention issues. Think of the billions of e-mails that must run through a Fortune 500 company. Now think about how many of those e-mails contain some amount of information that fits within the category I described above. To disseminate that information, each individual has to be contacted and give written consent. Like I said, mind-boggling.

Obviously, society is walking a thin line between protection of information and the availability of information for legitimate purposes. Privacy litigation both here and abroad is going to shape the breadth and direction of that line. And then, when we think we have a handle on it all, we'll start talking about what we are going to do under cloud computing law for that data that is stuck firmly in the cloud.

SaaS Licensing Payment Terms

Monday, April 19, 2010 by William Boncosky

We all know the beauty of the SaaS business model: great cash flow from up front payments, recurring revenue from clients that renew, ratable revenue recognition that results in smooth rather than lumpy revenue models, etc. But what if during your licensing agreement negotiations the client is pushing back and threatens some or all of these SaaS model advantages?

This is when its great to work with attorneys that have extensive SaaS legal consulting backgrounds; attorneys that not only understand ASP law or cloud computing law but can help achieve business goals during licensing agreement negotiations.

If a client does not want to pay up front, provide and incentive for them to do so. Give them 60 day payment terms and a 2% discount for paying for a 1 year subscription / license up front. That's better than receiving payment over a 13 month term, no? And if you are a start-up struggling to manage cash flow, a small discount for an up front payment is a small price to pay.

If this is a consistent issue, consider incentivizing your sales force for up front payments. Give them a bigger / better commission for clients that pay up front within 30 days.

Entrepreneurial Law – B2B, B2C and C2C

Monday, April 19, 2010 by David Castor

Indianapolis has done some amazing things in SaaS technology markets. As many readers of this blog know, much of my business law practice focuses on SaaS law, Internet law and funding law. Most of this is in business-to-business (B2B) SaaS markets. This week I was thinking about how this is not just true of my practice, but it also is true for Indianapolis as a whole. Most software companies in Indianapolis are in B2B markets.

The other two markets are business-to-consumer (B2C) and consumer-to-consumer (C2C).

The list of successful B2B SaaS or cloud computing companies in Indy is huge. Examples include ExactTarget, Compendium, BlueLock, Iasta, FormStack, iGoDigital, Aprimo and Cantaloupe, to name a few. A couple of emerging companies in this field that I expect to be stellar (because I love their applications and leadership teams) are Gauge Telematics and TinderBox.

B2C SaaS companies are those that sell SaaS applications directly to consumers. In Indianapolis the most popular examples may be Redcats USA and SigmaMicro. An emerging Indy company in this field is RewardSnap.

C2C Internet companies are often social media sites. These are companies built more on rapid scale and person-to-person buy-in than sellable units. The company value is in the ultimate consumer database rather than pricing for a SaaS application.

It is clear that the Indianapolis entrepreneurial culture accepts and supports B2B companies. It is less clear to me how much it supports or fully understands B2C and C2C markets. I have seen companies in these markets struggle to win peer support or obtain first-money funding locally; Whereas I see coastal investors much more willing to back companies in B2C and C2C markets.

Please Read Before You Click "I ACCEPT"

Wednesday, February 10, 2010 by Janet Monroe

SaaS litigation, software service level agreement, cloud computing law

How many times have you signed up for a service on-line, scrolled past all the legal jargon, and clicked "I Accept" or "I Agree" without taking the time to actually read the terms and conditions you're agreeing to?

Admit it. We all do it.

But, just as a warning to be careful the next time you're purchasing that new mp3, or more importantly signing your company up for something on-line... those shrink-wrap and click-wrap agreements have been held by the courts to be binding.

Contracting in cloud computing law doesn't necessarily require a signature these days. An affirmative acceptance of the provisions of a software service level agreement by an authorized agent can be given with a click of a button.

Take the recent trademark infringement case of Appliance Zone, LLC v. Nextag, Inc. for instance. Although this case was dismissed on grounds of jurisdiction (which, incidentally, was a term of the shrink-wrap agreement that was held by the court to be an effective document) the court discussed some important software litigation surrounding click-through agreements within it.

