Cloud Computing: Can You Retrieve Your Data?

As the hype over cloud computing continues, many CFOs wonder about worst-case scenarios. For the purposes of auditing or in case of litigation, how will the company retrieve crucial e-mails, HR records, transaction data and other financial documents in a cloud environment?

 
“The actual processes and procedures are completely dependent upon the cloud provider, so the process will vary in each case,” says Jim Shook, director of EMC Corporation’s e-discovery and compliance legal team. “Sometimes the cloud provider will make tools available for self-help, but most frequently the discovery process is completely ad-hoc.”
 
Shook spoke to Carol Ko of Asia Cloud Forum (CFO Innovation’s sister publication, owned by Questex Media), on electronic discovery (e-discovery) issues in a cloud environment and how companies can make sure they have the ability to access needed information for auditing, litigation and other purposes.   
 
What is e-discovery?
It can actually mean a lot of different things. Most frequently, e-discovery relates to identifying, preserving, collecting and processing electronically stored information for the purposes of litigation.
 
For example, if a company is involved in a lawsuit in the United States, one of its obligations is to find all e-mail messages that relate to the issues that are disputed, and then provide them to the other side in the lawsuit, regardless of whether they are helpful or damaging to the case.
 
E-discovery is also a term that is being used more frequently outside of the litigation context. For example, many companies that conduct internal investigations or audits, and many regulators overseeing companies, require access to information that is stored electronically. The process is very similar to that in litigation, but has broader implications, especially outside of the U.S.
 
Are you seeing growing demand for e-discovery in Asia?
There is absolutely a growing demand for e-discovery in Asia, and I can see three very strong reasons:
 
  • Any company that transacts business with US or UK-based companies, or does business within those countries, may be subject to a lawsuit that will require e-discovery.

 

  • Regulators throughout the world require access to information, and more frequently, that information is only available electronically. More data is “born digital” -- some studies suggest that 80 to 90% of information is never available on paper. 

 

  • Companies conducting internal audits or investigations also have a need for e-discovery processes, for the same reasons as the regulators. 
 
How similar or different is conducting e-discovery in traditional self-managed data centers versus third-party managed cloud computing facilities?
There is an enormous difference.
 
In a self-managed data center, an entity has access to all of the data. It controls the personnel, and it can build tools or hire additional help to access the necessary information. In a third-party managed facility, the ability to conduct e-discovery is controlled by the relationship between the parties [frequently through a written contract] and the party needing the discovery is almost entirely dependent upon the cloud provider.
 
Sometimes the cloud provider will make tools available for self-help, but most frequently the discovery process is completely ad-hoc. 
 
  • 1
  • 2
  • 3
  • Next page