Blog

May 21, 2012

Is Your Data in the Cloud Really Yours?

Filed under: All Blog Postings — Craig Pollack @ 10:06 am

As more and more companies look to the cloud to store their information, such as the recently unveiled Google Drive, the era of being able to mindlessly click “OK” or “Agree” on the terms of usage may be over. When your information is stored on your network, you (or one of your IT minions) are responsible for keeping it safe, secure, and backed up.  But when you shift from local storage to "the cloud", you need to understand that you now live by the terms and conditions set by someone else.  There are two sets of word-dense documents you need to read before marrying yourself to a cloud-service: the privacy policy and the terms of service. Yes, the words will bleed together from all the legal jargon, but they’re important. Every service has its own terms, and what’s in there and how it’s written vary widely.

Remember that when you upload content, you are essentially publishing it - even if you think it’s just for your eyes. For any cloud service to work as designed, you give the service permission to store and make copies of the content you upload - this is how your stuff ends up everywhere you want it. The cloud copy is the master. Google, for instance, clearly states in its terms of service that apply to all things Google: “You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.” But where the Google policy may read a bit murky is what you entitle Google to do with it: “When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.” That permission continues even if you stop using the services, the contract says. Google issued a statement, explaining why it, or for that matter others such as SkyDrive or SugarSync, would need to spell out its rights with your content. “Our Terms of Service enable us to give you the services you want - so if you decide to share a document with someone, or open it on a different device, you can.”

Competing cloud service Dropbox makes no claims to user content. “You retain full ownership to your stuff,” the terms of service reads. “We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services.” I’ve read and reread terms and privacy policies from SugarSync and another service called Box, and they don’t seem to make mention of ownership of your content. And what about someone else, such as law enforcement, trying to access your information? With your own server, you’d have to be served a warrant for legal access to your hard drives. But with remote storage, you may not know whether a subpoena or warrant has been served on the cloud service provider, depending on what the company says it will do in the terms of service.

One thing is certain - as these services become more and more integral in how we store and access our information, the companies will need to prove themselves trustworthy as we bank our bits and bytes with them. “All of this comes back down to trust,” said Frank Gillette, an analyst at Forrester Research. “These organizations, like banks, have to convince people they are trustworthy.”  Unlike banks, however, there is no insurance for the security - and replacement - of our information stored online. Although nearly every provider’s terms read differently, one thing remains the same. They all tell you explicitly they are not responsible for any loss you experience.

So before jumping on the cloud bandwagon, you might want to figure out how to back yourself up if your stuff should dissipate like an actual cloud in the sky.