In essence, if the facts support a claim that a person (a) is authorized to enter into such a contract, and (b) had the intent to enter into it, then they will be held to terms of service they signed up for, including basic contracting terms such as jurisdiction, venue, etc, etc.

The court in this case cited Gallent Ins. Co. v. Isaac in ruling that there was authorized conduct that clearly demonstrated the acceptance of a valid contract by the 19 year old website manager of Appliance Zone who registered the company as a merchant on Nextag's website and clicked "I accept the Nextag Terms of Service" as part of the process.

While the enforceability of a contract can be destroyed with factors that make it unconscionable (such as inequality of bargaining power, or unreasonable or unknown terms) the court did not find those arguments sustainable in this case for a number of reasons, including the fact that clickable acceptance has become commonplace for on-line retail, and the registration process could not have been completed without the click-through acceptance.

The court in this Indiana technology litigation case fell back on Paper Exp., Ltd., Micrometl Corp. v. TranzAct Technologies, Inc. with the "fundamental principle of contract law that a person who signs a contract is presumed to know its terms and consents to be bound by them."

Next time, before you click "I Accept" make sure you really do.

Your SaaS Customer License / Subscription / EULA

Tuesday, January 26, 2010 by William Boncosky

For SaaS companies, the customer agreement is critical. Why? A SaaS relationship is not a 1-time purchase of software to be installed. The SaaS customer agreement is a document which will govern (what you hope will be) a long-term relationship with your client. It must cover the software license aspect of the relationship, the ongoing maintenance, upgrading and use of the software and - often overlooked - the professional services to be provided by the SaaS company to the client. The standard software license agreement is simply not sufficient. And please do all you can to talk your REALLY BIG client from insisting that you use a form purchase agreement.

I recommend a "Subscription Agreement" for the use of the software. This makes it clear what you are providing to the client - not a license to use software but access to a service during the subscription period. The SaaS client must also consider the relationship professional services play and the nature of the SaaS service being provided. Each will require customization of your SaaS customer agreement.

SaaS legal consulting requires a novel approach to client agreements. Knowledge of ASP law, SaaS litigation issues, cloud computing law, etc. is just a start. Make sure you discuss the unique nature of your SaaS service with a experienced SaaS law counsel so that you put the best agreement possible in front of your clients.

Bill Boncosky Joins the ACH

Monday, January 4, 2010 by Janet Monroe

Alerding Castor Hewitt, LLP, Indiana Technology Litigation, SaaS Litigation

Alerding Castor Hewitt, LLP is proud to announce the addition of Indiana technology lawyer Bill Boncosky to the firm.

The former General Counsel for ExactTarget, Bill has tremendous experience as technology counsel for one of the most successful technology start ups based right here in the heart of Indianapolis. A company that had just over a dozen employees when he joined, Bill has substantial experience in licensing agreement negotiations, ASP Law and Cloud Computing Law serving in that role for over seven years. He will be able to provide significant guidance based on solid experiences to many of our clients operating within this industry.

If you're looking for SaaS legal consulting, the attorneys at Alerding Castor Hewitt, LLP can help. The newest attorney to join the firm, Bill Boncosky, is no exception.

The other cloud hanging over L.A. - developments in cloud computing law

Monday, December 14, 2009 by Chris Stephen

Google announced in its blog today that Los Angeles has officially switched to using Google Apps for e-mail and collaboration. 34,000 city employees will now be using the Google cloud to do their work and, more importantly, their communication. This is a substantial development in cloud computing law. This will highlight the pros and cons of cloud computing for the future,and is likely to shape the success of other municipalities going the same way. Data issues and privacy litigation is likely to start popping up even more predominately related to the cloud. Plus the bloggers will get to continue to discuss the impact of Google taking over the technology world.

