Licensing in the Cloud (2013 Rocky Mountain IP and Technology Institute) (May 2013)
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPCopyright 2013 BryanCave LLPMay 30, 2013Jason D. Haislmaierjason.firstname.lastname@example.orgLicensing Issues in the CloudCopyright 2013 BryanCave LLP
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPThis presentation is intended for general informational purposes only and should notbe construed as legal advice or legal opinion on any specific facts or circumstances,nor is it intended to address specific legal compliance issues that may arise inparticular circumstances. Please consult counsel concerning your own situation andany specific legal questions you may have.The thoughts and opinions expressed in this presentation are those of the individualpresenters and do not necessarily reflect the official or unofficial thoughts or opinionsof their employers.For further information regarding this presentation, please contact the presenter(s)listed in the presentation.Unless otherwise noted, all original content in this presentation is licensed under theCreative Commons Creative Commons Attribution-Share Alike 3.0 United StatesLicense available at: http://creativecommons.org/licenses/by-sa/3.0/us.
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPWhat is it?Cloud
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPCloudWhat is it?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPSteve BallmerCEO,Speaking at a Microsoftevent in Singapore“Im not sure my goal for today is going to be toactually explain it to you, but I do want to makesure that people understand that I think everybodyin our industry accepts its the next majortransition point in terms of how IT gets done.”
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPCloudWhat is it?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPNIST Definition• Initial draft – April 24, 2009• Final draft (v16) – October 25, 2011• In practice, the definition has continued to evolveWhat is Cloud Computing?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Still emerging and rapidly expanding• Many models, many providers, many markets• Computing resources or functionality delivered as a service over a network• Common traits– On-demand (self-service)– Pooled resources (“multi-tenant”)– Rapid provisioning (high elasticity)– Dynamically assigned resources (“Infinite” capabilities)– Broad network access (ubiquitous)– Location and device-independent– Thin client interface (e.g., a web browser)• Increased access to applications, data, and functionality• Reduced costs (for infrastructure, support, and staffing)• Reduced need for knowledge and control of resourcesKey CharacteristicsWhat is Cloud Computing?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Private cloud– Owned or leased by a single organization (“internal” cloud)– Operated solely for that organization• Community cloud– Shared by several organizations– Supports a specific user community (often with shared concerns)• Public cloud– Owned by a company selling cloud services– Mass-market model• Hybrids and combinations aboundCloud Models - DeploymentWhat is Cloud Computing?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Software as a Service (SaaS)– User does not manage or control the underlying infrastructure– Limited user ability to set configuration settings (mass-market software)• Platform as a Service (PaaS)– User does not manage or control the underlying infrastructure– User selects (and even builds) the applications and other software running on theinfrastructure• Infrastructure as a Service (IaaS)– User does not manage or control the underlying infrastructure– User selects and configures the fundamental resources running on the infrastructure(operating systems, storage, applications, and other networking components)– User selects and controls (and even builds) the applications and other software runningon the infrastructureCloud Models - DeliveryWhat is Cloud Computing?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPUnderstand the similaritiesUnderstand the differencesUnderstand why they matter
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPMany Issues– Some New, Some NotLicensing in the Cloud• Cloud computing represents a paradigm shift from the traditionalenterprise software delivery model• Paradigm shift does not mean an entirely new paradigm• Cloud computing shares many legal issues in common with legacylicensing models, but poses new legal challenges– IP and software rights– Service levels and performance– Privacy and security– Data protection, rights, and usage– Cross-border issues– Legal compliance issues• Lessons learned from traditional software licensing are often applicable
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPTransparency and UnderstandingCloud
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPTransparency and Understanding
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPUnderstand The Nature of the ServicesTransparency and Understanding• Cloud services often rely on multiple levels of providers– Offer expanded cloud service offerings– Provide additional capacity– Spread risk• Conduct diligence and clarify how the services are actuallybeing provided• Require responsibility/liability by the primary provider for allother providers• Understand how software, IP and data will be affected• Solidify ownership and rights• Understand inherent limitations
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPRights inSoftware and IP
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Cloud services are moving beyond vendor-provided software– Many permit customer-supplied software in addition to standard applications (BYOS)– Increasingly allow for the development of software to run on the cloud platform• Contracting models can vary significantly– Scope of license– Ownership of developments– Pricing (users, processors, actual use, etc.)– Rights after cloud services end• Likewise, vendor-provided software is increasingly comprised of third partyand open source software• Understand how licensing and ownership models may impact the servicesEvaluate and Clarify Ownership and RightsSoftware and IP
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPRights in Data
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPDo you know where your data is?Do you know what data is yours?Does your provider know?
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Increasingly lucrative model for cloud providers to obtain rights in the data• Define “data” (both existing and generated through the services)• Specify ownership rights• Grant provider specific (and limited) rights in the data– Use as required to provide the services– Limited (if any) use for other purposes– Only permitted monitoring and access• Protect data as confidential information where applicableSecure Rights in DataData
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Cloud computing services are inherently “stateless”• Resources are dynamically and constantly re-provisioned• Servers are located in multiple different locations (and often countries)• Never anywhere, but always somewhere• Can and does create jurisdictional and regulatory issues– Cross-border flows of software, IP, and data– Compliance with applicable regulations– Potentially conflicting outcomes• Obtain transparency and control– Specified locations– Limitations/notices regarding changes– Specified ownership and license rights– Required audit trailInherently Cross-BorderCross-Border Legal Issues
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Cloud provider business models rely on the adoption of astandard platform– Standard service offerings– Standard performance and service levels• Providers are often (still) reticent to negotiate changes to service levels• As the sophistication and volume of services grow, so does the needfor flexibility• At minimum, understand the limitations on the service being received andhow they may impact your requirements and expectations• Strong parallels to IT outsourcing agreementsStandard Platform, Standard Service LevelsService Levels
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPTermination and Transition
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Dependency on cloud services is increasing• Understand you level of dependency• Adjust termination triggers as needed• Understand practical barriers to transitioning to a new service provider• Obtain necessary visibility into services– Software and hardware used to provide services– Applicable software licensing terms– Relevant subcontractors– Compatibility and interoperability issues• Provide for transition assistance where needed– All services provided during the term of the agreement– Assistance needed to transition to a new providerControl Termination and TransitionTermination and Transition
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLPWhat Happens When the Provider FailsBusiness Continuity and Disaster Recovery• How long could you operate without access to:– Services?– Software?– Data?• Provide for a business continuity plan (BCP)– Understand your current BCP– Diligence provider’s existing BCP– Set minimum requirements for the BCP in the agreement– Restrict changes to the BCP– Include audit rights to ensure implementation of the BCP• Consider data back-up (or even service back-up) through a secondaryprovider
Copyright 2012 Bryan CaveCopyright 2013 BryanCave LLP• Cloud services are growing ever more sophisticated• The importance of cloud services will only increase• In addition to data, significant software and IP is now developed throughcloud services• Take the time to understand the nature of the cloud services beingprovided• Leverage legal concepts from traditional software licensing to addressissues that matter to your business• Having flexibility and additional rights can be important, even if you haveto pay for themParadigm Shift, But Many Existing Rules ApplyClosing Thoughts