Corrs Chambers Westgarth law firm has received a request to use public cloud storage services to receive client data and information. However, the document outlines several risks associated with using public cloud storage services, including data leakage, service compromise, and access to data by US authorities under the Patriot Act for US-based cloud services. As an alternative, the law firm has implemented a secure file transfer solution and recommends clients use this option instead of public cloud storage due to the security risks. The client must acknowledge understanding the risks if they still wish to use public cloud storage to transmit their data to the law firm.

1. 3461-2205-2097v1
567 Collins Street, Melbourne VIC 3000, Australia
GPO Box 9925, Melbourne VIC 3001, Australia
Tel +61 3 9672 3000
Fax +61 3 9672 3010
www.corrs.com.au
Sydney
Melbourne
Brisbane
Perth
Request for use of public cloud storage services to
transmit information to Corrs.
You have requested that Corrs Chambers Westgarth (Corrs) use public cloud storage services to
receive your data/information. Before organising the use of public cloud storage services, we would
like to draw your attention to some of the risks inherent in this technology, and suggest a secure
alternative method for receiving your data.
Risks of public cloud storage services
Public cloud storage allows for documents to be stored and hosted in the cloud ie on infrastructure
owned, managed and maintained by a third party. Third party cloud services such as Dropbox,
GoogleDrive, SkyDrive and Apple’s iCloud are becoming increasingly popular as they allow users to
store and access large quantities of information from any device, anywhere and at anytime.
There are, however, a number of risks associated with use of public cloud services including:
1 Data leakage and malicious interception
A user might send documents from their work computer to Dropbox, which they may access
from any number of locations or devices (such as their home computer or smart phone). As the
level of security applied to these devices is unknown, the potential exists for a copy of any
document accessed to be left on the device and available to subsequent users of the device
including those with malicious intent.
2 Service compromise
Third party cloud storage providers are not without their own issues. Last year Dropbox was
subject to a significant security breach (due to a programming error) where anyone could log
into another users’ account without entering a password. Generally these service providers
make their services available ‘as is’ and seek to disclaim any liability for loss arising from their
use including corruption of data, hacking or other security intrusions.
3 US Patriot Act
Many public cloud services are provided by US based companies such as Microsoft who are
subject to the US Patriot Act. The Patriot Act grants US authorities broad powers to access
and carry out surveillance of data stored within or outside US territory, by US companies and
their non-US based affiliates if suspected of terrorism. This means that if information is stored
in a US based or owned cloud, it may be accessed by the US government without notice.
Use of public cloud storage services
Due to the risks associated with these services Corrs does not recommend the use of public cloud
storage services. We do however recognise that some clients still require the use of public cloud
storage services to transfer/receive their data. Accordingly, Corrs will only adopt this technology for
use in transmitting data where it is specifically requested by a client. In doing so you, the client,
acknowledge and accept full responsibility for any loss or damage flowing from the use of public cloud
storage services and the risks identified above.
Corrs, and Corrs Support Services Pty Ltd as trustee for the Corrs Support Services Trust (CSS),
collectively, the Corrs Group, our employees, partners, officers, consultants and agents exclude all
liability whatsoever in connection with the use public cloud storage services, including without
limitation, any liability in tort (including negligence). The Corrs Group, our employees, partners,
officers, consultants and agents further exclude any liability for indirect, consequential or special
damages (including loss of revenue or profit, savings, goodwill, reputation or data) whether or not
such loss was foreseeable.

2. 3461-2205-2097v1 page 2
Alternative file transfer
To assist clients in transferring large files, we have implemented secure file transfer solution and it is
our strong preference that this technology be used. We would be happy to work with you to provide
this service.
Acknowledgment
I, [ ] on behalf of [ ], confirm that I have read and understood the
above information, including the risks associated with public cloud storage services, and request that
Corrs receive our information via public cloud storage services.
……………………………………………. …………………………………….
Signature Date