Overall, I think that cloud computing is the future, but as a technology legal counsel, I can't help but watch this development with youngster-like anticipation. As goes the cities, so goes the country. Keep your eyes on the horizon for developments from this jump by L.A.. The litigation that is possible from this decision by L.A. will be delectable.

E-books for Lawyers: The Future or Flash-in-the-Pan

Friday, November 20, 2009 by Chris Stephen

As an admitted technophile, I can't help but look into all the newest gizmos and gadgets. Plus, working at an information technology law firm, I can even bill it sometimes. Thus, I've recently begun a fascination with e-books. Jason Wilson has done a very interesting set of blogs looking at the use of e-books (or lack of use) for lawyers (www.jasnwilsn.com/). Jason's viewpoint is as a counterpoint to a recent set of blogs by Professor Eugene Volokh (volokh.com/2009/10/02/the-future-of-books-related-to-the-law/). I find this debate interesting for lawyers in general, but litigators specifically.

While I appreciate Jason's point of the importance of cloud computing and web based interfaces for lawyers, I have to admit that I personally think that e-readers are likely to have increasing presence in courtrooms around the country. I am genuinely intrigued by the thought of turning to my e-reader to "leaf" through a treatise on privacy litigation or ASP law that I've downloaded while sitting in a courtroom. This is particularly true when the courtroom that I'm sitting in is located in small town Indiana (or any other small town) that is still working on integrated computer systems and look at you askew when you ask about WI-fi. Web based interfaces are extremely important to the 21st century attorney, but there are still limitations. And if technology can allow me to carry treatises and law books that I might need before a court while still using my super sleek briefcase, I'm all for it.

Go for Home Court Advantage

Monday, November 16, 2009 by Janet Monroe

Indiana Software Litigation, Indiana Technology Counsel

Here at Alerding Castor Hewitt, LLP, often times we work with clients who have software that inherently transcends state and national borders.

Not just brick and mortor storefronts, many of our clients have customers nationwide and around the world.

Such is the realm of cloud computing law, and it's up to us as technology legal counsel to answer the inescapable question of what state, federal, or even country's law applies should a lawsuit arise.

Well, if you haven't contracted for this simple jurisdictional provision specifically in the terms of your license agreement or software service level agreement, as a SaaS company you may just find yourself flying over to London someday to deal with a breach of contract under U.K. law and their interpretation of your agreement.

All I have to say is good luck, and I hope you are prepared for those Barristers' premium legal rates.

Even if you win your case, you just wasted a tremendous amount of valuable time and money unnecessarily on SaaS litigation in the "wrong" venue.

I'm all for making the deal, but before you go shaking hands and rolling out your new Software as a Service application with a form agreement and without proper advisement, be sure to consult with reliable technology counsel to help you draft a solid agreement for your company's SaaS product.

SaaS Law - MBO Conference

Wednesday, October 21, 2009 by David Castor

I am speaking this afternoon at the MBO Conference on the Legal Landscape of Corporate Blogging. It was an honor to be invited to participate in this year's conference, and I am truly looking forward to the time.

As an Indiana technology lawyer I monitor areas of law that impact my clients' business worlds. My colleagues and I monitor Internet laws, privacy laws, ASP law, SaaS law, cloud computing law, and various other areas of business law to best advise our clients on how to navigate the legal landscape of emerging technology fields. Blogging law is the topic for today's talk.

We will be covering areas such as copyright infringement, defamation claims, privacy laws and Section 230 protections. We will also address the recent FTC Guidelines on endorsements by bloggers.

This should be an interesting discussion.

SaaS Law - Enterprise 3.0

Thursday, September 3, 2009 by David Castor

Indiana Technology Counsel - Enterprise 1.0

I read an interesting blog post by Thomas Klein of Sand Hill Group this week on the evolution and future of enterprise software.

Klein states that a new wave of enterprise software has emerged and is “pulsating through the economy” and venture capital will soon take notice. The new platform is marked principally by SaaS and cloud computing. The industry visionaries are referring to this new era of enterprise software as Enterprise 3.0.

I found Klein's summary of the history of enterprise software interesting. Here is an excerpt of his post:

Enterprise 1.0 occurred during the great mainframe expansion that began in the early 1950's and ran until the minicomputer revolution in the early to mid 1970's. Enterprise 1.0 was characterized by "Big Iron" mainframe computers with a few thousand dedicated connections to the machine, and once-a-day batch processing. IBM was dominant in this field with several other players that together were referred to as "IBM and the Seven Dwarfs." The dwarfs were Burroughs, UNIVAC, NCR, Control Data, Honeywell, GE and RCA, later after mergers referred to as "IBM and the BUNCH" (Burroughs, UNIVAC, NCR, Control Data, and Honeywell). Operating and application software were initially written in-house by programmers dedicated to their mainframe systems, until mainframe adoption spread into most large enterprises in the late 1950's and early 1960's.

At that time, independent software companies emerged to write specific applications. The Computer Usage Corporation (CUC) was founded by two former IBM employees in 1955, and by 1967, CUC had 700 employees in 12 cities. The Systems Development Corporation (SDC), a division of the RAND Corporation, was formed in 1956 to develop a large air defense system. SDC employed hundreds of programmers and was referred to as "programmer university". The Computer Sciences Corporation was formed with five founders in 1969, and had 68,000 employees by 1990. Most of these early entrants into independent software development were formed by programmers writing custom programs for individual customers. By the mid-1960's, however, independent software companies began developing and marketing software packages that could be used by many different types of customers. One innovator in this era was Informatics, which wrote and sold the hugely popular Mark IV database in the mid-1960's.

Although minicomputers were developed in the 1960's, their widespread adoption in the 1970's marked the flourishing of Enterprise 1.0. Digital Equipment Company, formed in 1964, was the first successful minicomputer maker, but other companies along Massachusetts route 128 joined in the growth of the minicomputer market during the 1970's: Data General, Wang Laboratories, Apollo Computer, and Prime Computer. Tracy Kidder won a Pulitzer prize for his non-fiction book The Soul of a New Machine, detailing the development of Data General's minicomputer. In 1984, there were 91 minicomputer companies in the United States. By 1990, there were less than 10.

The last hurrah of Enterprise 1.0 was the flourishing of software companies developing products for the minicomputer market. Some names were American Software (1970), Tesseract Systems (1970), Walker Interactive Software (1971), ASK Computer and Ross Systems (1972), Compuware (1973), Cyborg Systems (1974), Computer Associates and SAS Institute (both 1976), and Candle Corporation, J.D. Edwards, Oracle Corporation, Softool (all formed in 1977). The most successful enterprise software at the time was Computer Associates, which acquired dozens of software product companies. A well-known pioneer during this period was John Cullinane who in 1968 founded Cullinane Software, which was the first software product company to go public, in 1978.

The PC platform was the death knell for minicomputers as client-server architecture took over the enterprise in the early to mid-1980's, heralding Enterprise 2.0. Enterprise 2.0 was marked by data continuously available and updated, millions of connections to the network rather than mere thousands, and data available from the network almost anywhere, rather than just at a terminal connected to a mainframe or minicomputer. The client-server architecture required entirely new software at the system level, management level, and at the client level. With decentralization and distribution, the advent of networks, and Marc Andreesen's Mosaic user interface to the Internet (later commercialized at Netscape), Enterprise 2.0 was at its height, and another flourishing of enterprise software companies took place. There were not only Netscape, Microsoft, Oracle, Peoplesoft, Sybase, Informix, Platinum Technology, BMC, BEA, and Red Brick, but also Arbor, Aurum, Broadvision, Scopus, Simware, Sun's Java platform, and hundreds of other companies offering platforms, management software (e.g. Remedy's helpdesk software), security software, enterprise applications, and of course even client-level applications. The industry consolidated again in fits are starts over the next decade, accelerated by the recessions in 1990-91, the mild slowdown in 1994-95, and the tech bust of 2000-2002.

Today, the software industry is at the threshold of Enterprise 3.0, where data is continuously updated and available all the time from multiple devices anywhere in the world, with billions of connections to systems and users through online networks that are not tethered to a specific enterprise's system. Saas and Cloud computing are part of Enterprise 3.0, and cloud vendors are capitalizing on the infrastructure needs of the new paradigm. Enterprise 3.0 is characterized by vendors solving highly specific problems and providing highly customized solutions for customers by bringing together just the resources needed for that solution, and doing so on a model where almost all the infrastructure and development are outsourced in one form or another. The hosting of the data may be outsourced to a hosting company, the software development might be outsourced to a development team, other software might be purchased on a Saas model, and storage might be purchased on a terabyte basis from a cloud vendor. The ability to collaborate and affiliate easily are central to effecting these solutions for customers and making money in Enterprise 3.0.

There is a flourishing of SaaS, cloud, and infrastructure vendors filling market spaces in new Enterprise 3.0 sectors. Companies like Cast Iron Systems, Cloudera, Corticon Technologies, Gridapp Systems, Instantis, Kace, Marketo, Mobclix, Nirvanix, SOA Software, SmartVault, Vkernel, Wize, and Zetta are a few of the companies penetrating the multitude of new segments opened up by the Enterprise 3.0 paradigm. Many of these companies have received venture funding, and the venture capital community is once again very interested in enterprise software, albeit looking for specific niches that each venture group perceives as potentially high growth. Fortunately, Enterprise 3.0 offers a superabundance of these niches for investment capital. Accordingly, venture capital is alive and well in the new enterprise software market, and that is reason for optimism in the enterprise software industry.

As an entrprenuerial law and SaaS business law attorney, I am always on the lookout for trends in US private equity and venture capital in SaaS industries. This area of entrprise software licensing is one area I have noticed interest from private equity firms in the last 18 months or so.

~~~~~~

Alerding Castor Hewitt, LLP is an Indianapolis law firm focusing on business law, information technology law (including SaaS law and legal technology consulting), private equity consulting, and business and Internet litigation.

SaaS Debate – Who Is The Better Customer?

Monday, June 8, 2009 by David Castor

There was a great post on the bMighty blog last week regarding the debate between who Infrastructure as a Service (IaaS) is better targeted for – large enterprises (+1,000 employees) or small to midsize businesses (SMBs).

According to a recent Forrester research report on cloud computing models entitled Conventional Wisdom is Wrong About IaaS, a higher percentage of enterprise-level businesses are interested in Infrastructure as a Service than SMBs. Fredric Paul, the blog author, argues that despite this report cloud computing is more appropriate at the SMB level. The reasons include: less legacy infrastructure, fewer security and compliance issues, greater capital expenditure constraints, smaller internal IT staffs, and a bigger appetite for innovation.

He concludes by stating: “Given the exponentially larger number of small and midsize businesses, even if they're a few percentage points less likely than enterprises to head to the cloud, there will still be waaayyyy more SMBs in the cloud than there will be enterprises.”

Over the last year I have seen the debate between the value of cloud computing, and SaaS, for enterprise vs. SMBs grow. This is quite important to any cloud computing or SaaS business which is trying to refine its target market. Many IaaS and SaaS businesses focus solely on SMBs, as described in Chris Anderson’s book The Long Tail. Part of the reason is that this previously under-addressed market segment is huge – and there is much opportunity for quick sign on and customer benefit. But, larger contract scale and margins from enterprise customers make that segment too enticing to ignore – especially in light of the growing trend of buy-in from these types of businesses.

~~~~~~

Alerding Castor is an Indianapolis law firm focusing on business law, information technology law (including SaaS law and legal technology consulting), private equity consulting, probate and business litigation.

SaaS Law - Cloud Computing meets U.S. Spending

Sunday, April 5, 2009 by David Castor

There is a huge potential savings for the U.S. government in adopting SaaS technologies, cloud computing infrastructure and open source software. Last week President Obama requested Scott McNealy, ex-CEO and co-founder of Sun Microsystems, to produce a report on potential benefits of such a move. The current U.S. government IT budget is approximately $70 billion per year.

According to a recent study by MeriTalk, Red Hat, and DLT Solutions, the U.S. government could save $3.7 billion by using open source software, $13.3 billion by using virtualization, and $6.6 billion from using SaaS applications. This assumes an integrated model combining the three technologies.

The U.K. government recently announced its plans to accelerate deployment of open source software. According to Simon Phipps, Chief Open Source Officer for Sun Microsystems, "We waste a fortune on proprietary computer software because of paying for licenses and promises up front and not demanding value."

In any economic environment this makes sense, but with the current economic climate the adoption of an integrated SaaS, cloud computing, and open source model appears necessary.

Alerding Castor's SaaS law / Entrepreneurial law practice partners with several SaaS, cloud computing and virtualization businesses. We help these clients through their strategic business growth, including negotiating licensing transactions, providing legal technology consulting, offering direction on capitalization and private equity, and counseling on general business law matters. See our Partners in Success page to see a listing of a few of these companies.

What Exactly is Cloud Computing?

Saturday, February 14, 2009 by David Castor

Thank you for continuing to read the Business & Culture Blog. The purpose of this blog is to address those areas of innovation, leadership, entrepreneurship, technology and community that lie at the intersection of business and culture. My law practice focuses on software licensing, entrepreneurship law, SaaS law, legal technology consulting and private equity and funding law. My goal is for this blog to assist business owners and leaders become more excellent at their craft. Be sure to subscribe to this blog by clicking the RSS Feed here.

~~~~~~

A group of researchers from UC Berkeley's Schools of Engeneering and Computer Science published a white paper this past week addressing the state of cloud computing, including its opportunities and obstacles.

There is a lot of confusion on what exactly makes up cloud computing. Here is an excerpt from the white paper addressing that issue:

Cloud Computing refers to both the applications delivered as services over the Internet and the hardware and systems software in the datacenters that provide those services. The services themselves have long been referred to as Software as a Service (SaaS), so we use that term. The datacenter hardware and software is what we will call a Cloud.

When a Cloud is made available in a pay-as-you-go manner to the public, we call it a Public Cloud; the service being sold is Utility Computing. Current examples of public Utility Computing include AmazonWeb Services, Google AppEngine, and Microsoft Azure. We use the term Private Cloud to refer to internal datacenters of a business or other organization that are not made available to the public. Thus, Cloud Computing is the sum of SaaS and Utility Computing, but does not normally include Private Clouds. We’ll generally use Cloud Computing, replacing it with one of the other terms only when clarity demands it. Figure 1 shows the roles of the people as users or providers of these layers of Cloud Computing, and we’ll use those terms to help make our arguments clear.

The advantages of SaaS to both end users and service providers are well understood. Service providers enjoy greatly simplified software installation and maintenance and centralized control over versioning; end users can access the service “anytime, anywhere”, share data and collaborate more easily, and keep their data stored safely in the infrastructure. Cloud Computing does not change these arguments, but it does give more application providers the choice of deploying their product as SaaS without provisioning a datacenter: just as the emergence of semiconductor foundries gave chip companies the opportunity to design and sell chips without owning a fab, Cloud Computing allows deploying SaaS—and scaling on demand—without building or provisioning a datacenter. Analogously to how SaaS allows the user to offload some problems to the SaaS provider, the SaaS provider can now offload some of his problems to the Cloud Computing provider. From now on, we will focus on issues related to the potential SaaS Provider (Cloud User) and to the Cloud Providers, which have received less attention.

The white paper concludes with addressing the top 10 obstacles and opportunities for cloud computing.

~~~~~~
See also:

SaaS in 2009 II - High Market Growth
SaaS in 2009 - Positive Outlook
Cloud Computing in 2009 - A Trend in Hosting
Private Equity in 2009 - Don't Give Up